1. Introduction

At ceylonshop.co.uk, operated by Aurums Ceylon LTD ("we", "us", or "our"), we are committed to protecting and respecting your privacy. This policy explains how we collect, use, and protect your personal data when you visit our website or purchase our products.

Aurums Ceylon LTD is the data controller responsible for your personal data.

• Company Number: 15394969

• Address: 10 Glendower Close, Churchdown, GL3 1NR

• Email: [Insert Business Email]

2. The Data We Collect

We may collect and process the following types of personal data:

• Identity Data: Name, surname, and title.

• Contact Data: Delivery address, billing address, email address, and telephone numbers.

• Financial Data: Payment card details (processed securely via third-party providers; we do not store your full card details).

• Transaction Data: Details about products you have purchased from us.

• Technical Data: IP address, browser type, and location data (collected via cookies).

3. How We Use Your Data

We use your information for the following legal reasons:

• To Perform a Contract: To process and deliver your orders of sweets and leafy greens.

• Legitimate Interests: To improve our website and provide better customer service.

• Consent: If you sign up for our newsletter, we will send you marketing updates. You can opt-out at any time.

4. Data Sharing

We do not sell your data. We only share your data with trusted third parties to run our business:

• Delivery Couriers: To get your products to your home.

• Payment Processors: To securely handle your transactions (e.g., Stripe, PayPal).

• IT Service Providers: Our website hosting and management platform (Odoo).

5. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way. We limit access to your personal data to those employees and partners who have a business need to know.

6. How Long We Keep Your Data

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements (usually 6 years for tax purposes in the UK).

7. Your Legal Rights

Under the UK GDPR, you have the following rights:

• Access: Request a copy of the personal data we hold about you.

• Correction: Request that we fix any incorrect data.

• Erasure: Request that we delete your data (where applicable).

• Object/Restrict: Object to the processing of your data for marketing.

To exercise any of these rights, please contact us at [Insert Business Email].

8. Third-Party Links

Our website may include links to third-party websites (like social media). Clicking on those links may allow third parties to collect data about you. We do not control these websites and are not responsible for their privacy statements.

9. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with an updated "Effective Date."