Privacy Policy and Data Security (Last updated on 1st September 2026)

We respect your privacy and we want you to be fully aware as to how Atlas Axillia uses your personal data. The below document will help you understand why we collect, what we collect and how it is used so that you will learn your rights towards the use of data.

It is crucial that you take a moment to clearly learn the policy. Should there be any clarity required, do not hesitate to contact us via our customer service email or phone.

We have also attached an index below for your understanding.

Who is collecting your data?

Your personal data is collected and controlled by Atlas Axillia, a subsidiary of Hemas Holdings PLC, in return for the services/products that we offer.

The policy will apply for the data collected for the marketing purposes of the business, including promotional activity and advertisements, which will be sent to you on third party sites (they have their own policies, please adhere before usage) depending on your site usage.

What do we collect?

We collect your personal data i.e. any information used to identify an individual specifically. You can, however, opt to not provide, in which instance we may not be able to fully provide our products/services tailored to your needs.

To exercise customer profiling and marketing activities, we gather your personal data such as name, address, telephone number, email address, payment information, and certain other data, including from social media. This will only be used to enhance your experience with our products and will be treated with utmost privacy.

For your convenience, you are presented the option to register with our site to process order transactions, where your order details, personal information and order trackers can be found.

On the other hand, certain information such as IP address, which browser you’re using, and information about your computer’s operating system, application version, language settings will be stored with us to identify user uniqueness, even without you creating an account or making a purchase.

For international transactions, we may collect and process additional payment-related information, including billing address, payment card details (processed securely through accredited payment service providers), transaction identifiers, currency information, payment authentication information, fraud screening data and other information necessary to complete, verify and secure a payment transaction. Atlas Axillia does not store full payment card details except where permitted by applicable law and industry security standards.

For mobile devices, we collect data to identify the kind of device used.

Sources of data collection are as follows:

  • Directly collected information
  • Automatically collected data
  • Third party sources

Child Policy

As our products are used predominantly by children, we understand the importance of taking extra precautions to protect their privacy and safety.

All services on the ecommerce site have been designed and intended for use by adults. If it will be used by a younger audience at any time, we will obtain consent from the person with parental responsibility before we collect personal data where it is required by applicable laws and regulations.

On the instance of discovering that we have collected personal data from a child without parental or guardian consent, we will delete that personal data as soon as practical.

Cross-Border Transfers of Personal Data

As part of providing ecommerce services and facilitating international payments, your personal data may be transferred to, accessed from, stored or processed in countries outside Sri Lanka.

These transfers may involve:

  • Payment service providers
  • Financial institutions and banking partners
  • Cloud hosting and technology service providers
  • Fraud prevention and cybersecurity service providers
  • Customer support and business service providers

Where personal data is transferred outside Sri Lanka, Atlas Axillia will take reasonable steps to ensure that such transfers are subject to appropriate safeguards and protections consistent with applicable data protection laws, including the Sri Lanka Personal Data Protection Act No. 9 of 2022 and, where applicable, the General Data Protection Regulation (GDPR). Such safeguards may include contractual protections, adequacy mechanisms, security controls or other legally recognized transfer mechanisms.

Why do we collect, use and sometimes share your personal details?

The data we collect is only used towards processes to serve and enhance your experience with the brand. Examples include: payments processing, complaint handling or verification, tailoring our marketing efforts and communication to your needs, and personalization and targeted advertising.

We create customer segments and profiles based on your buying behavior and searching interactions on the web and social media.

  • To complete your purchase, we collect an array of information.
  • Third Party Delivery agent: We will be sharing your address and contact information with the delivery party to ensure a seamless last mile fulfillment. There are legal terms in contract with the delivery party to ensure your information is safe.
  • Marketing activities: We may send advertisements on social media, flyers or any marketing medium permitted by law.
  • Market research and process refinement: We sometimes ask our customers to take part in market research. Any additional personal details that you give us as part of the market research will be used only with your consent.
  • Service and functionality improvement: This will also require conducting of surveys and will be used with your consent only.
  • Fraud detection and prevention: We may be asked by law with a court order to reveal personal information for the detection and prevention of fraud and other illegal or unwanted activities.
  • Where consent is required under applicable data protection laws, we will obtain your consent before collecting or processing your personal data. You may withdraw your consent at any time, subject to legal, contractual and operational requirements. Withdrawal of consent will not affect the lawfulness of processing carried out before such withdrawal and may affect our ability to provide certain products or services, including the processing of transactions.

To facilitate international payments and transactions made using foreign-issued payment cards or payment methods, we may share personal data with authorized payment gateways, payment processors, acquiring banks, card schemes (including Visa, Mastercard, American Express and similar providers), fraud prevention providers, financial institutions and regulatory authorities where required.

Such processing may be necessary to:

  • Authorize and complete payment transactions;
  • Perform identity verification and fraud detection;
  • Meet anti-money laundering, sanctions screening and financial compliance obligations;
  • Manage chargebacks, refunds and payment disputes;

Protect our ecommerce platform, customers and payment networks from fraudulent activity.

How do we use social media?

We use social media to promote our offers and to improve and facilitate our own services. For example, we have integrated social media plugins into the Atlas My Shop website.

How do we make use of mobile devices?

We may introduce apps for a variety of mobile devices and use versions of our regular website that have been optimized for mobile.

These apps and mobile websites process the personal details you give us in much the same way as our website does.

How Long Do We Keep Your Personal Data for?

As long as the order is being processed, we will keep your personal data only for its specific purpose. For example, your name, address and contact number will be stored until your purchase with us has been fulfilled and thereafter if we are to send you any personalized promotional information.

To improve your experience and loyalty rewards scheme, your data may be retained.

All data will be anonymously stored and processed, and will be reviewed on a timely manner for marketing purposes.

By your request, we will delete your information as soon as practical.

How Do We Keep This Notice Up to Date?

The Policy will be updated as and when necessary based on learnings and consumer feedback. The “Last updated” date will appear on the top of the notice, reflecting any changes.