Privacy Policy
Last updated: 24 September 2026
RC in Cafe (Pvt) Ltd ("RC in Cafe", "we", "us"), of Weliveriya, Gampaha, Sri Lanka, is the controller of the personal data collected through this website and our mobile app. We handle your personal data in line with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka ("PDPA").
What we collect
- Account details: name, email address, mobile number, and a securely hashed password
- Delivery addresses you save to your account
- Order and purchase history, including how you chose to pay
- Loyalty points balance and history
- Messages you send us through the contact form or WhatsApp
- Security information: two-factor authentication status (secrets are encrypted), and login attempt records used to protect your account from unauthorised access
We never see or store your card details. Card, eZ Cash and mCash payments are made on PayHere's secure payment page, and PayHere only tells us whether the payment succeeded.
Why we use it
- To perform our contract with you: creating your account, taking payment, and delivering or preparing your order for collection
- To meet our legal obligations, such as keeping tax and accounting records
- For our legitimate interests: running the loyalty programme, answering your questions, and protecting your account and our shop from fraud and abuse
- With your consent: sending you our newsletter or offers. You can unsubscribe at any time using the link in any email
We do not sell your personal data.
Who we share it with
Only with the service providers we need to run the shop, and only what they need:
- PayHere, to process online payments
- Our courier partners, who receive your name, delivery address and phone number to deliver your order
- Our hosting, email and app notification providers
Some of these providers may store data outside Sri Lanka. Where they do, we only use providers that protect it to the standard the PDPA requires. We may also disclose data where Sri Lankan law requires us to.
How long we keep it
Order and transaction records are kept for as long as Sri Lankan tax and accounting law requires. Account data is kept while your account is active. If you ask us to delete your account, we delete what we can and anonymise the records we're legally required to keep.
Your rights
Under the PDPA you have the right to:
- Access the personal data we hold about you
- Withdraw your consent, or object to processing based on our legitimate interests
- Have inaccurate or incomplete data corrected
- Have your data erased, subject to what we must keep by law
- Ask for a review of any decision made about you solely by automated means (we don't currently make any)
You can download a copy of your data or delete your account yourself from your account page, or contact us at madhura@rcincafe.com. If you're not happy with how we've handled your request, you can complain to the Data Protection Authority of Sri Lanka.
Children
Many of our customers buy for children, but accounts are for adults. If you're under 18, please ask a parent or guardian to order for you. If you believe a child has given us personal data, contact us and we'll delete it.
Security
Data is encrypted in transit and at rest, passwords are hashed, and two-factor authentication is available on every account. No system is perfectly secure, so if we ever find a breach that affects your data, we'll tell you and the authorities as the law requires.
Cookies
See our Cookies Policy for what we use and why.
Contact
RC in Cafe (Pvt) Ltd, Weliveriya, Gampaha, Sri Lanka · madhura@rcincafe.com · 071 998 2906