Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how Off the Ruck ("we," "us," or "our") collects, uses, discloses, and protects your personal data when you use our website, services, and applications (collectively, the "Services"). We are committed to protecting your privacy and handling your data in an open and transparent manner.

Given our operational base, we prioritize compliance with the Sri Lanka Personal Data Protection Act, No. 9 of 2022 (SL DPA), alongside the principles of the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other global privacy frameworks.

2. Data We Collect

We collect several types of information for various purposes to provide and improve our Services to you.

A. Data You Provide Directly

• Identity Data: Name, email address, postal address, phone number.
• Profile Data: Username, password, preferences, feedback.
• Financial Data: Payment card details (processed by secure third-party processors, we do not store full details).

B. Data Collected Automatically (Technical Data)

• Usage Data: Information on how you access and use the Services (e.g., pages viewed, time spent, click patterns).
• Device Data: Internet Protocol (IP) address, browser type, operating system, device identifiers.
• Location Data: General location derived from your IP address or, with your consent, precise location data.

3. How We Use Your Data

We use the collected data for various purposes, including:

• To provide and maintain the Services, including processing transactions.
• To notify you about changes to our Services or policies.
• To allow you to participate in interactive features of our Services when you choose to do so.
• To provide customer support and respond to inquiries.
• To monitor the usage and technical performance of the Services.
• To detect, prevent, and address technical issues or fraud.
• To send you marketing and promotional communications, in accordance with your preferences.

4. Legal Basis for Processing (For EU/EEA Users - GDPR)

If you are from the European Economic Area (EEA), our legal basis for collecting and using the personal data described in this Privacy Policy depends on the Personal Data we collect and the specific context in which we collect it. We may process your Personal Data because:

• The processing is necessary for the performance of a contract with you (e.g., processing your payments).
• You have given us permission/consent to do so (e.g., for optional marketing).
• The processing is in our legitimate interests (and not overridden by your rights).
• We need to comply with the law (e.g., tax or accounting regulations).

5. Data Sharing and Disclosure

We may share your personal data with third parties in the following situations:

• Service Providers: We engage third-party companies to facilitate our Services (e.g., payment processors, hosting services, analytics providers). These third parties are bound by confidentiality agreements and are prohibited from using your Personal Data for any other purpose.
• Legal Requirements: If required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).
• Business Transfers: In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business.

7. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track the activity on our Services and hold certain information. Cookies are files with a small amount of data which may include an anonymous unique identifier.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service. We use:

• Necessary Cookies: Essential for the operation of the Service.
• Preference Cookies: To remember your preferences and various settings.
• Statistical/Analytics Cookies: To analyze how users interact with the Service.

8. International Data Transfers

Your information, including personal data, may be transferred to — and maintained on — computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction.

If you are located in the EEA and your data is transferred outside the EEA, we ensure a similar degree of protection is afforded by ensuring at least one of the following safeguards is implemented:

• We will transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
• We use specific contracts approved by the European Commission which give personal data the same protection it has in Europe (Standard Contractual Clauses).

9. Data Retention, Security, and Breach Notification

We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We take reasonable and appropriate measures to protect your Personal Data from unauthorized access, disclosure, alteration, or destruction. However, remember that no method of transmission over the Internet or method of electronic storage is 100% secure.

Data Breach Notification (SL DPA Requirement)

In compliance with the Sri Lanka Personal Data Protection Act, in the event of a personal data breach that is likely to result in a high risk to the rights and freedoms of data subjects, we commit to notify:

• The Data Protection Authority of Sri Lanka without undue delay.
• The affected data subjects without undue delay, where required by law.

10. Children's Privacy

Our Services are not intended for use by anyone under the age of 13 ("Children"). We do not knowingly collect personally identifiable information from anyone under the age of 13. If you are a parent or guardian and you are aware that your Children has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from children without verification of parental consent, we take steps to remove that information from our servers.

11. Changes to this Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top of this Policy. You are advised to review this Privacy Policy periodically for any changes.