Privacy Policy

Who we are

Java Lounge is operated by Java Lounge (Pvt) Ltd together with its group companies Java Colombo (Pvt) Ltd and Java Chocolate Heaven (Pvt) Ltd (together “Java Lounge”, “we”, “us”). We run coffee houses across Sri Lanka, the website javalounge.lk, and the Java Lounge mobile ordering app.

This policy explains what personal data we collect, why, who we share it with, how long we keep it, and the rights you have under Sri Lanka’s Personal Data Protection Act No. 9 of 2022 (the “PDPA”). It applies to our cafés, this website and the mobile app.

What we collect, and why

We collect only what we need to serve you. Depending on how you interact with us:

• Mobile app orders — your name, mobile number, the outlet you order from, the items ordered, order time, order status and collection/ready time. We use this to prepare your order, let you know when it is ready, and help you if something goes wrong.
• In-store purchases — the items bought, amount, outlet, time and payment method, as recorded on our point-of-sale system. These are transaction records we are required to keep for accounting and tax purposes. A cash purchase does not identify you personally.
• Payments — payments are taken at the counter or handled by our payment partners. Java Lounge does not store full card numbers or card security codes on its own systems.
• Contacting us — if you email, call, message us on social media or reply to one of our review responses, we keep your message and contact details so we can respond and follow up.
• Google reviews — reviews you post on Google Maps are public. We read them and may reply publicly, and we keep a record of our replies. We never ask for personal details in a public reply; if we invite you to email us, anything you send is used only to look into your visit.
• Website visits — javalounge.lk does not require an account and does not run its own analytics or advertising trackers. Our hosting and security provider (Cloudflare) processes technical data such as your IP address, browser type and the pages requested in order to serve the site, block abuse and keep it fast.

How we use your data

We use personal data for the following purposes, each of which is either necessary to provide what you asked for, required by law, or a legitimate interest of running our cafés:

• Preparing, fulfilling and notifying you about orders.
• Answering questions, complaints and feedback, including following up on reviews.
• Keeping accurate financial and tax records.
• Understanding how our outlets and menu are performing. This analysis is done on aggregated sales data inside our internal reporting tools and is not used to profile individual customers.
• Protecting our systems, customers and staff from fraud and abuse.

We do not sell or rent personal data, and we do not use it for third-party advertising.

Who we share it with

We share personal data only where needed to run the service, and only with providers bound to protect it:

• Service providers who host our website, app and systems, deliver notifications, and provide security (for example Cloudflare and our hosting providers).
• Payment partners, to process app or card payments.
• Google, when you leave a review on Google Maps and when we reply to it. Google’s own privacy policy applies to your Google account and review.
• Kapruka, our group e-commerce partner, if you choose to order Java cakes, chocolates or gift vouchers online through kapruka.com. Kapruka’s privacy policy applies to those orders.
• Authorities, auditors or professional advisers where the law requires it or to protect our legal rights.

Some providers, such as Google and Cloudflare, process data on servers outside Sri Lanka. Where that happens we rely on the safeguards those providers offer, and we transfer only what is necessary.

How long we keep it

We keep personal data only for as long as it is needed for the purpose it was collected for, and then delete or anonymise it. Transaction and order records are kept for the period required by Sri Lankan accounting and tax law. Correspondence is kept for as long as needed to resolve the matter and for a reasonable period afterwards. App account details are kept while your account is active and removed after a period of inactivity, or sooner if you ask.

Your rights

Under the PDPA you have the right to:

• Ask what personal data we hold about you and receive a copy.
• Have inaccurate or incomplete data corrected.
• Have your data deleted, unless we must keep it by law (for example transaction records).
• Withdraw consent where our processing is based on consent, without affecting what was done before.
• Object to processing based on our legitimate interests.
• Complain to the Data Protection Authority of Sri Lanka if you believe we have not handled your data properly.

To exercise any of these rights, email [email protected] with “Privacy request” in the subject line. We may need to verify your identity first. We will respond within the time the PDPA requires, and we will not charge you unless a request is clearly excessive.

Security

We protect personal data with access controls, encryption of data in transit (HTTPS), restricted access for staff who need it for their work, and regular review of our systems. No system is completely secure, so we cannot guarantee absolute security, but we take our obligations to protect your data seriously and will notify you and the relevant authority as the law requires if a breach affects you.

Cookies

javalounge.lk does not set tracking or advertising cookies. Our security and hosting provider may set a small number of strictly necessary cookies to protect the site from abuse and to remember your settings. Links to third-party sites (app stores, Kapruka, Instagram, Facebook, TikTok) lead to services with their own cookie and privacy policies.

Children

Our cafés welcome families, but our website and app are not directed at children and we do not knowingly collect personal data from a child without a parent or guardian’s consent. If you believe a child has given us personal data, please contact us and we will delete it.

Changes to this policy

We may update this policy as our services or the law change. The date at the top shows when it was last revised. Significant changes will be highlighted on this page and, where we have your contact details, we may tell you directly.