Last updated: 9 August 2026
BahBay (“we”, “us”, “our”) sells island-inspired resort wear through bahbay.com. This policy explains what personal information we collect when you visit our site or place an order, why we collect it, who we share it with, and the choices you have.
We handle personal data in line with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka (as amended) and, where they apply to you, comparable laws in your own country.
Who we are
BahBay is the controller of the personal data described in this policy.
BahBay
58/43B, Somathalagala 3rd Lane, Delkanda, Nugegoda, Sri Lanka
Email: [email protected]
Phone: +94 76 248 4833
Information we collect
Information you give us
- Order and delivery details — your name, delivery and billing address, email address and phone number.
- Payment information — handled directly by our payment provider, [payment gateway]. We receive confirmation that a payment succeeded and the last four digits of the card; we never see or store your full card number.
- Account details — if you create an account, your username, password (stored encrypted) and saved addresses.
- Messages — anything you send us through the contact form, email, WhatsApp, or our Instagram and Facebook pages.
- Marketing preferences — your email address if you subscribe to our newsletter.
- Product reviews — the name and comments you choose to publish on a product page.
Information we collect automatically
- Technical data — IP address, browser type, device type, operating system and language settings.
- Usage data — pages viewed, products viewed, time spent, referring website, and what you added to your cart.
- Cookie data — see the cookies section below.
We do not deliberately collect sensitive categories of personal data such as health information, religious beliefs or biometric data. Please don’t send us this kind of information.
How we use your information
| Purpose | Why |
| Processing and delivering your order | To perform our contract with you |
| Order confirmations, dispatch notices and delivery updates | To perform our contract with you |
| Answering questions, handling exchanges and returns | To perform our contract with you |
| Newsletters, offers and new arrivals | Your consent — withdrawable at any time |
| Preventing fraud and securing the site | Our legitimate interests |
| Understanding how the site is used so we can improve it | Our legitimate interests |
| Keeping tax, accounting and transaction records | Legal obligation |
We do not sell your personal data, and we do not share it with third parties for their own marketing.
Who we share your information with
We share personal data only with service providers who need it to do their job for us, and only as far as they need it:
- Delivery partners — [courier names] receive your name, address and phone number so they can deliver your parcel.
- Payment providers — [payment gateway] processes your payment under its own privacy policy.
- Website hosting and platform — our host [hosting provider] and the WordPress/WooCommerce plugins that run the store.
- Email and marketing tools — [email tool] to send order emails and newsletters.
- Analytics and advertising — [analytics tools] to measure traffic and, where you’ve consented, show relevant ads.
- Professional advisers and authorities — our accountants, or law enforcement and regulators where we’re legally required to disclose information.
If BahBay is ever sold or merged, customer data may transfer to the new owner, who would remain bound by this policy.
International transfers
Some of the providers above store data on servers outside Sri Lanka. Where that happens, we take reasonable steps to make sure your data stays protected to a standard consistent with this policy and with Sri Lankan law, including contractual safeguards with those providers.
Cookies
Cookies are small files stored on your device. We use:
- Essential cookies — these keep your cart and login session working. The site can’t function without them.
- Analytics cookies — these tell us which pages and products people actually look at.
- Marketing cookies — these let us show you BahBay pieces you’ve viewed, on other sites and on social media.
You can block or delete cookies in your browser settings at any time. Blocking essential cookies will stop checkout from working.
How long we keep it
- Order records — kept for [7] years to meet tax and accounting requirements.
- Account details — kept while your account is open, and deleted on request.
- Newsletter subscriptions — kept until you unsubscribe.
- Enquiries — kept for up to [2] years after your question is resolved.
- Analytics data — kept in aggregated or anonymised form.
Keeping your data secure
Our site runs over an encrypted HTTPS connection, access to customer records is limited to people who need it, and card payments are handled entirely by our payment provider. No system is perfectly secure, but if a breach ever puts your rights at serious risk, we will notify you and the Data Protection Authority as the law requires.
Your rights
Under the Personal Data Protection Act you can ask us to:
- tell you what personal data we hold about you and give you access to it;
- correct anything that’s inaccurate or incomplete;
- delete your data, where we have no continuing legal reason to keep it;
- stop processing your data for a particular purpose, including direct marketing;
- review any decision made about you purely by automated means.
Where we rely on your consent, you can withdraw it at any time — that doesn’t undo processing we did before you withdrew it. To exercise any of these rights, email [email protected]. We’ll respond within 21 days and may ask you to confirm your identity first. There’s no charge.
Every marketing email also carries an unsubscribe link. Unsubscribing stops the newsletter but not the emails we must send about an order you’ve placed.
Children
Our store is intended for adults. We don’t knowingly collect personal data from anyone under 18 without a parent or guardian’s consent. If you believe a child has given us their information, contact us and we’ll delete it.
Other websites
Our pages link to Instagram, Facebook and our payment provider. Once you follow a link, that company’s own privacy policy applies — we’re not responsible for how they handle your data.
Changes to this policy
We’ll update this page when our practices change, and the date at the top will always show the latest version. If a change materially affects your rights, we’ll tell you by email or through a notice on the site.
Questions and complaints
Talk to us first — most things are quickest to fix directly.
Email: [email protected]
Phone: +94 76 248 4833
Post: BahBay, 58/43B, Somathalagala 3rd Lane, Delkanda, Nugegoda, Sri Lanka
If you’re not satisfied with our response, you can complain to the Data Protection Authority of Sri Lanka.
