Privacy Policy

Last updated: 23 May 2025  ·  Effective date: 23 May 2025

EPCOM Technology ("we", "us", "our") operates the website epcom.lk and is committed to protecting your personal data in accordance with the Personal Data Protection Act No. 9 of 2022 of Sri Lanka (PDPA) and all other applicable laws. This Privacy Policy explains what data we collect, how we use it, and your rights as a data subject.

1. Data Controller

2. Personal Data We Collect

When you create an account or submit a quotation request, we collect:

• Identity data: first name, last name
• Contact data: email address, phone number
• Business data: company name (optional)
• Transaction data: quotation requests, selected products, preferred configurations
• Technical data: IP address, browser type, and usage information collected automatically when you visit epcom.lk

We do not collect payment card details. All payments, if applicable, are processed separately through authorised channels.

3. Legal Basis for Processing

Under the PDPA, we process your personal data on the following lawful bases:

• Contract performance: to process your quotation requests and manage your account
• Consent: when you voluntarily register an account and agree to this policy
• Legitimate interests: to maintain site security, prevent fraud, and improve our services
• Legal obligation: to comply with applicable Sri Lankan law, including tax and commercial record-keeping requirements

4. How We Use Your Data

• To create and manage your customer account
• To process and respond to your quotation requests
• To send you order-related communications (e.g. quote confirmations)
• To notify you of stock availability or price changes, only if you have opted in
• To improve our website and services
• To comply with legal and regulatory obligations

We will never sell your personal data to third parties or use it for unrelated marketing without your explicit consent.

5. Third-Party Service Providers

We share data with the following trusted processors solely to deliver our service:

• Google LLC (reCAPTCHA v3): We use Google reCAPTCHA to protect our registration form from automated abuse. Your interaction with the registration page is subject to Google's Privacy Policy and Terms of Service. Google may process your IP address and behavioural signals.
• Hosting / Infrastructure providers: Our web servers and database are operated by providers bound by confidentiality and data-protection obligations. Data is hosted within a jurisdiction with adequate data protection standards.

Any cross-border transfer of personal data is conducted in compliance with Part V of the PDPA.

6. Data Retention

• Account data: retained for as long as your account is active. If you request deletion, we will erase your personal data within 30 days, subject to legal retention obligations.
• Quotation records: retained for a minimum of 7 years to comply with the Inland Revenue Act No. 24 of 2017 and commercial record-keeping requirements.
• Technical / log data: retained for up to 90 days for security and diagnostic purposes.

7. Your Rights Under the PDPA

As a data subject under the Personal Data Protection Act No. 9 of 2022, you have the right to:

• Access the personal data we hold about you
• Correction of inaccurate or incomplete data
• Erasure ("right to be forgotten") where data is no longer necessary, or where you withdraw consent
• Restriction of processing in certain circumstances
• Data portability in a machine-readable format, where technically feasible
• Withdraw consent at any time, without affecting the lawfulness of prior processing
• Object to processing based on legitimate interests

To exercise any of these rights, please contact us at sales@epcom.lk with the subject line "Data Subject Request". We will respond within 30 days. Where a request requires identity verification, we may ask for reasonable proof of identity before proceeding.

You also have the right to lodge a complaint with the Data Protection Authority of Sri Lanka (established under the PDPA) if you believe we have processed your data unlawfully.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. Passwords are stored using an industry-standard one-way hashing algorithm (bcrypt). Access to personal data is restricted to authorised staff only.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Authority and, where required, affected individuals, in accordance with the PDPA.

9. Cookies

We use cookies that are strictly necessary for the website to function (e.g. session and security tokens). We also use Google reCAPTCHA, which sets its own cookies. By using epcom.lk you consent to the use of these essential cookies. We do not use advertising or tracking cookies.

10. Children's Privacy

Our services are not directed at persons under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us for prompt deletion.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law or our practices. The updated version will be published on this page with a revised "Last updated" date. For material changes, we will notify registered customers by email.

12. Contact Us

For any privacy-related questions or to exercise your data subject rights: