Jackfruit Privacy Policy

Jackfruit (“we,” “us,” or “our”) is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, share, and safeguard your personal information when you access or use the Jackfruit platform (the “Platform”), including our website, mobile applications, and related services.

By using the Platform, you consent to the data practices described in this Privacy Policy and agree to be bound by it in accordance with the data protection laws of Sri Lanka and where applicable, the Regulation (EU) 2016/679 on General Data Protection Regulation (“GDPR”) (“Data Protection Laws”).

Information we may collect

The categories of personal data collected by us will depend on your role and how you interact with the Platform. We collect the following types of data:

If you are a Vendor

When you register with and use the Platform, we collect and process certain information to facilitate your listings, manage payouts, and uphold the safety and integrity of the Platform. This may include:

• Identity Information: Full name, national identity card number or passport number, and business registration documents
• Contact Details: Email address, phone number, and residential or mailing address
• Profile Information: Biography, profile photo, languages spoken, and selected experience category
• Payment Information: Bank account details, mobile wallet information (e.g., eZ Cash, mCash), and payout preferences
• Media Submissions: Photos, videos, or audio clips submitted in relation to your offerings or listed spaces
• Platform Activity: Information such as your reviews, ratings, profile response times, completed bookings and listing updates.
• Compliance Declarations: Self attested declarations regarding insurance coverage, safety practices or licensing status.

If you are a Customer

When you browse, book, or review an experience on the Platform, we collect and process certain information to fulfill your bookings, enhance your user experience and personalize your interactions with the Platform. This may include:

• Identity Information: Full name, nickname or preferred name, date of birth (if provided)
• Contact Information: Email address, phone number, and delivery or billing address
• Booking and Transaction History: Details of experiences purchased, date and time of orders, quantity, amount paid, and delivery preferences
• Payment Confirmation: Transaction references and payment status details received from our payment partners
• User-Generated Content: Reviews, star ratings, comments, or photos you voluntarily submit
• Interaction Data: Saved items, wishlists, cart content, favorites, and search terms

Personal Data Collected from Visitors and Newsletter Subscribers

We collect certain categories of personal data from individuals who interact with our Platform without creating an account or making a purchase. This includes data collected through cookies, web analytics tools, and optional marketing subscription forms.

This section applies only to users who visit the Platform as non-registered users or who opt to receive marketing communications.

• Device and Technical Information: IP address, browser type, device type, and operating system
• Location Data: General location inferred from your IP address (e.g., city or country)
• Browsing Behavior: Pages visited, time spent on the Platform, buttons clicked, referral source
• Newsletter Subscriptions: Your email address if you subscribe to receive our newsletters, blog updates, and promotional offers

Cookies and Similar Technologies

We use cookies and similar tracking technologies to understand how users interact with our Platform and to improve your overall experience. These technologies help us analyze usage patterns (such as pages viewed and interactions with content), enhance website functionality, and deliver more relevant services and advertising.

Cookies also allow us and our advertising partners to show you promotions both on our Platform and on third-party websites. Additionally, we use them to measure the effectiveness of marketing campaigns and website performance.

We may also use web beacons (also known as pixel tags or clear GIFs), which are small graphic files embedded in web pages or emails. These enable us to recognize certain types of information, such as cookies, the time and date a page was accessed, the page title, and technical data from your browser or device.

Some of these technologies may allow us or our partners to collect information about your activity across different websites over time to better understand your interests and browsing behavior.

When you first visit the Platform, a cookie banner will be displayed to inform you of our use of cookies and similar technologies. This banner allows you to manage your preferences, including the ability to opt in and opt out of non-essential cookies. By opting out, you can disable certain cookies or adjust your preferences for how we collect and use information through cookies. Please note that opting out may affect your experience on our website, as some features may not function as intended without cookies.

How we use your information

We only use your personal information when it is necessary and always with care, in line with your rights, our values, and our commitment to ethical, inclusive business. Our goal is to create a secure, empowering platform for vendors and customers alike. Specifically, we use your data to:

• Create and manage your account: To register you as a customer or vendor, maintain your profile, and personalize your experience.
• Enable bookings and process payments: To help you book or offer experiences, confirm orders, and securely handle payments and payouts.
• Communicate with you: To send confirmations, respond to support requests, notify you of changes, or ask for feedback.
• Send marketing and updates (only with your permission): To share newsletters, promotions, or recommendations we think you will enjoy—always with your consent.
• Improve the platform: To analyze trends, fix bugs, and enhance how Jackfruit works for everyone.
• Protect our community: To detect and prevent fraud, abuse, or rule violations, and help ensure a safe and trusted environment.
• Comply with the law: To meet legal and regulatory requirements, including but not limited to Sri Lanka’s data protection laws and, where applicable, the GDPR.

We may convert personal data into anonymized or aggregated data in a manner that ensures it can no longer reasonably be used to identify you. Once data is anonymized, it is no longer considered personal information under applicable Data Protection Laws. We may use anonymized information for various legitimate business purposes, including but not limited to:

• Platform performance monitoring
• Trend and usage analysis
• Product or service development
• Internal research and statistical reporting

Where we rely on anonymized data, we take reasonable steps to ensure that the data cannot be re-identified. We do not attempt to reverse the anonymization process.

How we share your information

We may share your personal data with certain third parties to enable and improve our services, fulfill contractual obligations, comply with legal requirements, and provide you with seamless experience. The types of third parties we share information with and the purposes for sharing are outlined below:

• Payment Processors: We share necessary information with payment service providers (such as Stripe and local mobile money services) to securely process your payments and vendor payouts.
• Experience Providers (Vendors): To fulfill your orders or bookings, we provide vendors with relevant customer details, including your name, contact information, and any specific requirements (e.g., dietary needs).
• Customer Support Platforms: If we use third-party helpdesk or communication tools, your interactions with our support team may be shared with those providers to facilitate assistance.
• Hosting and Technology Providers: We share data with trusted cloud hosting, infrastructure, and analytics providers (such as AWS, Google Analytics, Cloudflare, and Teqbahn (USA)) to store, maintain, and analyze platform performance, support technology development, and manage essential platform functions and security.
• Marketing Platforms: With your consent, we share your contact details and preferences with marketing service providers (e.g., Mailchimp, Meta Ads) to send you newsletters, promotional offers, and other communications.
• Auditors and Legal Advisors: When necessary, we disclose information to auditors, legal advisors, or consultants to respond to legal claims, audits, or investigations.
• Regulatory Authorities: We may disclose your information to the government or regulatory bodies when required by law, court order, or regulatory obligations.
• Business Transfers: In the event of a merger, acquisition, or sale of all or portion of our business, personal data may be transferred as part of this transaction.

We ensure that any third party who processes personal data on our behalf are bound by appropriate confidentiality and data protection agreements.

Where personal information is shared with any third party it is disclosed solely for specific, authorized purposes that are directly related to Jackfruit’s operations and to enhancing your experience on the Platform. All third parties, including those located outside Sri Lanka and excluding regulatory authorities are required to enter into formal contractual agreements with Jackfruit. These agreements incorporate strict confidentiality obligations, comprehensive data protection provisions, and explicit usage limitations to ensure that your personal information is processed securely and in compliance with applicable data protection laws, including the laws of Sri Lanka and where applicable GDPR. Such agreements explicitly prohibit third parties from using your personal information for any purpose other than delivering the specific services for which they are engaged by Jackfruit.

If sharing data through these methods is not feasible, we will take every reasonable measure to ensure that your rights and protections with respect to your personal information are maintained.

Data Sharing and International Transfers

We operate using secure cloud infrastructure and engage third party service providers including Teqbahn, whose servers and business operations may be located outside of your jurisdiction. Consequently, your personal data may be stored, processed, and transferred to other jurisdictions.

Where your data is transferred internationally, we ensure appropriate safeguards are in place to protect your information in accordance with applicable data protection laws. These safeguards may include contractual agreements, security measures, and compliance with recognized international frameworks.

By using our Platform, you consent to the transfer, storage, and processing of your personal data outside Sri Lanka as described above.

Lawful Basis for Processing

We rely on the following lawful grounds under the Data Protection Laws:

• Consent: For marketing, analytics, and optional data.
• Contractual necessity: To provide services, process transactions and manage accounts.
• Legal obligations: Including compliance with tax, financial laws and other legal requirements.
• Legitimate interests: Such as improving services, protecting platform security and taking reasonable steps to prevent fraud, to the extent practicable.

Data Minimization

We only collect and process personal data that is strictly necessary for the purposes stated above.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for collected, or as required to meet legal, regulatory, or operational obligations.

Once the applicable retention period has expired, we will either:

• Securely delete the data; or
• Anonymize it so that it can no longer be linked to any individual, and retain it for purposes such as research, analytics, or platform improvement.

Your Rights

As a user of our Platform, you are entitled to exercise the following rights:

• Right to be Informed: You have the right to receive clear, transparent information about how we collect, use, store, and share your personal data, including our contact details, the purposes and legal bases for processing, and your rights under applicable laws.
• Right of Access: You may request access to the personal data we hold about you, as well as information about how and why your data is processed, the categories of data involved, and any third parties with whom your data is shared.
• Right to Rectification: If you believe that any personal data we hold about you is inaccurate or incomplete, you have the right to request correction or completion of that data.
• Right to Erasure: You may request the deletion of your personal data in certain circumstances, such as when the data is no longer necessary, you withdraw consent, or processing is unlawful, subject to legal limitations.
• Right to Restrict Processing: You can request that we restrict the processing of your personal data in specific situations, for example, if you contest the accuracy of the data or object to its processing.
• Right to Object: You may object to the processing of your personal data for certain purposes, including direct marketing or processing based on our legitimate interests.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Rights Related to Automated Decision-Making: We do not use automated decision making processes, including profiling, that produce legal effects concerning you or significantly affect you. If we implement any automated decision making in the future, we will inform you about the logic involved, the significance, and the possible consequences of such processing and we will ensure you have the right to obtain human intervention, express your point of view and contest the decision.

To exercise any of these rights, please contact us at hello@jackfruiting.com. We may require you to verify your identity before fulfilling your request. We will respond to your request without undue delay and in accordance with the timeframes set out by applicable law.

Payments and Transactions

Payments are securely handled by trusted gateways (e.g., LankaPay). Jackfruit does not store your full payment card information.

Third-Party Links

Our Platform may contain links to third-party websites or services. We are not responsible for their privacy practices. Please review their privacy policies before providing any information.

Age

By using this site, you represent that you are at least the age of majority in your country. Our Platform is not intended for children under the age of 18 years. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to remove that information promptly.

Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse, to the extent practicable. These measures include encryption, secure servers, access controls, and regular security assessments.

Changes to This Policy

We may update this Privacy Policy to reflect legal, technical, or business changes. If significant updates are made, we will notify users before they take effect. Continued use of the platform indicates acceptance.

Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact:

• Jackfruit Support
• Email: hello@jackfruiting.com
• WhatsApp: +94 76 131 5363

Jackfruit is dedicated to privacy, security, and empowering Sri Lanka’s MSMEs through responsible data stewardship.

If you have any concerns about our data practices, contact hello@jackfruiting.com or lodge a complaint with your local supervisory authority.

This Privacy Policy is separate from our User Terms and Conditions and is designed to address privacy and data protection only.