Privacy Policy

Haddai Pvt Ltd ("Haddai", "we", "us" or "our") respects your privacy. This Privacy Policy applies when you visit haddai.lk, browse our products, submit an enquiry, request a consultation, communicate with us through WhatsApp, email, telephone or social media, or visit our studio in connection with services initiated through the website.

1. Who we are

Haddai Pvt Ltd is responsible for the personal data described in this policy. Our studio is at 212 1/1 Stanley Thilakarathna Mawatha, Nugegoda 10250, Sri Lanka. You can contact us at info@haddai.lk or +94 77 771 0977.

2. Personal data we may collect

• Identity and contact details, such as your name, email address, telephone number and preferred contact method.
• Enquiry and appointment details, including the service or product you are interested in, preferred appointment time and messages you send to us.
• Hair and product preferences, measurements, colour or texture preferences, fitting notes and other information you choose to provide for a consultation. If you voluntarily provide health-related information relevant to a fitting or service, we use it only as reasonably necessary to respond to your request and with the care required by applicable law.
• Transaction and service records, such as confirmed quotes, products or services selected, payment status and collection or delivery arrangements. Payments may be handled by third-party payment providers; we do not ask you to send full card details through our website contact forms.
• Technical and usage data, such as IP address, device and browser information, pages viewed, referring pages, approximate location derived from IP address, cookie identifiers and diagnostic information.
• Photos, videos, reviews or testimonials only where you provide them, make them public through a review platform, or separately permit us to use them.

3. How we collect personal data

We collect data directly from you when you complete a form, contact us, book or attend a consultation, purchase a product or service, or interact with us. We may also receive limited data from service providers you choose to use, such as WhatsApp, Google, social platforms, payment providers or review services, subject to their own policies and your settings. Technical data may be collected automatically when you use the website.

4. How we use personal data

• To respond to enquiries, arrange consultations and communicate with you.
• To recommend, quote, supply, fit and support products or services you request.
• To process and record payments, manage appointments, collections, deliveries, returns and customer support.
• To operate, secure, troubleshoot and improve our website, products, services and customer experience.
• To send marketing communications where you have consented or where otherwise permitted by law. You may opt out at any time.
• To prevent fraud or misuse, protect people and property, keep appropriate business records, and comply with legal, regulatory or tax obligations.

We process personal data only where there is an appropriate basis under applicable law, which may include your consent, steps requested by you before entering into a contract, performance of a contract, compliance with a legal obligation, or a legitimate purpose that does not improperly override your interests and rights. Where we rely on consent, you may withdraw it for future processing.

5. Cookies and similar technologies

Our website may use essential cookies needed for security and core functions, and optional analytics or preference technologies where enabled. You can use the "Manage cookies" link in the footer to review or change available choices. Browser settings may also allow you to block or delete cookies, although some website features may then work differently.

6. When we share personal data

We do not sell or rent your personal data. We may share only what is reasonably necessary with trusted providers that support website hosting and content management, communications, spam and security checks, analytics, payments, delivery, professional advice and business administration. We may also disclose data where required by law, to protect legal rights or safety, or as part of a genuine business reorganisation subject to appropriate safeguards.

7. International processing

Some service providers may process data outside Sri Lanka. Where an international transfer occurs, we take reasonable steps to use providers and arrangements that protect the data and to meet applicable transfer requirements.

8. How long we keep data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including providing services, maintaining appropriate transaction and fitting records, resolving disputes, enforcing agreements and meeting legal, accounting or tax requirements. Retention periods vary according to the type of data and the applicable obligation. Data is deleted, anonymised or securely archived when it is no longer required.

9. Security

We use reasonable administrative, technical and physical safeguards designed to protect personal data against accidental loss, unauthorised access, misuse, alteration or disclosure. No internet transmission or storage system is completely secure, so please avoid sending sensitive information through unsecured channels and contact us if you believe your data or account-related communications have been compromised.

10. Your choices and rights

Subject to applicable law and any permitted limitations, you may have rights to:

• Ask whether we process your data and request access to it.
• Ask us to correct inaccurate or incomplete data.
• Request erasure where the legal conditions are met.
• Withdraw consent for future processing where consent is the basis used.
• Object to or seek review of certain processing, including qualifying automated decisions.
• Opt out of direct marketing communications.

To make a request, email info@haddai.lk with enough information for us to identify you and understand the request. We may need to verify your identity. You may also raise a concern with the Data Protection Authority of Sri Lanka where applicable.

11. Children

The website is intended for a general audience and is not designed to collect personal data directly from children. A parent or legal guardian should contact us and participate where a person under 18 seeks a consultation, product or service. If you believe a child provided data without appropriate involvement, please contact us.

12. Third-party services and links

Our website links to services operated by others, including WhatsApp, Google, social networks, payment providers and the AI try-on service. Those services control their own processing and apply their own privacy terms. Review those terms before submitting personal data, especially photographs or images to an AI service. This policy does not control independent third-party services.

13. Changes to this policy

We may update this policy when our practices, technology or legal obligations change. The current version will be published on this page with its effective or updated date. Material changes may also be highlighted through the website or another appropriate channel.

14. Contact us

Questions, privacy requests or complaints may be sent to Haddai Pvt Ltd at info@haddai.lk, by telephone at +94 77 771 0977, or by post or in person at 212 1/1 Stanley Thilakarathna Mawatha, Nugegoda 10250, Sri Lanka.