Everyone

Privacy Policy

What personal information we collect, why we use it, who receives it and the choices available to you.

Important This policy forms part of the Ceylona Terms of Use. Mandatory rights under applicable law take priority where they cannot be limited by contract.

1. Who controls your information

Ceylona is responsible for personal data used to operate the marketplace. Sellers may separately control buyer information they receive to fulfil an order. Questions and privacy requests can be sent to privacy@ceylonaa.com.

2. Information we collect

Account details such as name, email, phone number and authentication identifiers.
Order, delivery, billing and transaction information. Full card details are handled by authorised payment providers and are not intended to be stored by Ceylona.
Seller identity, shop, payout, tax and verification information.
Messages, reviews, support requests and content you upload.
Device, browser, IP address, approximate location, cookie and activity information.
Information received from sign-in, payment, fraud-prevention, courier and analytics providers.

3. Why we use it

Provide accounts, listings, checkout, delivery, messages, reviews and support.
Perform contracts and process transactions.
Protect users, prevent fraud, enforce policies and comply with legal duties.
Personalise search and recommendations and measure service performance.
Send service communications and, with consent where required, marketing.
Improve accessibility, reliability and marketplace features.

4. Legal grounds

Depending on the activity, processing is based on performing a contract, complying with legal obligations, legitimate interests such as security and service improvement, consent, or another ground permitted by Sri Lanka’s Personal Data Protection Act, No. 9 of 2022.

5. Sharing

Sellers and buyers, to the extent needed to complete an order.
Payment processors, couriers, email, hosting, identity, analytics and fraud-prevention providers.
Professional advisers, insurers, regulators, courts or law-enforcement bodies where legally required.
A successor organisation in a merger, financing or transfer, subject to appropriate safeguards.

6. International transfers and retention

Some providers may process information outside Sri Lanka. We use contractual, organisational and technical safeguards appropriate to the transfer. We keep information only as long as needed for the purposes above, open disputes, security, accounting and legal requirements, then delete or de-identify it.

7. Your choices and rights

Request access to or correction of your personal data.
Request deletion, restriction or objection where applicable.
Withdraw consent without affecting earlier lawful processing.
Unsubscribe from marketing while continuing to receive essential service messages.
Complain to Ceylona or the Data Protection Authority of Sri Lanka.

8. Security and children

We use proportionate access controls, encryption in transit, monitoring and provider safeguards. No system is completely secure, so users should protect their credentials. Ceylona is not directed to children under 16 and seller accounts require an adult.