Privacy Policy

1. Introduction

LoreKart (“LoreKart,” “we,” “us,” or “our”) is a private digital showroom and marketplace platform operated by Evoto AI (Pvt) Ltd, a company incorporated in Sri Lanka (“Company”), designed for high-value vendors including dealers in gemstones, jewelry, luxury timepieces, and fine art (“Vendors”) and their prospective buyers (“Buyers,” together with Vendors, “Users,” “you”).

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, create an account, use our platform, or otherwise interact with our services (collectively, the “Service”). This Policy is issued in accordance with applicable Sri Lankan law, including the Personal Data Protection Act, No. 9 of 2022 (“PDPA”).

By accessing or using the Service, you agree to the collection and use of information in accordance with this Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: name, email address, phone number, business name, business registration details, billing address, password and account credentials.
• Identity Verification Data: for high-value vendor accounts, we may collect government-issued identification, business registration certificates, tax identification numbers, and other documentation necessary to verify identity and prevent fraud.
• Payment Information: billing details, payment card information, and bank account details, processed via our third-party payment processors (see Section 5).
• Listing and Storefront Content: product descriptions, images, certifications, provenance documentation, pricing, and other content you upload to your storefront.
• Communications: messages exchanged through the platform, inquiries, support requests, and waitlist sign-up information.
• Auction Activity: bids placed, auction participation history, and related transaction data.

2.2 Information Collected Automatically

• Usage Data: pages visited, time spent on the Service, click patterns, referring URLs, and feature usage.
• Device and Technical Data: IP address, browser type, operating system, device identifiers, and approximate location derived from IP address.
• Cookies and Similar Technologies: see Section 6 below.

2.3 Information from Third Parties

We may receive information about you from identity verification providers, payment processors, analytics providers, and publicly available business registries, where necessary to verify Vendor legitimacy.

3. How We Use Your Information

We use collected information to:

• Create, maintain, and secure your account;
• Verify Vendor identity and legitimacy, given the high-value nature of goods listed on the platform;
• Process payments, transactions, and auction settlements;
• Operate lead management, AI-driven analytics, and storefront checkout features;
• Facilitate communication between Vendors and Buyers;
• Send transactional notifications, service updates, and (with consent, where required) marketing communications;
• Detect, prevent, and investigate fraud, abuse, or security incidents;
• Comply with applicable legal, tax, and regulatory obligations;
• Improve and develop the Service, including through aggregated and de-identified analytics.

4. Legal Basis for Processing

Where the PDPA or other applicable law requires a legal basis, we rely on one or more of the following: your consent; performance of a contract with you; compliance with a legal obligation; and our legitimate interests in operating, securing, and improving the Service, provided such interests are not overridden by your data protection rights.

5. Sharing and Disclosure of Information

We do not sell your personal data. We may share information with:

• Other Users: Vendor storefront information and listing content is visible to Buyers as necessary for the marketplace to function. Buyer contact details are shared with a Vendor only when you initiate an inquiry, bid, or transaction with that Vendor.
• Payment Processors: third-party payment gateways process payment information on our behalf and are subject to their own privacy and security obligations.
• Service Providers: hosting providers, identity verification vendors, analytics providers, and customer support tools that process data on our behalf under contractual confidentiality and data protection obligations.
• Legal and Regulatory Authorities: where required by Sri Lankan law, court order, or to protect the rights, safety, or property of LoreKart, our Users, or the public.
• Business Transfers: in connection with a merger, acquisition, financing, or sale of assets involving Evoto AI (Pvt) Ltd or its business units, subject to confidentiality safeguards.

6. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Service, remember preferences, authenticate sessions, and analyze usage. You may control cookie preferences through your browser settings; disabling cookies may limit functionality of the Service.

7. Data Retention

We retain personal data for as long as necessary to provide the Service, comply with legal and tax obligations (including record-keeping requirements applicable to high-value transactions), resolve disputes, and enforce our agreements. Identity verification records for Vendor accounts may be retained for longer periods as required for fraud prevention and regulatory compliance.

8. Data Security

We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction, including encryption in transit, access controls, and secure infrastructure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. International Data Transfers

If your data is transferred to or processed in a jurisdiction outside Sri Lanka (for example, by a cloud hosting or payment provider), we take steps required under the PDPA to ensure such transfers are subject to appropriate safeguards.

10. Your Rights

Subject to applicable law, including the PDPA, you may have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion of your data, subject to our legal retention obligations;
• Object to or restrict certain processing activities;
• Withdraw consent where processing is based on consent;
• Lodge a complaint with the relevant Sri Lankan data protection authority.

To exercise these rights, contact us using the details in Section 14.

11. Children's Privacy

The Service is intended for business and adult use only and is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected such data, we will take steps to delete it.

12. Vendor Responsibilities

Vendors who collect Buyer information through their storefronts, auctions, or direct communications are independently responsible for complying with applicable data protection laws with respect to that data, and LoreKart is not responsible for a Vendor's independent use or mishandling of Buyer data outside the Service.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via the Service or email. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.