Privacy Policy

Who we are

Zento is a grocery delivery service based in Sri Lanka. For the purposes of Sri Lanka’s Personal Data Protection Act No. 9 of 2022, Zento is the controller of the personal data described in this policy.

Information we collect

We collect only what we need to take and deliver your order:

• Account details: your name, mobile number, and email address if you add one.
• Delivery details: saved addresses, landmark, recipient name and phone number, and any delivery instructions.
• Order details: the products you buy, prices, order history, loyalty points, and support conversations.
• Payment details: the payment method used and a transaction reference from our payment partner. We do not receive or store full card numbers or card security codes.
• Location: your device location when you choose to use it to find your address or follow a delivery. You can turn this off in your phone settings.
• Device and usage data: app version, device type, and basic logs needed to keep the service secure and working.

How we use your information

We use your information to:

• Create and secure your account, and sign you in with a one-time code.
• Pick, pack, and deliver your orders, and let you track them.
• Take payment, apply refunds, and calculate loyalty points.
• Contact you about an order, a substitution, or a delivery problem.
• Provide customer support and resolve complaints.
• Prevent fraud, misuse, and unsafe activity.
• Understand what is working so we can improve the service.
• Meet our legal and accounting obligations.

We rely on your consent for optional things such as marketing messages and precise location. You can withdraw consent at any time. We rely on the performance of our contract with you to fulfil orders, and on our legitimate interests to keep the service safe and improve it.

Who we share it with

We do not sell your personal data. We share it only as needed:

• Delivery riders receive the order items, delivery address, and your contact details so they can complete the delivery.
• Stores and packing partners receive the items and fulfilment details needed to prepare your order.
• Payment and messaging providers process payments and deliver one-time codes and order updates.
• Hosting and technology providers store data and run the service on our behalf under appropriate safeguards.
• Authorities where we are required by law, or where disclosure is necessary to protect someone’s safety.

Some providers may process data outside Sri Lanka. Where that happens, we take reasonable steps to ensure your data receives an appropriate level of protection.

Location data

If you allow location access, we use it to find your delivery address and to show your rider’s position while an order is on the way. Rider location is shared with you only for an active delivery. We do not track your location in the background unless you have given permission for a feature that needs it.

Cookies and similar technology

This website uses only the cookies and local storage needed to work properly. We do not use advertising cookies or sell audience data. You can clear cookies in your browser at any time, though some features may stop working.

How long we keep it

We keep account and order records for as long as your account is active and for a reasonable period afterwards where we need them for support, accounting, fraud prevention, or legal obligations. When data is no longer needed, we delete it or anonymise it. Records needed for tax and accounting are kept for the period required by Sri Lankan law.

Keeping your data safe

We use access controls, encryption in transit, and limited retention to protect your information. No service can promise perfect security, but we review our safeguards and act quickly if something goes wrong. If a breach is likely to affect you, we will notify you and the relevant authorities as required by law.

Your rights

Under Sri Lankan data protection law, you can ask us to:

• Confirm what personal data we hold about you, and give you a copy.
• Correct information that is inaccurate or out of date.
• Delete information we no longer have a lawful reason to keep.
• Withdraw consent for optional processing, such as marketing.
• Object to certain processing, or ask us to restrict it.

To make a request, email privacy@zento.lk from the number or address linked to your account. We may ask you to verify your identity first. If you are unhappy with our response, you can complain to the Data Protection Authority of Sri Lanka.

Children

Zento is for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, contact us and we will remove it.

Changes to this policy

We may update this policy as the service changes. The new version will be posted here with a new date, and material changes will be communicated in the app where appropriate.

Contact us

Questions about privacy can be sent to zentoCus@gmail.com.

Zento, Sri Lanka.