Privacy Policy
We value your privacy. This page explains what information we collect, why we collect it, and how you can control it.
Last updated: August 2026
Overview
This Privacy Policy explains how HABB (PVT) LTD ("HABB", "we", "us" or "our"), registered at 215, Adiyapatham Road, Jaffna, Sri Lanka, collects, uses, discloses and protects personal information when you visit habb.lk, engage us for a project, or use a HABB product such as HABB Stay, HABB POS, HABBGate or HABB AI. It also explains the choices and rights available to you.
1. Information we collect
We collect information you give us directly — such as your name, email address, phone number, company details and project requirements when you contact us, request a quote, apply for a role, or create a product account. We also collect information automatically when you use our Site or products, such as IP address, browser and device type, pages viewed and usage patterns, through cookies and similar technologies. Where you use a HABB product (for example HABB Stay or HABB POS), we process the business data you enter into that product — such as bookings, inventory or customer records — on your behalf, as described in Section 4. We do not store full payment card details; payments are processed by secure, PCI-compliant third-party providers.
2. How we use your information
We use personal information to: deliver and support the Services and products you request; respond to enquiries and provide quotes; process payments and manage accounts; send service updates and, where you have agreed, marketing communications; improve our Site, products and services; maintain security and prevent fraud; and comply with our legal obligations.
3. Legal basis for processing
We rely on one or more of the following grounds to process your information: performance of a contract with you (for example, delivering a project or product you have signed up for); our legitimate business interests (such as improving our Services and keeping them secure), balanced against your rights; your consent (for example, for marketing emails, which you can withdraw at any time); and compliance with our legal obligations under Sri Lanka's Personal Data Protection Act, No. 9 of 2022.
6. Data retention
We retain personal information for as long as needed to provide the Services, maintain our business relationship with you, and meet legal, accounting or reporting requirements, after which it is securely deleted or anonymised.
7. Data security
We use appropriate technical and organisational measures — including encryption in transit, access controls and regular security review — to protect personal information against unauthorised access, loss or misuse. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. International transfers
As HABB operates across multiple countries, your information may be transferred to and processed in a country other than your own. Where we do this, we take steps to ensure your information receives an adequate level of protection, consistent with Sri Lanka's Personal Data Protection Act, No. 9 of 2022.
9. Your rights
Subject to Sri Lanka's Personal Data Protection Act, No. 9 of 2022, you may have the right to request access to, correction of, or deletion of the personal information we hold about you; to object to or restrict certain processing; to receive your data in a portable format; and to withdraw consent where processing is based on consent. To exercise any of these rights, contact us using the details below — we will respond within the timeframe required by applicable law.
10. Children's privacy
Our Services are intended for businesses and individuals aged 18 or older. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.
11. Third-party links
Our Site and communications may link to third-party websites, such as social media platforms or partner sites. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies before providing information to them.
12. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes to our practices or legal requirements. We will post the revised policy on this page with an updated date, and for material changes we will make reasonable efforts to notify you directly.