Privacy
Privacy Notice
How CeyLanka Naturals handles personal data submitted through this website and related buyer interactions.
Reviewed August 2026
01
Who this notice is for
This notice applies to visitors, prospective buyers and business contacts who interact with the CeyLanka Naturals website or submit information through its enquiry and account-related features.
CeyLanka Naturals is being established as a Sri Lankan export business. This notice should be read together with the specific information shown at the point where data is collected.
02
Information we may process
Depending on how you use the site, information may include your name, business name, email address, telephone number, destination country, product requirements, quote details, account identifiers, order-related records, technical/security data and correspondence.
We aim to collect only information that is reasonably needed for the relevant business purpose.
03
Why we use information
Personal data may be used to respond to enquiries, prepare and manage quotations, maintain customer records, provide account functionality, process future orders, meet legal or compliance obligations, prevent abuse, secure the service and keep an auditable business record.
Where a particular processing activity requires a specific legal basis or consent, that requirement must be satisfied before the activity is enabled.
04
Sri Lankan data-protection framework
Sri Lanka's Personal Data Protection Act No. 9 of 2022, as amended, establishes the country's personal-data protection framework. The Data Protection Authority publishes the Act, amendment legislation, gazettes and current guidance.
This website policy is operational information, not a substitute for the Act, regulations or professional legal advice.
05
Service providers and international processing
The website may rely on technology, hosting, communications, security, media, payment or business-service providers. Those providers should receive only the information needed for their role and should be governed by appropriate contractual and security controls.
Because an export business and its technology providers can operate across borders, international data transfers must be reviewed against the applicable legal requirements before production use.
06
Retention and security
Retention periods should reflect the purpose of the record, legal/accounting obligations, dispute and audit needs, security requirements and whether an enquiry becomes an active customer relationship.
CeyLanka uses technical and organisational safeguards appropriate to the service, but no internet-connected system can promise absolute security.
07
Your requests and contact route
Where applicable law gives you rights relating to your personal data, requests can be raised through the Contact page. Identity or authority may need to be verified before a request is actioned.
The public privacy-contact mailbox will only be published when the mailbox and response ownership are operationally verified.