1. Who we are
Mark & Medal (“we”, “us”) makes custom brand objects in Galle, Sri Lanka, and is a venture of LOOM Brand Designs. We are the controller of the personal data described here. Contact: info@markandmedal.lk or WhatsApp +94 77 100 3969.
2. What we collect
- Details you give us: first and last name, email address, mobile number, organisation, delivery and billing addresses, the date you need an order, and messages you send (for example through the price-list form, the price calculator, the contact form, WhatsApp or email).
- Your customer account: if you sign in at markandmedal.lk/account, your email address, the sign-in method (an emailed sign-in link or Google), your Firebase user ID and sign-in times; the profile you keep there (name, organisation, mobile, delivery and billing addresses, marketing preference); and your order history, mockup approvals and change requests. Sign-in uses Google Firebase Authentication: we email you a one-time sign-in link from hello@markandmedal.lk, or Google confirms your address if you choose “Continue with Google” (we receive your name and email, never your Google password). We record sign-in link requests (as a one-way hash of the email address and of the network address) for 10 minutes to stop abuse.
- Order material: logos, crests, brand guidelines and permission letters you send us, mockup approvals, quotations, purchase orders, invoices and delivery notes.
- Payment information: card payments are handled by PayHere and LankaQR payments by your bank or payment app. We see the payment reference and amount, never your full card details.
- Cookies needed for the site to work: the sign-in cookie
__session(only when you sign in; 14 days or until you sign out) and the referral cookiemm_ref(only when you arrive through a partner's or customer's referral link; 30 days), which records the referral code so the person who recommended us is credited. See the Cookie Policy. - Website usage: with your consent, pages visited, device and browser type, approximate location (city level), how you arrived and how you use pages, collected through Google Analytics and Microsoft Clarity. See the Cookie Policy.
- NFC tap data: when someone taps a Mark & Medal NFC product, our link service records the time, the tag, the device type and approximate location so that tap counts can be shown to the product's owner. We do not identify the person tapping.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis under the PDPA |
|---|---|
| Preparing mockups and quotations, making and delivering orders, invoicing, after-sales support and returns | Performance of a contract, or steps you asked us to take before one |
| Running your customer account: signing you in, showing your orders, mockups and invoices, saving your profile, and sending sign-in and account emails | Performance of a contract, and our legitimate interest in keeping your account secure |
Crediting referrals (the mm_ref cookie and the referral code on your quote and order) and paying referral rewards | Legitimate interest in running our referral programme; for members, the programme terms (contract) |
| Sending the price list you requested and replying to enquiries | Your request (contract) and our legitimate interest in answering |
| Offers and order-by reminders by email or WhatsApp | Your consent, which you can withdraw at any time |
| Website analytics and session recordings | Your consent through the cookie banner |
| Keeping accounting and tax records | Legal obligation |
| Preventing fraud and spam, securing the site | Legitimate interest |
4. Who we share it with
We never sell personal data. We share it only with service providers who help us run the business, under contracts that protect it:
- Google (Firebase hosting, Firestore database and Firebase Authentication for customer accounts, Google Analytics, Google Tag Manager, Google Workspace email)
- Microsoft (Clarity analytics, with your consent)
- PayHere and banks (payments, including LankaQR)
- Koombiyo Delivery and PickMe (delivery of your order: name, phone number and address only)
- WhatsApp (Meta), when you choose to message us there
- LOOM Brand Designs, our parent company, which builds and maintains our systems and, for LOOM clients, holds your brand files. LOOM Brand Designs also operates the tools we use as its customer: LOOM CRM (our contacts, enquiries, quotes and sales follow-up, including the acknowledgement email for contact-form messages), LOOM Programs (the referral programme: referral codes, credited orders and reward payouts) and LOOM Projects (collecting and publishing reviews you choose to leave). It processes this data on our instructions only.
- Our accountants and, where the law requires, government or regulatory authorities
Inside Mark & Medal, your quote becomes an order in our operations system (MM Ops: mockups, production, delivery and the courier hand-over) and its payments, invoices and refunds are recorded in our finance system (MM Finance). Both are our own systems, run on the same Google Cloud project as this website, and are used only by Mark & Medal staff.
If we add advertising tools (for example Meta, TikTok or LinkedIn), they will only run with your marketing consent and will be listed in the Cookie Policy.
5. Where your data is stored
Our database and some service providers store data outside Sri Lanka, including in India, the European Union and the United States. Where data leaves Sri Lanka we rely on providers that apply safeguards recognised under the PDPA, such as contractual protections and strong security.
6. How long we keep it
- Enquiries and price-list sign-ups that don't become orders: up to 24 months after our last contact, or until you ask us to delete them.
- Orders, invoices and related records: 7 years, for tax and accounting purposes.
- Your customer account and profile: while you use it. Ask us to close it and we delete the account and profile; the orders themselves are kept for the 7 years above.
- Contact-form messages: up to 24 months after our last contact, unless they lead to an order.
- Brand files and approved designs: while you remain a client, so re-orders are quick, and deleted on request.
- Analytics data: 14 months in Google Analytics. Microsoft Clarity keeps session recordings for about 30 days and summary data for up to 13 months.
7. Your rights
Under the PDPA you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct or complete inaccurate data;
- delete your data, or stop or limit how we use it, where the law allows;
- withdraw consent at any time (for marketing, reply “STOP” or use the unsubscribe link; for cookies, use “Cookie settings” in the footer);
- review a decision made only by automated means (we do not make any).
Email info@markandmedal.lk and we will reply within 21 working days. If you are not satisfied, you can complain to the Data Protection Authority of Sri Lanka.
8. Security
Form submissions are sent over an encrypted connection and stored in a database that cannot be read from the public website. Your account has no password to steal: you sign in with a one-time emailed link or Google, and the sign-in cookie is secure and cannot be read by scripts on the page. Access is limited to the people who need it to serve you. If a breach affects your data, we will tell you and the authority as the law requires.
9. Children
We sell to businesses, schools and associations. We do not knowingly collect personal data from children. Names on school medals or badges are supplied by the school or association, which is responsible for having the right to share them.
10. Changes
We may update this policy. The date at the top shows the latest version; significant changes will be highlighted on the site.