Privacy Policy

ECTOPAY Mall | ECTO PAY (PRIVATE) LIMITED

Website: https://ectopay.com
Effective Date: 14 November 2026
Last Updated: 14 November 2026

1. Introduction

Welcome to ECTOPAY Mall, an online shopping and digital services platform operated by ECTO PAY (PRIVATE) LIMITED (“ECTOPAY”, “we”, “us”, or “our”).

We respect your privacy and are committed to protecting the personal information entrusted to us.

This Privacy Policy explains how we collect, use, process, store, disclose, and protect personal information when you access our website, create an account, purchase products, obtain software or digital services, make recharge transactions, pay utility bills, or communicate with us.

Our services may include:

• Online shopping and physical product sales.

• Software sales, digital downloads, subscriptions, and license services.

• Mobile phone recharges and data packages.

• Utility bill payments and digital payment services.

• Customer account management and order tracking.

• Technical support and other related online services.

By using our services, you acknowledge this Privacy Policy. Where consent is required by applicable law, we will request it separately.

2. Information We Collect

We may collect the following categories of information, depending on the services you use.

2.1 Personal Identification Information

• Full name.

• Email address.

• Mobile or telephone number.

• Billing and delivery addresses.

• Account username and customer identification details.

• Other information voluntarily provided when contacting customer support.

2.2 Account Information

When you register an account, we may process your login credentials, account preferences, purchase history, saved addresses, and account activity.

Passwords should be stored using appropriate security protections rather than as readable plain text.

2.3 Shopping and Order Information

When you purchase products, we may collect:

• Products ordered and quantities.

• Order numbers and transaction dates.

• Billing and delivery information.

• Payment and order status.

• Shipping and tracking details.

• Returns, refunds, and warranty requests.

• Customer communication relating to purchases.

We use this information to manage orders, arrange delivery, provide support, and maintain business records.

2.4 Software and Digital Product Information

When purchasing or using software and digital products, we may process:

• Purchased software or digital product information.

• License keys and activation records.

• Subscription and renewal information.

• Software version and compatibility information.

• Device or installation identifiers where required for activation.

• Download history and relevant technical diagnostic information.

• Technical support requests.

Where a software product is supplied by a third-party developer, relevant information may be shared with that developer or licensing provider when necessary to deliver or activate the purchased product.

Any additional information collected directly by third-party software will be governed by the applicable software provider’s privacy practices.

2.5 Mobile Recharge Information

When you use mobile recharge, data package, or similar digital recharge services, we may collect:

• Mobile number or recharge account number.

• Telecommunications network or service provider.

• Recharge amount or selected package.

• Transaction reference number.

• Transaction date and time.

• Payment status.

• Recharge confirmation, failure, or reversal information.

This information may be shared with authorized telecommunications operators, recharge aggregators, payment processors, or other service providers as necessary to process the requested recharge.

2.6 Utility Bill Payment Information

When you make utility or service bill payments, we may process:

• Utility or service provider name.

• Customer account, bill reference, or connection number.

• Payment amount.

• Payer contact information.

• Transaction date and reference.

• Payment confirmation and processing status.

Depending on the service, payments may include electricity, water, telephone, internet, television, and other supported bill-payment categories.

The information necessary to complete a payment may be transmitted to the relevant utility provider, billing system, authorized payment partner, or transaction processor.

2.7 Payment and Financial Transaction Information

Depending on the payment method, we may process:

• Payment amount and currency.

• Transaction identification numbers.

• Payment method and payment status.

• Billing information.

• Refund or reversal records.

• Limited payment-related details supplied by the payment provider.

Where a third-party payment gateway processes card payments, payment card information is handled according to that provider’s payment flow and security arrangements.

We do not require customers to provide card PINs, internet banking passwords, or one-time verification codes to our customer support team.

2.8 Technical and Usage Information

When you visit our website, certain information may be collected automatically, such as:

• IP address.

• Browser type and version.

• Device type and operating system.

• Pages visited.

• Date and time of access.

• Referring website.

• Cookie identifiers.

• Error reports and security-related logs.

This information helps us operate, secure, troubleshoot, and improve our services.

3. How We Use Your Information

We may use personal information for the following purposes:

1. Creating and managing customer accounts.

2. Processing product purchases and payments.

3. Arranging shipping and delivery.

4. Providing software downloads, activation, and licensing.

5. Processing mobile and digital recharge transactions.

6. Facilitating utility and service bill payments.

7. Sending order confirmations, transaction receipts, and service notifications.

8. Providing customer service and technical assistance.

9. Managing refunds, returns, warranties, and transaction disputes.

10. Detecting fraud, unauthorized activity, and security incidents.

11. Maintaining accounting, transaction, and regulatory records.

12. Improving website functionality and customer experience.

13. Sending promotional communications where permitted and subject to applicable consent requirements.

14. Complying with applicable legal obligations.

We do not use personal information for unrelated purposes without an appropriate lawful basis.

4. Legal Grounds for Processing

Where required under applicable data protection legislation, we process personal information based on appropriate legal grounds, which may include:

• Performance of a contract or steps requested before entering into a contract.

• Compliance with legal and regulatory obligations.

• Consent, where required.

• Legitimate interests, where permitted by applicable law.

• Other lawful grounds applicable to the specific processing activity.

The applicable legal basis depends on the nature and purpose of the processing.

We will review our practices in accordance with Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, as amended, and the commencement dates of its relevant provisions.

5. Online Shopping and Delivery

When customers purchase physical products, we use order information to process purchases, confirm payment, arrange packaging, and coordinate delivery.

We may share necessary information, including customer name, delivery address, contact number, and delivery instructions, with authorized courier and logistics providers.

Courier companies may process this information under their own applicable privacy policies.

We retain relevant order and delivery records for customer support, business administration, and applicable legal purposes.

6. Software Sales and Digital Services

For digital products, we may process account information, purchase details, license information, and technical information required to provide access to the relevant software or service.

Digital products may be supplied directly by ECTOPAY or through authorized third-party vendors.

When necessary, purchase or activation information may be shared with the relevant developer, licensing provider, hosting service, or technical support partner.

Software license terms, usage restrictions, updates, subscriptions, and refunds may be governed by separate product-specific terms.

7. Mobile Recharge and Digital Top-Up Services

To provide recharge services, we may transmit the relevant mobile number, selected network, package, amount, and transaction reference to the authorized processing partner.

Telecommunications operators and recharge service providers may process the submitted information to complete the requested transaction.

We may retain transaction records to investigate failed recharges, duplicate payments, service complaints, and refund or reversal requests.

Customers should verify the recipient mobile number and selected service before confirming a transaction.

8. Utility Bill Payments

We process bill-payment details for the purpose of submitting and confirming payments to the relevant utility or service provider.

Information may be transmitted to authorized billing systems, payment processors, financial institutions, and service providers involved in the transaction.

We may retain transaction references and payment confirmations for reconciliation, customer support, and dispute resolution.

Payment processing times, reversals, and service availability may depend on the relevant provider.

We do not use bill-payment account details for unrelated marketing activities without an appropriate lawful basis.

9. Payment Processing and Security

Payments may be processed using supported payment gateways, banks, financial institutions, or other authorized payment service providers.

Such providers may receive information necessary to authorize and complete transactions.

We seek to implement appropriate technical and organizational security measures, including access controls, secure communication protocols, and administrative safeguards.

Where a payment provider hosts the payment process, customers may be redirected to that provider or interact with its embedded payment interface.

The relevant provider’s privacy policy and payment terms may also apply.

No online system can guarantee absolute security. We encourage customers to protect their account credentials and immediately report suspicious activity.

10. Cookies and Similar Technologies

Our website may use cookies and similar technologies to:

• Maintain login sessions.

• Remember shopping cart contents.

• Support checkout functionality.

• Store customer preferences.

• Improve website performance.

• Help identify suspicious activity.

• Measure website usage where analytics tools are enabled.

• Support marketing features where such services are enabled and legally permitted.

Some cookies are essential for the website to function correctly. Others may be optional and subject to user choices or consent requirements.

Customers can manage cookies through their browser settings and any available cookie preference controls on our website.

Disabling certain cookies may affect account access, shopping carts, or checkout functionality.

11. Customer Accounts and Passwords

Customers are responsible for maintaining the confidentiality of their account passwords and protecting access to their devices.

We recommend using strong passwords and avoiding password reuse.

We may use account security information to investigate suspicious activity, prevent unauthorized access, and protect customer accounts.

If unauthorized activity is suspected, customers should contact ECTOPAY support promptly.

12. Marketing and Promotional Communications

We may send customers information about products, services, promotions, new features, or relevant updates where permitted by applicable law.

Marketing communications may be delivered through email, SMS, or other communication channels selected by the customer or supported by our services.

Where consent is required, promotional communications will be sent only after the necessary consent has been obtained.

Customers may opt out of optional promotional communications using the available unsubscribe method or by contacting us.

Essential transactional messages, such as payment receipts and order updates, may continue where necessary.

13. Sharing Information with Third Parties

We may disclose relevant personal information to trusted parties involved in delivering our services, including:

• Payment gateways and financial institutions.

• Banks and authorized transaction processors.

• Telecommunications operators and recharge providers.

• Utility and billing service providers.

• Courier and logistics companies.

• Software developers and licensing providers.

• Website hosting and technical service providers.

• Customer support and communication providers.

• Analytics or marketing providers, where enabled.

• Regulatory, judicial, or law-enforcement authorities where legally required.

We aim to share only information reasonably necessary for the relevant purpose.

We do not sell customer personal information to third parties as a commercial data product.

Third-party service providers may have their own privacy notices and legal obligations.

14. International Data Transfers

Certain technology providers, hosting services, software licensing systems, payment platforms, or other third parties may process information outside Sri Lanka.

Where personal information is transferred internationally, we will take steps to ensure appropriate safeguards and comply with applicable legal requirements.

The safeguards used may depend on the recipient, destination country, nature of the information, and applicable law.

15. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal, accounting, operational, and regulatory requirements.

Retention may depend on the category of information:

• Account information may be retained while the account remains active and for an appropriate period afterward.

• Shopping and payment records may be retained for accounting, legal compliance, customer support, and dispute resolution.

• Recharge and bill-payment records may be retained for reconciliation, investigation, and applicable financial recordkeeping.

• Software licensing records may be retained for the relevant license or subscription period and necessary support obligations.

• Security logs and technical data may be retained according to operational security requirements.

• Marketing information may be retained until the applicable permission is withdrawn or the information is no longer needed.

Where appropriate, information will be securely deleted or anonymized after the applicable retention period.

16. Data Protection and Website Security

We aim to protect personal information through appropriate measures, which may include:

• Encrypted website connections.

• Secure account authentication.

• Restricted administrative access.

• Software and security updates.

• Monitoring for suspicious activity.

• Controlled access to sensitive transaction information.

• Appropriate backups and recovery arrangements.

• Security incident response procedures.

Security measures are reviewed and improved as reasonably necessary.

17. Your Privacy Choices and Requests

Subject to applicable law and the availability of relevant legal rights, customers may contact us to request:

• Information about personal data we process.

• Access to personal information.

• Correction of inaccurate information.

• Deletion of eligible personal information.

• Withdrawal of consent where processing relies on consent.

• Objection to certain processing activities.

• An available copy or export of personal information.

• Assistance concerning privacy-related complaints.

Certain requests may be limited where information must be retained for legal obligations, fraud prevention, payment reconciliation, or other lawful reasons.

We will review requests and respond according to the legal requirements applicable at the time of the request.

18. Children’s Privacy

Our website may offer products intended for children, including toys, clothing, accessories, and educational products.

However, the availability of children’s products does not mean that children are authorized to independently enter into purchases or payment transactions.

Children should use our shopping and payment services only with appropriate parent or legal guardian supervision and authorization.

Where the law requires parental authorization for particular personal data processing activities, we will take appropriate steps to obtain it.

Parents or guardians may contact us regarding concerns about information submitted by a child.

19. Third-Party Websites and External Links

Our website may include links to third-party websites, payment providers, software vendors, social media platforms, or other external services.

These services may operate under their own privacy policies.

We encourage customers to review the relevant third-party policies before submitting personal or financial information.

We are not responsible for the privacy practices of independent third-party websites outside our control.

20. Comments, Reviews, and User-Generated Content

If comments, product reviews, ratings, or other public contribution features are enabled, we may collect the information submitted through those features.

This may include a display name, rating, review content, and relevant technical information used for security and spam prevention.

Approved reviews or comments may be publicly visible along with the associated display name.

Customers should avoid including confidential information, payment credentials, or sensitive personal details in publicly visible submissions.

21. Business Records, Fraud Prevention, and Legal Compliance

We may process and retain relevant information to:

• Investigate suspicious transactions.

• Prevent fraud and unauthorized access.

• Resolve disputes and payment discrepancies.

• Respond to lawful requests from competent authorities.

• Maintain accounting and financial records.

• Comply with applicable tax, commercial, data protection, and other legal requirements.

We will limit such processing to what is appropriate and lawful for the relevant purpose.

22. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technology, business operations, or applicable legal requirements.

The updated version will be published on our website with a revised “Last Updated” date.

Where required by law, we will provide additional notice or seek consent for material changes to relevant processing activities.

We encourage customers to review this page periodically.

23. Contact Information

For questions about this Privacy Policy, personal information, account privacy, or data-related requests, please contact:

ECTO PAY (PRIVATE) LIMITED
Trading Name: ECTOPAY Mall
Website: https://ectopay.com
Privacy Contact Email: info@ectopay.com
Telephone: +94783111222 / 0703111222
Registered or Business Address: 37, Main Street, Oddamavadi-01
Country: Sri Lanka

Please include sufficient information for us to identify and respond to your request. Do not send passwords, PINs, or one-time verification codes.

© 2026 ECTO PAY (PRIVATE) LIMITED. All rights reserved.

Your privacy matters to us. We are committed to handling customer information responsibly across our online shopping, software, recharge, utility payment, and related digital services.