Privacy policy

This Privacy Policy applies to Ceylon Elephant Co. and the website, online store, platforms, systems, and services operated in connection with Ceylon Elephant Co. (collectively, the “Site”).

The Site is owned and operated by JANET LANKA (PVT) LTD, PV65544.

In this Privacy Policy, the terms “Ceylon Elephant Co.”, “Spa Ceylon”, “we”, “us”, and “our” refer to JANET LANKA (PVT) LTD, Ceylon Elephant Co., Spa Ceylon, related entities, authorized personnel, systems, stores, platforms, service channels, and approved service providers, as applicable.

Ceylon Elephant Co. is an apparel and lifestyle brand by Spa Ceylon, inspired by the Ceylon Elephant and Sri Lanka’s natural heritage.

This Privacy Policy explains how we collect, use, store, process, disclose, transfer, retain, and protect personal information when you access or use the Site, place an order, create an account, log in through a customer identity system, subscribe to communications, participate in promotions, use rewards-related services, contact customer support, submit information, interact with our content, request an exchange, submit returned items for exchange inspection, or engage with any official Ceylon Elephant Co. or Spa Ceylon channel.

By accessing or using the Site or any related service, you acknowledge that your personal information may be handled as described in this Privacy Policy.

This Privacy Policy should be read together with our:

·   Terms of Service

·   Cookie Policy

·   Shipping Policy

·   Exchange Policy

·   Spa Ceylon Rewards Terms, where applicable

·   promotion-specific terms, where applicable

·   donation-linked campaign terms, where applicable

any other policy or notice published on the Site.

1. Scope of This Privacy Policy

This Privacy Policy applies to personal information collected through or in connection with:

·   Ceylon Elephant Co. websites and ecommerce platforms

·   Shopify, Shopify Plus, and similar ecommerce systems

·   customer account creation, login, checkout, and order processing

·   SpaCeylon ID, Spaceylon ID, Multipass-style login, single sign-on, OTP login, passwordless login, social login, customer identity systems, or similar account access tools, where enabled

·   Spa Ceylon or Ceylon Elephant Co. mobile applications, where applicable

·   retail outlets, pop-ups, activations, events, counters, exhibitions, or point-of-sale systems, where applicable

·   Spa Ceylon Rewards or related loyalty, membership, customer benefit, or promotional programs, where applicable

·   customer care, live chat, chatbot, WhatsApp, SMS, email, phone, and social media interactions

·   marketing, advertising, remarketing, analytics, and measurement channels

·   surveys, competitions, forms, promotions, product reviews, feedback tools, and customer submissions

·   donation-linked, awareness-led, conservation-related, community-related, or brand initiatives

·   AI-enabled tools, automated tools, analytics tools, fraud prevention tools, personalization tools, identity tools, and customer support tools

third-party platforms, apps, tools, plugins, providers, processors, and subprocessors used to operate, secure, improve, market, or support our business.

This Privacy Policy applies whether you complete a transaction or only browse, interact with, or use the Site.

This Privacy Policy does not replace separate employee, contractor, supplier, or internal HR privacy notices, where those apply. If an employee, contractor, supplier, or partner uses the Site as a customer, this Privacy Policy may also apply to that activity.

2. Data Controller and Responsible Entity

For the purposes of applicable data protection laws, JANET LANKA (PVT) LTD is generally the entity responsible for determining the purposes and means of processing personal information collected through Ceylon Elephant Co. and related Spa Ceylon systems.

Some third-party platforms, payment providers, banks, card networks, delivery partners, advertising platforms, identity providers, analytics providers, messaging providers, AI providers, and technology partners may process personal information under their own terms and privacy policies.

Depending on the service, such third parties may act as independent controllers, processors, subprocessors, technology providers, platform operators, payment providers, logistics providers, or professional advisers.

You should review third-party privacy notices where they are made available to you.

3. Key Terms Used in This Privacy Policy

For readability, the following terms are used in this Privacy Policy:

Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an individual.

Processing means any operation performed on personal information, including collection, recording, storage, use, analysis, disclosure, transfer, deletion, restriction, or destruction.

Service provider means a third party that processes information for us or helps us operate our Site, business, ecommerce services, marketing, payments, delivery, rewards, analytics, customer support, AI tools, security, or infrastructure.

Customer identity system means any login, customer account, SpaCeylon ID, Spaceylon ID, Shopify customer account, Multipass-style login, SSO, OTP, passwordless login, or similar identity access system used to identify or authenticate a customer.

Rewards program means Spa Ceylon Rewards or any related loyalty, membership, customer benefit, points, voucher, tier, or promotional program that may apply from time to time.

4. Information We Collect

We may collect the following categories of personal information.

4.1 Identity and Contact Information

This may include:

·   full name

·   email address

·   mobile number

·   telephone number

·   billing address

·   delivery address

·   account username or account identifier

·   SpaCeylon ID, Spaceylon ID, customer ID, loyalty ID, or similar identifier

·   date of birth, where needed for birthday offers, promotions, rewards, age-related eligibility, or account features

·   gender, where voluntarily provided

·   preferred language

·   preferred store, outlet, region, or delivery location

customer support reference number.

4.2 Account, Login, and Registration Information

This may include:

·   account creation details

·   login credentials and authentication information, stored securely

·   OTP verification records

·   password reset records

·   account login history

·   session information

·   account status

·   saved addresses

·   purchase history

·   wishlist, cart, browsing, and preference data

·   rewards account details, where applicable

·   communication preferences

·   consent records

identity linking information across Ceylon Elephant Co., Spa Ceylon, Shopify, rewards, retail, and related systems.

4.3 SpaCeylon ID, Spaceylon ID, Multipass, SSO, and Customer Identity Information

Where enabled, we may allow you to access the Site, Shopify store, customer account, rewards account, or related services using SpaCeylon ID, Spaceylon ID, Multipass-style login, single sign-on, OTP login, passwordless login, social login, or similar identity systems.

This may involve processing:

·   customer ID

·   email address

·   phone number

·   account status

·   account linking status

·   authentication token

·   session identifier

·   login token

·   timestamp

·   rewards membership status

·   name and contact details needed to create, match, or update a customer account

·   billing or delivery details needed for account or checkout functions

security, device, and fraud prevention signals.

Where a Multipass-style login or legacy customer account flow is used, it may involve signed tokens or account-matching data that allow a customer authenticated in one approved system to access another approved system without separately entering credentials again.

We do not ask you to share your password with customer support staff.

Authentication tokens, session identifiers, login links, OTPs, and similar tools may be used to confirm access, maintain sessions, protect accounts, prevent fraud, and connect customer activity across approved systems.

4.4 Technical, Device, and Usage Information

This may include:

·   IP address

·   browser type and version

·   operating system

·   device type

·   device identifiers

·   session identifiers

·   URL data

·   referral sources

·   approximate geographic location

·   website and app navigation behaviour

·   page views

·   session duration

·   clickstream data

·   cart activity

·   search behaviour

·   app usage and feature interaction data, where applicable

·   error logs

·   security logs

·   fraud signals

·   analytics identifiers

·   cookie identifiers

·   pixel identifiers

device fingerprinting signals, where used for fraud prevention, security, or abuse control.

4.5 Transaction, Order, and Payment-Related Information

This may include:

·   products viewed

·   products added to cart

·   products purchased

·   order numbers

·   transaction IDs

·   invoices

·   receipts

·   fulfilment status

·   delivery status

·   exchange requests

·   exchange inspection, return handling, or limited refund records

·   cancellations

·   refunds

·   reversals

·   chargeback references

·   customer service history

·   proof of purchase

·   product issue records

·   delivery instructions

·   payment method type

·   payment confirmation status

·   payment failure status

·   Cash on Delivery status, where applicable

·   failed delivery records

·   payment gateway references

reconciliation records.

We do not store full credit card numbers, debit card numbers, CVV numbers, card PINs, online banking passwords, wallet passwords, or sensitive payment authentication data.

Payment processing is handled by authorized payment providers, banks, card networks, wallet providers, Buy Now Pay Later providers, POS providers, or payment gateways.

Transaction and order information may be collected even if a transaction is not completed or an account is not registered.

4.6 Apparel, Product, and Preference Information

Because Ceylon Elephant Co. is mainly an apparel and lifestyle products brand, we may process information connected to:

·   size preferences

·   fit preferences

·   colour preferences

·   style preferences

·   product category preferences

·   collection interests

·   purchase patterns

·   exchange history

·   product review history

·   product care or complaint information

·   wishlist and browsing patterns

·   abandoned cart activity

product recommendation activity.

We may use this information to improve product recommendations, customer support, stock planning, sizing guidance, marketing relevance, product development, quality control, and future collections.

4.7 Rewards and Loyalty Information

Where Ceylon Elephant Co. products, purchases, campaigns, accounts, or customer activity are included in Spa Ceylon Rewards or related programs, we may collect and process:

·   rewards membership details

·   tier status

·   points earned

·   points redeemed

·   points expired

·   points forfeited

·   points reversed or adjusted

·   vouchers issued or used

·   offers received

·   benefits claimed

·   campaign participation

·   rewards-linked purchase history

·   behavioural and engagement data linked to loyalty activity

·   rewards eligibility records

·   rewards communication preferences

·   rewards abuse or fraud indicators

account suspension, limitation, or termination records, where applicable.

Eligibility for rewards may vary and is not guaranteed unless expressly stated.

4.8 Marketing, Advertising, and Communication Information

This may include:

·   subscription status

·   consent status

·   email preferences

·   SMS preferences

·   WhatsApp preferences

·   push notification preferences

·   app notification preferences

·   browser notification preferences

·   communication delivery status

·   email opens

·   link clicks

·   campaign engagement

·   offer response history

·   unsubscribe records

·   suppression lists

·   complaint records

·   customer segment information

·   campaign attribution data

·   advertising audience information

·   remarketing status

conversion tracking events.

4.9 Donation-Linked and Conservation-Related Information

Where we run donation-linked, awareness-led, conservation-related, community-related, or brand-purpose initiatives, we may process:

·   campaign participation information

·   qualifying product or order information

·   donation-linked product tags, SKU data, or order tags

·   campaign source information

·   customer engagement with awareness content

·   communication preferences relating to donation-linked updates

·   campaign analytics and reporting records

beneficiary or partner reporting data in aggregated or non-identifying form, where possible.

Unless expressly stated, a purchase does not automatically mean a donation is made to a specific organization, person, project, community, or cause.

4.10 Customer Support and Interaction Information

This may include:

·   emails sent to customer care

·   WhatsApp messages

·   SMS messages

·   live chat messages

·   chatbot messages

·   social media messages

·   phone call records or notes, where applicable

·   complaints

·   inquiries

·   exchange requests

·   refund requests

·   product issue details

·   review responses

·   AI-assisted support interactions, where applicable

·   support agent notes

·   escalation records

customer satisfaction feedback.

Phone calls may be recorded or monitored where permitted and where notice is provided, for quality, training, security, or dispute-resolution purposes.

4.11 User-Generated Content and Voluntary Submissions

This may include:

·   product reviews

·   ratings

·   photographs

·   videos

·   testimonials

·   styling images

·   social media tags

·   comments

·   competition entries

·   survey responses

·   campaign ideas

·   conservation ideas

·   feedback

·   AI-generated content you submit

any other information you voluntarily share with us.

Please avoid sending us sensitive personal information unless we specifically request it for a lawful and necessary purpose.

4.12 Retail, Event, CCTV, and In-Person Interaction Information

Where Ceylon Elephant Co. or Spa Ceylon operates through retail outlets, pop-ups, activations, counters, events, warehouses, offices, or similar locations, we may collect information through:

·   point-of-sale systems

·   receipts and invoices

·   customer forms

·   event registrations

·   loyalty enrollment forms

·   customer support records

·   CCTV cameras, where used and signposted

·   security incident records

·   staff assistance notes

delivery or collection records.

CCTV, where used, is generally for safety, security, loss prevention, fraud prevention, incident investigation, and protection of customers, staff, property, and business operations.

4.13 Employee, Contractor, and Authorized Personnel Access Information

Our employees, contractors, consultants, support agents, retail staff, warehouse staff, delivery coordination teams, marketing teams, technology teams, finance teams, legal teams, auditors, managers, and authorized personnel may access personal information where needed to perform their duties.

We may maintain records of:

·   staff access logs

·   system activity

·   customer support actions

·   order handling actions

·   refund or exchange handling actions

·   rewards adjustments

·   account changes

·   fraud review decisions

administrative activity.

Access is intended to be limited to authorized personnel who need the information for business, legal, operational, support, security, audit, or compliance purposes.

4.14 Sensitive or Special Categories of Information

We generally do not seek to collect sensitive personal information.

You should not submit sensitive personal information, including health information, financial account passwords, government ID numbers, biometric data, religious beliefs, political opinions, or similar sensitive data, unless we specifically request it for a lawful and necessary purpose.

If you voluntarily provide sensitive information, we may delete, restrict, or process it only where necessary and legally permitted.

5. How We Collect Information

We may collect personal information:

·   directly from you

·   when you browse the Site

·   when you create an account

·   when you log in through SpaCeylon ID, Spaceylon ID, Shopify customer accounts, Multipass-style login, SSO, OTP, social login, passwordless login, or similar tools

·   when you place an order

·   when you add products to cart

·   when you use checkout

·   when you subscribe to communications

·   when you join or interact with rewards-related services

·   when you contact customer support

·   when you participate in promotions, events, surveys, or campaigns

·   when you submit reviews, photos, videos, feedback, or other content

·   through cookies, pixels, SDKs, tags, and similar technologies

·   from Shopify and other ecommerce platforms

·   from payment providers

·   from delivery partners

·   from advertising, analytics, and marketing platforms

·   from fraud prevention systems

·   from AI-enabled or automated tools

·   from messaging and communication providers

·   from retail or event systems, where applicable

·   from Spa Ceylon group systems, where legally permitted

·   from employees or authorized personnel who record customer interactions

from third-party platforms used to manage campaigns, forms, loyalty, identity, analytics, or customer support.

6. Legal Bases and Purposes of Processing

We process personal information where we have a lawful basis to do so under applicable law.

Depending on the context, this may include:

·   your consent

·   performance of a contract with you

·   steps taken before entering into a contract with you

·   order processing and fulfilment

·   compliance with legal, regulatory, accounting, tax, audit, or recordkeeping duties

·   legitimate business interests, where permitted

·   fraud prevention and security

·   customer support and dispute handling

·   protection of legal rights

·   rewards, loyalty, and promotional administration

·   consent management

·   account authentication and identity verification

·   protection of customers, employees, systems, property, and business operations

any other lawful ground recognized under applicable law.

Where we rely on consent, you may withdraw consent where legally available. Withdrawal of consent will not affect processing carried out before withdrawal.

Where we rely on legitimate business interests, we aim to balance those interests against your privacy rights and expectations.

7. How We Use Personal Information

We may use personal information to:

·   operate the Site, ecommerce platform, apps, retail channels, and service channels

·   create and manage customer accounts

·   support SpaCeylon ID, Spaceylon ID, Shopify login, Multipass-style login, SSO, OTP, passwordless login, social login, or similar identity systems

·   link customer profiles across approved systems

·   process orders

·   process payments

·   issue transaction IDs

·   send order confirmations

·   arrange shipping and delivery

·   process exchanges, limited returns, refunds, reversals, and cancellations

·   provide customer support

·   respond to inquiries, complaints, and requests

·   manage product reviews and submissions

·   personalize shopping experiences

·   recommend products, sizes, styles, or collections

·   maintain shopping carts, wishlists, preferences, and account settings

·   administer promotions, offers, discounts, vouchers, and campaigns

·   administer Spa Ceylon Rewards or related programs, where applicable

·   verify rewards eligibility

·   issue, reverse, adjust, expire, suspend, or redeem rewards, where applicable

·   send transactional and service communications

·   send marketing communications where permitted

·   send rewards-related communications where applicable

·   support donation-linked, conservation-related, or awareness-led initiatives

·   measure campaign performance

·   run advertising, retargeting, attribution, and analytics

·   improve products, services, systems, content, and user experience

·   conduct analytics, reporting, audits, forecasting, and business planning

·   detect, prevent, and investigate fraud, misuse, abuse, chargebacks, security incidents, and policy violations

·   comply with legal, regulatory, tax, accounting, and audit requirements

·   protect our rights, property, customers, employees, systems, and business

·   support AI-assisted, automated, or rules-based tools used for business operations

·   manage employee and authorized personnel access to customer information

maintain security logs, consent records, access records, and operational records.

We aim to process only information reasonably necessary for the relevant purpose.

8. Transactional, Service, Marketing, and Rewards Communications

We may communicate with you through:

·   email

·   SMS

·   WhatsApp Business messaging

·   phone calls

·   push notifications

·   in-app messages

·   browser notifications

·   account notices

·   website notices

·   customer support channels

·   live chat

·   chatbot

social media messaging, where applicable.

8.1 Transactional and Service Communications

Transactional and service communications are necessary for processing and managing your orders, payments, deliveries, exchanges, limited refunds where applicable, account activity, security, customer support, fraud checks, legal notices, and related services.

These may include:

·   order confirmations

·   payment confirmations

·   transaction IDs

·   invoices

·   receipts

·   delivery updates

·   exchange updates

·   refund updates

·   account notices

·   fraud prevention or verification messages

·   customer support replies

·   service notices

·   legal or policy notices

·   login or authentication notices

rewards account notices needed for account operation.

Opting out of marketing communications will not stop essential transactional, service, legal, security, account, order, payment, delivery, exchange, refund, or customer support communications.

8.2 Marketing Communications

Marketing communications may include:

·   new apparel collections

·   product launches

·   styling updates

·   offers and discounts

·   events

·   brand news

·   awareness initiatives

·   donation-linked campaigns, where applicable

·   conservation-related updates

rewards-related offers and benefits, where applicable.

You may opt out of marketing communications where an unsubscribe, preference, or opt-out option is available.

8.3 Third-Party Messaging and Communication Tools

We may use third-party tools and providers to send, manage, personalize, measure, automate, or support communications.

These may include:

·   email service providers, including SendGrid or similar tools

·   SMS gateways

·   WhatsApp Business providers

·   push notification providers

·   customer support ticketing tools

·   live chat tools

·   chatbot tools

·   CRM platforms

·   marketing automation platforms

·   customer data platforms

·   loyalty and rewards communication tools

·   notification tools connected to Shopify or related systems

·   survey and feedback tools

·   social media messaging tools

call centre or support tools.

These tools may process contact details, message content, communication status, delivery status, open rates, click data, opt-out status, support history, and engagement data.

8.4 Rewards Communications

If Ceylon Elephant Co. products, purchases, or customer accounts are included in Spa Ceylon Rewards or related programs, certain communications may be needed to operate the rewards account, confirm benefits, notify point activity, prevent misuse, or manage eligibility.

Some rewards, member offers, discounts, vouchers, birthday offers, early access benefits, promotional benefits, or loyalty privileges may depend on your participation in rewards-related communications or marketing communications.

If you opt out, unsubscribe, block, disable, filter, or mark communications as spam, you may lose access to certain rewards, offers, vouchers, points, redemptions, member benefits, or loyalty privileges where such communications are a condition of participation, subject to applicable law.

9. Spa Ceylon Rewards and Possible Automatic Enrollment

Ceylon Elephant Co. purchases, accounts, promotions, campaigns, login activity, or customer activity may from time to time be included as part of Spa Ceylon Rewards or related loyalty, membership, customer benefit, or promotional programs.

Where applicable, creating an account, making a purchase, subscribing, participating in selected promotions, using certain services, logging in through SpaCeylon ID or Spaceylon ID, or providing your contact details may automatically enroll you in Spa Ceylon Rewards or make you eligible for rewards-related communications, offers, and benefits.

We may use personal information to:

·   create or identify your rewards profile

·   link online and offline activity

·   calculate points

·   assign tiers

·   issue vouchers

·   verify eligibility

·   prevent rewards misuse

·   reverse rewards after refunds, cancellations, chargebacks, exchanges, or abuse

·   personalize offers

·   notify you of rewards activity

manage expiry, suspension, limitation, cancellation, or termination of rewards benefits.

Where separate Spa Ceylon Rewards Terms apply, those terms will govern rewards earning, redemption, expiry, exclusions, reversals, account status, and related benefits.

10. Cookies, Analytics, Pixels, and Similar Technologies

We include a summary of cookies and similar technologies in this Privacy Policy. Detailed cookie categories, cookie duration, consent choices, cookie banner wording, analytics tools, advertising pixels, opt-out options, and preference controls are covered in our separate Cookie Policy and cookie banner settings, where available.

We may use cookies, pixels, SDKs, tags, local storage, scripts, and similar technologies across our websites, ecommerce platforms, mobile applications, advertisements, emails, and digital channels.

These technologies may be used to:

·   enable essential website functionality

·   maintain sessions

·   support login, including customer accounts, SSO, OTP, or Multipass-style login where enabled

·   remember user preferences

·   support cart and checkout functions

·   improve website performance

·   analyze traffic and behaviour

·   measure conversions

·   support advertising and remarketing

·   personalize content

·   support fraud prevention and security

·   measure campaign effectiveness

·   support affiliate, attribution, or partner reporting

·   support rewards tracking and promotion eligibility

remember cookie consent choices.

Cookies may be session-based or persistent.

Disabling cookies may affect website, ecommerce, checkout, login, account, rewards, personalization, security, fraud prevention, or app functionality.

11. Advertising, Remarketing, and Measurement

We may use digital advertising, remarketing, attribution, and measurement platforms, including:

·   Meta platforms such as Facebook and Instagram

·   Google advertising and analytics services

·   Shopify analytics and marketing tools

·   email marketing platforms

·   SMS or WhatsApp marketing platforms

·   customer data platforms

·   analytics and conversion tools

other advertising, attribution, optimization, and remarketing tools used from time to time.

These platforms may use cookies, pixels, identifiers, or similar technologies to:

·   deliver relevant advertisements

·   measure advertising effectiveness

·   support audience segmentation

·   measure conversion events

·   suppress irrelevant ads

·   create custom or lookalike audiences

improve campaign performance.

Advertising content may be personalized based on browsing behaviour, purchase history, cart activity, product interests, rewards activity, engagement patterns, and similar information.

You may be able to control certain advertising preferences through your browser, device settings, cookie banner, platform settings, or advertising provider controls.

12. Customer Profiles, Personalization, and Customer Memory

We may analyze, combine, and retain customer data across channels to build and maintain a customer profile.

This may include information from:

·   online purchases

·   retail outlet purchases, where applicable

·   customer accounts

·   SpaCeylon ID or Spaceylon ID activity

·   rewards activity

·   customer care interactions

·   marketing engagement

·   browsing behaviour

·   app usage

·   product preferences

·   exchange, inspection, or limited refund history

·   donation-linked campaign participation

·   survey responses and feedback

·   advertising engagement

·   messaging engagement

fraud prevention and security records.

We may use this information to:

·   understand preferences

·   personalize offers

·   improve customer service

·   recommend products

·   manage rewards eligibility

·   support fraud prevention

·   resolve disputes

·   improve product planning

·   support customer segmentation

·   improve campaign relevance

·   support cross-channel customer recognition

improve business forecasting.

Aggregated or anonymized data may be used for analytics, forecasting, reporting, stock planning, product development, service improvement, and business planning. Aggregated or anonymized data does not identify individual customers.

13. AI, Automated Processing, and System Decisions

We may use AI-enabled tools, automation, machine learning, rules-based systems, analytics systems, recommendation engines, and similar technologies to support business operations.

These tools may assist with:

·   customer service replies

·   chatbot support

·   product recommendations

·   size or fit guidance

·   search results

·   personalization

·   marketing segmentation

·   campaign targeting

·   rewards eligibility checks

·   tier assignments

·   offer targeting

·   fraud detection

·   payment risk review

·   order verification

·   account security

·   content moderation

·   review analysis

·   translation

·   demand forecasting

·   inventory planning

·   analytics and reporting

·   customer support routing

·   detection of promotion or rewards misuse

service quality review.

AI-enabled or automated outputs may be incomplete, inaccurate, outdated, or unsuitable for your specific circumstances.

We may review, correct, reject, edit, override, or disable AI-enabled or automated outputs at our discretion.

We do not knowingly submit full card numbers, CVV numbers, payment passwords, wallet passwords, banking passwords, or sensitive payment authentication data into AI tools.

Where AI or automated tools process personal information, such processing is subject to this Privacy Policy, applicable service provider terms, internal controls, and applicable law.

Automated processing may support operational decisions, including rewards eligibility, offer targeting, fraud review, account review, promotion eligibility, customer segmentation, support routing, and order verification.

Where appropriate and legally required, certain automated or system-assisted outcomes may be reviewed manually.

14. Ecommerce Platforms, Shopify, and Order Processing

Ceylon Elephant Co. operates ecommerce services using third-party platforms and tools, including Shopify, Shopify Plus, and similar ecommerce solutions.

These platforms may support:

·   account creation and login

·   customer account authentication

·   Multipass-style login, legacy customer account login, customer account tools, or SSO where enabled

·   product browsing

·   cart activity

·   checkout

·   order placement

·   payment initiation

·   order confirmation

·   fulfilment

·   shipping and delivery updates

·   exchange and limited refund support where applicable

·   promotional application

·   rewards-related integrations

·   communication and notification delivery

·   fraud prevention

·   analytics and reporting

customer profile matching.

Personal information processed through ecommerce platforms is handled in accordance with this Privacy Policy and the relevant platform’s privacy and security controls.

Shopify and similar platforms may also process information according to their own terms, privacy notices, and service provider arrangements.

15. Payment Processing and Providers

We use authorized third-party payment service providers for online and, where applicable, in-store transactions.

These may include:

·   PayHere

·   MintPay

·   Koko

·   local and international bank payment gateways

·   card processors

·   Buy Now Pay Later providers

·   QR-based payment systems

·   wallet payment systems

·   POS payment partners

other payment providers used from time to time.

Payment processing may vary by channel, outlet, platform, payment method, customer location, and technical setup.

We receive limited transaction-related information required for:

·   order fulfilment

·   payment confirmation

·   transaction ID generation or matching

·   refunds

·   reversals

·   reconciliation

·   fraud prevention

·   customer support

·   compliance

·   dispute handling

chargeback handling.

Each payment provider operates under its own privacy and security policies.

16. Shipping, Delivery, and Logistics Partners

We may share personal information with delivery, courier, logistics, fulfilment, warehouse, and customer notification partners to process and deliver orders.

This may include:

·   name

·   delivery address

·   phone number

·   email address

·   order details

·   delivery instructions

·   payment method type, where needed

·   Cash on Delivery status, where applicable

·   tracking details

·   exchange, return inspection, or failed delivery information

customer support notes needed for delivery.

Delivery partners may contact you directly to complete delivery or resolve delivery issues.

Shipping and delivery terms are covered separately in our Shipping Policy.

17. Exchanges, Returned Items Submitted for Exchange Inspection, and Limited Refunds

We may process personal information to handle exchange requests, returned items submitted for exchange inspection, limited refunds where applicable, product issues, order cancellations, and customer complaints.

This may include:

·   order details

·   proof of purchase

·   product condition information

·   clear product photos shared by the customer

·   reason for exchange request

·   requested size or colour change

·   customer communication history

·   payment confirmation references

·   rewards, points, voucher, discount, or promotional usage

·   fraud, misuse, or abuse indicators

·   staff notes and approval records

·   customer care confirmation records

·   store exchange confirmation records

·   outlet inspection records

·   courier pickup records

·   delivery note or consignee note records

·   return pickup fee records

·   failed inspection records

records of items returned to the customer at the customer’s cost, where applicable.

Exchange eligibility, inspection requirements, courier pickup handling, store exchange handling, exchange fees, single-exchange limits, non-exchangeable items, and limited refund terms are covered separately in our Exchange Policy.

18. Employees, Authorized Personnel, and Internal Access

Personal information may be accessed by employees, contractors, consultants, agents, retail staff, customer support staff, warehouse staff, finance staff, technology staff, marketing staff, legal staff, management, auditors, and other authorized personnel where needed.

Such access may be required to:

·   process orders

·   handle customer support

·   manage exchanges or limited refunds where applicable

·   manage payments and reconciliation

·   arrange delivery

·   manage rewards

·   handle complaints

·   investigate fraud or misuse

·   maintain systems

·   run marketing campaigns

·   manage donation-linked campaigns

·   comply with legal, audit, tax, or regulatory duties

protect customers, staff, property, systems, and business operations.

We may use internal access controls, authorization rules, confidentiality duties, system logs, staff policies, training, and monitoring to protect personal information.

We may restrict, review, suspend, or remove internal access where appropriate.

19. Infrastructure, Hosting, Servers, and Platform Differences

We operate digital platforms, ecommerce services, systems, applications, internal tools, and data processing environments using cloud-based, hosted, and third-party infrastructure.

Our systems may be hosted, supported, processed, backed up, or transmitted through providers including:

·   Shopify and related ecommerce infrastructure

·   Amazon Web Services

·   Contabo

·   analytics and marketing platforms

·   communication platforms

·   AI service providers

·   customer support platforms

·   payment and fraud prevention providers

·   identity and SSO providers

·   consent management platforms

·   security and monitoring tools

other hosting, cloud, infrastructure, or technology providers used from time to time.

Different systems may operate on different servers, data centres, cloud regions, technical environments, support centres, subprocessors, or processing regions.

The way personal information is collected or processed may differ depending on the platform or channel used, including websites, ecommerce platforms, mobile applications, retail outlets, POS systems, customer service tools, rewards systems, identity systems, messaging tools, and internal operational tools.

All such processing is intended to follow the privacy principles and safeguards described in this Privacy Policy.

20. International Data Transfers

Personal information may be processed, stored, backed up, accessed, supported, or transferred in Sri Lanka or in other countries and regions where we or our service providers operate.

These countries may have data protection laws that differ from those in Sri Lanka or your country of residence.

Your information may be processed by:

·   ecommerce platforms

·   cloud providers

·   payment providers

·   analytics providers

·   advertising platforms

·   AI service providers

·   customer support platforms

·   marketing platforms

·   rewards providers

·   delivery partners

·   identity providers

·   messaging providers

·   technical support teams

group systems and authorized personnel.

Where required by applicable law, we will take reasonable steps to protect personal information transferred across borders. Such steps may include contractual safeguards, internal controls, access restrictions, security measures, vendor due diligence, or other lawful transfer mechanisms.

Use of the Site, ecommerce platform, rewards services, communication channels, login tools, or customer support channels indicates acknowledgment that cross-border processing may occur as described in this Privacy Policy.

21. Disclosure of Personal Information

We may share personal information with:

·   employees and authorized personnel

·   Spa Ceylon group entities and related brands

·   ecommerce platforms

·   technology providers

·   CRM providers

·   analytics providers

·   marketing platforms

·   advertising platforms

·   communication providers

·   WhatsApp, SMS, email, push notification, and messaging providers

·   AI-enabled service providers

·   automation providers

·   cloud and hosting providers

·   logistics, courier, and fulfilment partners

·   payment processors

·   banks and financial institutions

·   fraud prevention and security providers

·   identity, authentication, SSO, or login providers

·   rewards and loyalty providers

·   customer support platforms

·   survey, review, and feedback platforms

·   consent management platforms

·   auditors, lawyers, insurers, consultants, and professional advisers

regulators, law enforcement bodies, courts, or public authorities where required.

We may also disclose information:

·   where required by law or regulation

·   in response to court orders or lawful requests

·   to protect our legal rights

·   to prevent fraud, misuse, or abuse

·   to investigate security incidents

·   in connection with audits or investigations

·   in connection with a merger, acquisition, restructuring, financing, sale, transfer, or business reorganization

to enforce our Terms of Service, Exchange Policy, Rewards Terms, promotion terms, or other policies.

We do not sell personal data.

22. Third-Party Tools, Apps, Integrations, and Subprocessors

We may use third-party tools, apps, platforms, integrations, service providers, and subprocessors to operate, improve, protect, automate, and measure our services.

These may include tools for:

·   Shopify ecommerce

·   customer accounts

·   SpaCeylon ID or Spaceylon ID

·   SSO, Multipass-style login, OTP, and authentication

·   payment processing

·   fraud prevention

·   customer support

·   helpdesk and ticketing

·   live chat and chatbot services

·   email marketing

·   SMS messaging

·   WhatsApp messaging

·   push notifications

·   CRM and customer data

·   loyalty and rewards

·   analytics

·   advertising

·   attribution

·   personalization

·   AI assistance

·   translation

·   product recommendations

·   review collection

·   surveys

·   consent management

·   cookie banner tools

·   courier and delivery updates

·   accounting, audit, and reconciliation

system monitoring and security.

Service providers and subprocessors may change from time to time.

We may add, replace, suspend, or remove service providers, tools, platforms, integrations, or subprocessors without individual notice, unless specific notice is required by applicable law.

23. Data Security

We use reasonable technical, organizational, and administrative safeguards designed to protect personal information.

These may include:

·   access controls

·   authentication controls

·   encryption where appropriate

·   secure payment processing through authorized providers

·   internal confidentiality controls

·   system monitoring

·   fraud prevention tools

·   security reviews

·   backups and disaster recovery processes

·   vendor security controls

·   staff access controls

·   logging and monitoring

·   account security measures

·   token-based authentication controls, where applicable

·   role-based access restrictions

incident response processes.

Internet-based systems carry inherent risks. No method of transmission over the internet, cloud hosting, electronic storage, AI processing, payment processing, identity processing, or digital communication is fully secure.

We cannot guarantee absolute security of information transmitted through or stored by the Site, Shopify, payment gateways, communication systems, AI tools, third-party platforms, identity providers, cloud providers, or internal systems.

If required by applicable law, we may notify affected individuals, regulators, or relevant authorities of certain data security incidents.

24. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy.

This may include retention:

·   while customer accounts remain active

·   while SpaCeylon ID, Spaceylon ID, or similar identity accounts remain active

·   while rewards accounts remain active

·   for order fulfilment

·   for exchanges, limited refunds where applicable, reversals, and customer support

·   for legal, regulatory, tax, accounting, and audit purposes

·   for fraud prevention

·   for dispute resolution

·   for chargeback handling

·   for business reporting

·   for consent and opt-out records

·   for security monitoring

·   for staff access logs

·   for backup and disaster recovery purposes

for enforcing our Terms of Service and related policies.

Retention periods may vary depending on the type of information, purpose of processing, legal requirements, operational needs, risk, and customer relationship.

Aggregated or anonymized data may be retained for longer periods for analytics, forecasting, reporting, product development, service improvement, and business planning.

Personal information may also remain in backups or disaster recovery systems for a limited period based on operational and security needs.

25. Data Accuracy

You are responsible for ensuring that personal information you provide to us is accurate, complete, and up to date.

This includes:

·   name

·   phone number

·   email address

·   billing address

·   delivery address

·   rewards account information

·   login account information

·   payment-related information

·   communication preferences

·   exchange request details

product images or information submitted for exchange inspection.

We are not responsible for missed transaction IDs, order updates, delivery notices, refund notices, exchange notices, customer care confirmations, store exchange confirmations, courier pickup communications, rewards communications, promotional communications, login notices, customer support responses, or failed deliveries caused by incorrect, outdated, blocked, inaccessible, or inaccurate information provided by you.

26. Your Rights

Subject to applicable law, you may request:

·   access to personal information we hold about you

·   correction of inaccurate or incomplete personal information

·   withdrawal of consent where processing is based on consent

·   cessation of marketing communications

·   deletion or restriction of certain personal information, where applicable

·   review of certain automated or system-assisted outcomes, where applicable

·   information about how your personal information is processed

·   objection to certain processing, where applicable

portability of certain personal information, where applicable.

Requests may be sent to:

·   privacy@spaceylon.com

We may need to verify your identity before responding to your request.

Certain requests may be limited or refused where we need to retain or process information for legal, contractual, fraud prevention, dispute resolution, accounting, tax, audit, security, operational, rewards, transaction, or legitimate business purposes.

We may also retain certain information where required or permitted by law, including records needed to evidence transactions, consent, opt-out status, fraud prevention, disputes, complaints, compliance, or legal claims

27. Marketing Opt-Out

You may opt out of marketing communications at any time using the unsubscribe link, preference centre, opt-out instruction, or other method provided in relevant communications.

Opting out of marketing communications will not stop essential transactional, service, legal, security, order, payment, delivery, exchange, return inspection, limited refund, customer support, login, authentication, account, or operational communications.

Opting out may affect your ability to receive certain rewards, offers, vouchers, points, discounts, early access benefits, birthday offers, promotional benefits, or member privileges where marketing or rewards-related communication is a condition of eligibility.

28. Cookies and Tracking Choices

You may be able to control certain cookies and tracking technologies through:

·   our cookie banner

·   Cookie Policy settings

·   browser settings

·   device settings

·   advertising platform settings

·   email unsubscribe tools

·   app notification settings

account preference settings, where available.

Blocking or disabling certain cookies may affect Site functionality, checkout, login, account access, cart features, personalization, rewards tracking, campaign attribution, fraud prevention, security, or user experience.

For full details, please review our separate Cookie Policy.

29. Third-Party Websites and Platforms

Our Site, emails, messages, advertisements, social media content, or customer support channels may link to third-party websites, platforms, services, or applications.

These may include:

·   payment providers

·   delivery providers

·   advertising platforms

·   social media platforms

·   review platforms

·   conservation partners

·   charitable partners

·   rewards providers

·   Shopify or app providers

·   AI or automation providers

·   analytics providers

·   messaging providers

identity providers.

We are not responsible for the privacy practices, content, security, policies, or actions of third-party websites or platforms.

You should review the privacy policies and terms of any third-party service you use.

30. Children

We do not knowingly collect personal information from individuals under 16 years of age without appropriate consent.

By using the Site, creating an account, placing an order, subscribing, participating in rewards, or submitting information, you confirm that you are at least 16 years old or that you have parental or guardian consent where required.

If we become aware that personal information has been collected from a child without appropriate consent, we may take steps to delete or restrict such information.

31. Fraud Prevention, Security, and Abuse Control

We may use personal information, device information, transaction information, account history, rewards activity, payment status, delivery records, login data, identity data, exchange activity, returned item inspection records, customer support records, and behavioural indicators to detect, prevent, and investigate:

·   fraud

·   payment misuse

·   chargeback abuse

·   promotion abuse

·   rewards misuse

·   duplicate account abuse

·   automated order activity

·   scraping or bot activity

·   suspicious login activity

·   account compromise

·   unauthorized transactions

·   policy violations

·   cyber incidents

·   identity misuse

·   voucher or coupon abuse

·   false claims

·   exchange abuse

·   return inspection abuse

·   product condition misrepresentation

resale or bulk purchase abuse, where restricted.

We may use manual review, automated systems, AI-enabled tools, third-party fraud tools, payment gateway signals, device signals, login signals, employee review, and internal risk controls.

We are not required to disclose fraud detection rules, risk scores, internal review logic, AI review methods, vendor logic, or security processes.

32. Business Transfers

If Spa Ceylon, Ceylon Elephant Co., or any relevant part of our business is involved in a merger, acquisition, restructuring, financing, sale, transfer, reorganization, brand transfer, asset transfer, or similar transaction, personal information may be transferred or disclosed as part of that transaction.

Any such transfer will be handled in accordance with applicable law and reasonable confidentiality or data protection measures where required.

33. Changes to This Privacy Policy

We may update, modify, replace, remove, or add to this Privacy Policy at any time.

The most recent version published on the Site or official Spa Ceylon platform applies from the date of publication.

We may, at our discretion, notify users of major changes by email, website notice, SMS, WhatsApp, account notice, or other means.

We are not required to provide individual notice of every change unless required by applicable law.

It is your responsibility to review this Privacy Policy from time to time to stay informed of how we handle personal information.

Your continued use of the Site, placement of an order, login through any identity system, participation in rewards, subscription to communications, or interaction with our services after updates are posted will be treated as acknowledgment of the updated Privacy Policy.

If you do not agree with the updated Privacy Policy, you should stop using the Site and related services.

34. Regional and International Privacy Rights

This Privacy Policy is intended to address our privacy practices in Sri Lanka and, where applicable, other regions from which customers, visitors, or users may access the Site.

Sri Lanka

Where applicable, personal information processed by us will be handled in accordance with the Personal Data Protection Act No. 9 of 2022 and related rules, regulations, directions, or guidance issued by the Data Protection Authority of Sri Lanka.

Subject to applicable law, individuals in Sri Lanka may have rights relating to access, correction, withdrawal of consent, objection to certain processing, and other rights recognized under applicable data protection laws.

Requests may be submitted to privacy@spaceylon.com.

European Economic Area, European Union, and United Kingdom

If you are located in the European Economic Area, European Union, or United Kingdom, and if applicable data protection laws apply to our processing of your personal information, you may have additional rights under the GDPR, UK GDPR, or other applicable data protection laws.

These rights may include:

·   the right to access your personal information

·   the right to correct inaccurate or incomplete personal information

·   the right to request deletion of personal information

·   the right to restrict certain processing

·   the right to object to certain processing, including direct marketing

·   the right to data portability, where applicable

·   the right to withdraw consent where processing is based on consent

·   the right not to be subject to certain solely automated decisions that produce legal or similarly significant effects, where applicable

the right to complain to a relevant data protection authority.

Where required by applicable law, we will rely on appropriate lawful bases for processing personal information, which may include consent, performance of a contract, compliance with legal obligations, legitimate interests, protection of legal claims, fraud prevention, security, customer support, and operation of our services.

Where required by applicable law, we will use appropriate safeguards for international transfers of personal information, which may include contractual safeguards, vendor assessments, internal controls, access restrictions, security measures, or other lawful transfer mechanisms.

If we are legally required to appoint an EU or UK representative, we may publish the relevant representative details in this Privacy Policy or on another appropriate privacy notice page. Where such appointment is not legally required or has not yet been made, privacy requests may be submitted directly to privacy@spaceylon.com.

Other Countries and Regions

If you access the Site from outside Sri Lanka, your personal information may be processed in Sri Lanka and in other countries where we or our service providers operate.

Depending on your country or region, you may have privacy rights under local law. Where applicable and legally required, we will consider and respond to such requests in accordance with relevant legal requirements.

We may limit, decline, or modify requests where permitted by law, including where information is required for transactions, fraud prevention, security, dispute resolution, legal compliance, accounting, audit, tax, rewards administration, or legitimate business purposes.

35. Contact Information

For privacy-related questions, requests, or concerns, please contact:

·   Email: privacy@spaceylon.com

Postal Address:

JANET LANKA (PVT) LTD

No. 775/D, Galle Road

Nalluruwa, Panadura

Sri Lanka

For general customer support, order, exchange, delivery, product, or rewards inquiries, please contact Customer Care through:

·   Email: online@spaceylon.com

Phone / WhatsApp: +94 77 659 5757

Additional Customer Care Contact: +94 72 111 7722

For general inquiries, you may also contact:

·   Email: info@spaceylon.com

Business hours, response times, and available support channels may vary.