Privacy Policy

Game City ("we", "us", "our") operates an online store and related support services for customers in Sri Lanka at https://gamecity.lk. We sell computer hardware, accessories, pre-built systems, and related after-sales services for delivery and fulfilment within Sri Lanka only.

For the purposes of the Personal Data Protection Act, No. 9 of 2022 ("PDPA"), Game City is the controller of personal data described in this policy (we decide why and how that data is processed for our store).

Business contact:

info@gamecity.lk · +94 76 202 1600
205/E, Katukurunda Hena, Palannoruwa, Gonapola, Horana, Sri Lanka, 12410

If anything in this notice conflicts with the PDPA or other written law of Sri Lanka, the law prevails.

Depending on how you use our services, we may process:

• Identity and contact data — name, email address, phone number, and account login details (passwords are stored in hashed form).
• Delivery and billing data — shipping address, city, province, postal code, and related order notes.
• Transaction data — order history, products purchased, amounts in LKR, payment status, and invoices. Card or wallet details are handled by licensed payment providers; we do not store full card numbers.
• Support data — warranty claims, repair requests, and messages you send by form, email, phone, or WhatsApp.
• Technical and security data — IP address, device or browser information, and limited logs used for security, fraud prevention, and troubleshooting.

Under the PDPA, personal data must be processed for specified, explicit, and legitimate purposes. We process data to:

• Take and fulfil orders, arrange delivery within Sri Lanka, and issue receipts or invoices.
• Create and manage customer accounts and authenticate sign-in (including OTP where enabled).
• Process payments through payment service providers and confirm payment status.
• Provide warranty, repair, and after-sales support.
• Send transactional notices (order confirmation, status updates, security alerts).
• Prevent fraud, misuse, and unauthorised access, and keep the store secure.
• Comply with legal, accounting, tax, or regulatory duties in Sri Lanka.
• Respond to complaints, disputes, and lawful requests from competent authorities.

We do not use your personal data to sell it to third parties. Marketing messages (if any) are only sent where permitted and, where consent is required, you may withdraw consent as explained below.

We may engage service providers who process personal data on our instructions ("processors" under the PDPA), only as needed to run the store, for example:

• Payment processors (such as PayHere) to complete checkout.
• Email or SMS providers for transactional messages.
• Courier or logistics partners for delivery in Sri Lanka.
• Hosting, database, and IT security providers that support our systems.

Some providers may process or store data on servers outside Sri Lanka. Where that happens, we take steps consistent with the PDPA and available contracts or safeguards appropriate to the service. We may also disclose data if required by Sri Lankan law, court order, or to protect rights, safety, or property.

We use cookies and similar technologies that are necessary for the site to function: login sessions, cart state, security, and basic performance. These are used to operate the store for customers in Sri Lanka. Blocking essential cookies may stop checkout or account features from working.

We keep personal data only for as long as needed for the purposes above, including warranty support windows, accounting and tax retention, dispute handling, and security. When data is no longer required, we delete or anonymise it where practicable, subject to legal retention duties.

We apply technical and organisational measures appropriate to the risk (such as access controls, encrypted transport where applicable, and hashed passwords) to protect integrity and confidentiality. No method of online transmission or storage is completely secure; please keep your account credentials private.

Subject to the PDPA and any permitted exceptions, you may have rights to:

• Request access to personal data we hold about you.
• Request rectification or completion of inaccurate or incomplete data.
• Request erasure of personal data in situations allowed by the Act.
• Withdraw consent where processing is based on consent (withdrawal does not affect prior lawful processing).
• Object to certain processing, including automated decision-making where the Act applies.

To exercise these rights, email info@gamecity.lk with enough detail for us to verify your identity and respond. We will handle requests in line with the PDPA and any rules issued by the Data Protection Authority of Sri Lanka.

If a personal data breach occurs that must be notified under the PDPA, we will notify the Data Protection Authority and affected individuals as required by law and applicable rules.

Our store is intended for persons who can lawfully enter a consumer purchase in Sri Lanka. We do not knowingly market to children. If you believe a minor has provided personal data inappropriately, contact us so we can take appropriate action.

We may update this Privacy Policy to reflect operational or legal changes. The "Last updated" date will change when we publish a revision. Material changes may also be highlighted on the website.

See our Terms of Service. For consumer complaints about goods or services you may also contact the Consumer Affairs Authority of Sri Lanka through its published channels, in addition to writing to us at info@gamecity.lk.