Privacy policy

This policy explains what Boltix (Pvt) Ltd collects when you use boltix.ceyMXcom, why we collect it, and what you can ask us to do with it. If anything here is unclear, email hello@theboltix.com.

What we collect

• Order information — your name, delivery address, phone number and email address. We need these to deliver a parcel to you.
• Account information — if you create an account, the above plus a securely hashed password. We never store your password in a readable form.
• Order history — what you bought and when, so we can honour warranties and answer your questions.
• Messages — anything you send through the contact form or WhatsApp.
• Basic technical data — a session cookie to keep your cart and login working, and standard web server logs.

What we do not collect

• We never see or store card numbers. We do not process card payments at all right now.
• We do not buy personal data from third parties or scrape it.
• We do not track you across other websites for advertising.

Why we use it

• To process, pack and deliver your order
• To contact you about that order — confirmation calls, delivery coordination, delays
• To handle returns and warranty claims
• To send marketing emails only if you subscribed to the newsletter
• To meet our legal and accounting obligations in Sri Lanka

Who we share it with

We share the minimum necessary, with:

• Courier partners — your name, address and phone number, so they can deliver your parcel
• Our bank — for bank transfer reconciliation only
• Authorities — where we are legally required to

We do not sell your data. We do not rent it, trade it, or hand it to advertisers.

How long we keep it

Order records are kept for seven years to satisfy Sri Lankan accounting and tax requirements, and so we can honour long warranty periods. Account details are kept until you ask us to delete them. Contact-form messages are kept for two years. Newsletter subscriptions last until you unsubscribe.

Cookies

We use one essential cookie (boltix_session) to remember your cart and keep you signed in. It expires when you close your browser. We do not use advertising or third-party tracking cookies, so there is no consent banner to click through.

Security

Passwords are hashed with bcrypt. Forms are protected against cross-site request forgery. Database access uses prepared statements throughout. The live site runs over HTTPS. No system is perfect — if you spot a vulnerability, please report it to hello@theboltix.com and we will act on it quickly and credit you if you would like.

Your rights

Email hello@theboltix.com and we will action any of these within 30 days:

• Ask for a copy of everything we hold about you
• Ask us to correct anything wrong
• Ask us to delete your account and data, except records we must legally retain
• Unsubscribe from marketing — there is also a link in every email

Children

Boltix is not aimed at under-16s and we do not knowingly collect their data. If a child has given us information, tell us and we will remove it.

Changes

If this policy changes materially we will update the date at the top and, for significant changes, notify account holders by email.