Privacy Policy

1. Who controls your data

Ceylon Vault is not an incorporated company. The site is operated by Jagath Chaminda Wijaya Bandara as an individual trader, registered address Waththa Inna Kanda, Ayagama, Sri Lanka, 70024. For the purposes of Sri Lanka's Personal Data Protection Act No. 9 of 2022 (“the PDPA”), and of any equivalent foreign data protection law that applies to a given order, Jagath Chaminda Wijaya Bandara is the data controller.

Requests, questions, or complaints about this policy can be sent to info@ceylonvault.org.

2. What we collect

Depending on how you use the site, we collect:

• Account details: name, email address, phone number, and password (stored as a salted hash, never in plain text).
• Order details: billing and shipping address, order history, and payment confirmation from our payment processor (we do not store full card numbers).
• Verification details: for buyer verification, government-issued ID or business documents you choose to upload, and the review status of that verification.
• Communications: messages you send us, and support correspondence.
• Technical data: IP address, browser type, device information, and pages visited, collected automatically through essential and (where you consent) performance cookies — see our Cookie Policy for the full list.

3. Why we process it, and on what legal basis

• To perform your order (contract performance): processing payment, arranging insured shipping, and issuing certificates and invoices.
• To verify buyers (contract performance / legitimate interest): reviewing submitted ID and business documents before granting verified-buyer access to certain listings.
• To meet legal obligations: retaining records for tax purposes, and — for higher-value transactions — customer due diligence under Sri Lanka's anti-money-laundering rules for dealers in precious stones (see our Terms & Conditions).
• To keep the site secure and working (legitimate interest): fraud prevention, essential cookies, and diagnosing faults.
• With your consent: any non-essential cookie category (performance or marketing) you actively accept through the cookie banner, and any marketing email you opt into.

4. Who we share it with

We do not sell personal data. We share it only with the service providers needed to run the site and fulfil your order — our payment processor, insured courier partners, hosting and infrastructure providers, and the independent gemological laboratories that issue certification (limited to what a certificate requires) — and with a regulator, court, or law enforcement body where we are legally required to disclose it.

5. International transfer

Because Ceylon Vault ships internationally and uses service providers located outside Sri Lanka (for example, our payment processor and courier partners), your data may be transferred to and processed in other countries as a normal part of fulfilling an international order. Where the PDPA requires an adequate level of protection or appropriate safeguards for such a transfer, we rely on the transfer being necessary for the performance of your order, or on contractual safeguards with the provider concerned.

6. How long we keep it

We keep order and invoice records for as long as Sri Lankan tax and accounting law requires. We keep verification documents for as long as your buyer account remains verified, plus a limited period afterwards to meet AML record-keeping obligations. Account data is kept while your account is active; you can request deletion at any time, subject to the retention obligations above.

7. Your rights

Subject to the PDPA and, where applicable, the law of your own country, you can ask us to:

• confirm what personal data we hold about you and provide a copy (access);
• correct inaccurate or incomplete data (rectification);
• delete your data, where we are not required to keep it (erasure);
• restrict or object to certain processing;
• withdraw consent for anything we process on the basis of consent, at any time and without affecting processing already carried out; and
• request a review of any decision made about you solely by automated means.

To exercise any of these rights, email info@ceylonvault.org. We will respond within the timeframe required by the PDPA.

8. Children

Ceylon Vault is not directed at, and does not knowingly collect personal data from, anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.

9. Security

We apply reasonable technical and organizational safeguards — encrypted connections, hashed passwords, and access limited to what each function requires — to protect the data we hold. No online service can guarantee absolute security, and we will notify the Data Protection Authority and affected individuals of any breach as required by the PDPA.

10. Changes to this policy

We may update this policy as the site, our providers, or the law change. Material changes will be reflected in the “last updated” date below; continued use of the site after an update means you accept the revised policy.