Privacy policy

The data controller responsible for your personal data is Ceylora Gem Exchange (https://ceylora.global).

Registered address: Ceylora Gem Exchange, Colombo, Sri Lanka (full registered address to be confirmed)

Privacy contact: trade@ceylora.global

We have not appointed a separate data protection officer. All privacy and data subject requests should be sent to the privacy contact above.

Depending on how you use the platform, we may process:

• Identity and contact data — name, business name, job title, work email, telephone, billing or delivery address, country.
• Account and trade data — login identifiers, password hashes, trade verification documents you submit, enquiry bag contents, memo or sourcing brief details, correspondence with the desk.
• Technical and usage data — IP address, browser type, device identifiers, pages viewed, timestamps, referral source, and security logs.
• Cookie and similar technology data — as described in our Cookie policy.

We do not intentionally collect special category data (for example health or biometric data). Our services are directed at professional trade buyers, not children under 16.

Prototype notice: This concept frontend may not yet transmit personal data to a live production environment. Form submissions may display confirmation messages only until backend integration is complete.

We process personal data only where we have a valid legal basis. The table below summarises our main processing activities.

Where we rely on legitimate interests, we balance our interests against your rights and expect minimal privacy impact for core B2B trade operations. You may object to processing based on legitimate interests as set out in section 8.

We do not sell your personal data. We may share data with:

• Service providers (processors) — hosting, email, customer support, analytics (if consented), and IT security providers bound by data processing agreements.
• Trade partners — laboratories, insurers, logistics and payment providers when needed to fulfil an enquiry or transaction you request.
• Professional advisers — lawyers, auditors, and insurers under confidentiality duties.
• Authorities — regulators, courts, or law enforcement when required by law.

A list of key processor categories is available on request from the privacy contact.

Your data may be processed in Sri Lanka, the United Kingdom, the European Economic Area, and other countries where our providers operate. Where personal data is transferred outside the UK or EEA to a country without an adequacy decision, we implement appropriate safeguards such as the UK International Data Transfer Agreement (IDTA), EU Standard Contractual Clauses (SCCs), or equivalent mechanisms, and carry out transfer risk assessments where required.

We keep personal data only as long as necessary for the purposes above:

• Trade accounts: Duration of the trade relationship plus 7 years for tax and trade records
• Enquiries and desk correspondence: 3 years from last activity unless a longer period is required by law
• Server and security logs: 90 days unless needed for security investigations
• Marketing (if used): Until you withdraw consent or object, whichever is earlier

We may retain anonymised or aggregated data for longer where it cannot identify you.

We apply appropriate technical and organisational measures including access controls, encryption in transit, secure development practices, and staff confidentiality obligations. No method of transmission over the internet is completely secure; we cannot guarantee absolute security.

If you are in the UK or EEA (or where similar rights apply), you have the following rights, subject to conditions and exemptions in law:

• Access (Article 15) — obtain a copy of your personal data and information about how we use it.
• Rectification (Article 16) — correct inaccurate data.
• Erasure (Article 17) — request deletion in certain circumstances.
• Restriction (Article 18) — limit how we use your data in certain cases.
• Data portability (Article 20) — receive data you provided in a structured, machine-readable format where processing is based on consent or contract and is automated.
• Objection (Article 21) — object to processing based on legitimate interests or direct marketing.
• Withdraw consent — where processing is based on consent (for example non-essential cookies), you may withdraw at any time without affecting the lawfulness of processing before withdrawal.

To exercise your rights, email trade@ceylora.global. We may need to verify your identity. We respond within one month, extendable by two further months for complex requests as permitted by law.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU/EEA member state or UK where you live or work, or where an alleged infringement occurred:

• United Kingdom: Information Commissioner's Office (ICO)
• European Economic Area: Your national data protection authority
• Sri Lanka: Data Protection Authority of Sri Lanka

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. Trade account decisions involve human review by the desk.

Where we collect data because it is necessary to enter or perform a contract (for example trade account registration), failure to provide required fields may mean we cannot onboard you or process your enquiry. Other fields may be optional as indicated on forms.

We may update this notice to reflect legal, technical, or business changes. The "Last updated" date at the top will change when we do. Material changes may be notified by email or a prominent site notice where appropriate.