Privacy Policy

Overview

At NexaBloom, we respect your privacy and are committed to protecting the personal information you share with us. This policy outlines how we collect, use, store, and safeguard your data in compliance with the Sri Lanka Personal Data Protection Act (PDPA) No. 9 of 2022 (as amended).

Information We Collect

We collect only the minimal information necessary to fulfill your orders and provide customer care:

• Customer name
• Delivery address
• Mobile phone number
• Email address (optional)

We do not collect dates of birth or personal details about your baby.

Why We Collect Your Information

Your information is collected and used for the following purposes:

• Processing, packaging, and dispatching your orders
• Coordinating doorstep delivery via our courier partners
• Providing transactional updates and order receipts
• Answering support inquiries and handling returns
• Sending optional marketing updates (only with your separate explicit consent)

Third-Party Processors

To run our online shop and deliver your purchases, we work with trusted service providers:

• Supabase: Cloud database and secure file storage (hosted in Singapore region ap-southeast-1)
• Cloudflare: Global edge network for website hosting, performance, and security
• PayHere: Central Bank of Sri Lanka approved payment processor for card payments
• Text.lk: SMS gateway for transactional order status notifications
• Koombiyo Courier: Domestic delivery partner providing courier logistics across Sri Lanka
• Google Analytics: Anonymized web traffic and performance measurement

Cross-Border Disclosure

Our secure database hosting is located in the Singapore region (ap-southeast-1) and web traffic is protected globally by Cloudflare's edge network. We ensure appropriate safeguards are maintained for all cross-border data handling.

Retention and Deletion

Order records, invoices, and transaction histories are retained as required by statutory accounting and tax regulations. Uploaded bank transfer deposit slips are permanently deleted after 12 months.

Marketing Consent

Marketing communications via WhatsApp or SMS require a separate, voluntary opt-in. You may opt out of marketing messages at any time without affecting your transactional notifications.

Your Rights and Requests

Under Sri Lankan data protection law, you have the right to request access to, correction of, or deletion of your personal data. To make a request, please contact us via WhatsApp or email through our Contact page.