Privacy Policy

1. Introduction

Biswa Clay Tiles ("we," "us," or "our"), operating through the website terracottatiles.online, is committed to protecting and respecting your personal data in accordance with the Personal Data Protection Act No. 9 of 2022 of the Democratic Socialist Republic of Sri Lanka (the "PDPA") and all applicable data protection legislation.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and your rights as a data subject. By accessing or using our website, you acknowledge that you have read and understood this policy.

2. Data Controller

For the purposes of the PDPA, the data controller responsible for your personal data is:

3. Personal Data We Collect

We collect and process the following categories of personal data:

3.1 Information You Provide Directly

• Contact information: full name, email address, and phone number when you use our contact form or place an order.
• Shipping and billing address: street address, city, state/province, postal code, and country when you proceed to checkout.
• Order details: product selections, quantities, agreed pricing, and currency preferences.
• Donation information: display name (if not anonymous), email address for receipts, selected campaign, and donation amount.

3.2 Information Collected Automatically

• IP address: your Internet Protocol address is collected during checkout for fraud prevention and is hashed before being transmitted to our payment processor. We do not store raw IP addresses in our database.
• Browser and device data: browser type, operating system, screen resolution, and referring URL collected through standard web server logs.

3.3 Information Collected by Third Parties

Our payment processor, MoonPay, independently collects payment card details, identity verification documents, and other Know Your Customer (KYC) information directly through their embedded widget. This data is collected and processed solely by MoonPay under their own privacy policy. We never receive, access, or store your card numbers, CVV, or identity documents.

4. Purposes and Lawful Basis for Processing

We process your personal data for the following purposes under the lawful bases recognised by the PDPA:

5. Data Security

We implement appropriate technical and organisational measures to safeguard your personal data, including:

• Encryption at rest: customer email addresses and donor names stored in our database are encrypted using AES-256-GCM with per-subject data encryption keys.
• Blind indexing: email lookups use HMAC-SHA256 hashed indices, meaning your actual email is never queried in plaintext.
• Crypto-shredding: when your data is deleted, the encryption key for your record is destroyed, rendering the encrypted data irrecoverable.
• Transport security: all data transmitted between your browser and our servers is protected by TLS (HTTPS) encryption.
• Payment isolation: we never process, transmit, or store payment card data. All payment processing is handled entirely by MoonPay within their PCI DSS-compliant infrastructure.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Order records: retained for a period required by applicable tax and accounting laws (typically seven years from the date of the transaction).
• Donation records: retained for the period required by applicable charitable and tax regulations.
• Contact enquiries: contact form submissions are sent directly to our email and are not stored on our servers.
• Server logs: automatically purged after 90 days.

Upon expiry of the retention period, personal data is securely deleted using crypto-shredding (destruction of encryption keys) or secure erasure methods.

7. Cross-Border Data Transfers

As our business is based in India, your personal data may be transferred to and processed in India. Such transfers are carried out in compliance with Section 27 of the PDPA, and we ensure that adequate safeguards are in place, including:

• Encryption of personal data in transit and at rest.
• Contractual obligations requiring the recipient to maintain equivalent data protection standards.
• Limiting data transfers to what is strictly necessary for the performance of the contract or the provision of our services.

MoonPay, our payment processor, may process data in jurisdictions outside Sri Lanka in accordance with their own privacy policy and applicable data protection laws.

8. Your Rights Under the PDPA

As a data subject under the Personal Data Protection Act No. 9 of 2022, you have the following rights:

• Right of access (Section 17): you may request confirmation as to whether we process your personal data and obtain a copy of such data.
• Right to rectification (Section 18): you may request correction of inaccurate or incomplete personal data.
• Right to erasure (Section 19): you may request deletion of your personal data where there is no compelling reason for its continued processing, subject to legal retention obligations.
• Right to restrict processing (Section 20): you may request that we limit the processing of your personal data in certain circumstances.
• Right to data portability (Section 21): you may request to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object (Section 22): you may object to the processing of your personal data where it is based on legitimate interest.
• Right to withdraw consent: where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at bctiles5@gmail.com. We will respond to your request within 30 days in accordance with the PDPA.

9. Cookies and Tracking Technologies

Our website uses only essential cookies that are strictly necessary for the functioning of the site (such as session management). We do not use advertising cookies, analytics trackers, or third-party tracking technologies for behavioural profiling.

The embedded MoonPay payment widget may set its own cookies as necessary for payment processing and fraud prevention. These are governed by MoonPay's own cookie policy.

10. Third-Party Services

We share personal data with the following third parties only as necessary:

• MoonPay: payment processing, KYC verification, and fiat-to-crypto conversion. MoonPay acts as an independent data controller for the personal data it collects directly from you.
• Google Fonts: web fonts are loaded from Google's servers. Google may collect your IP address and browser information as described in their privacy policy.

We do not sell, rent, or trade your personal data to any third party for marketing or commercial purposes.

11. Children's Privacy

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will take steps to delete such data promptly.

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Authority of Sri Lanka within 72 hours of becoming aware of the breach, in accordance with Section 31 of the PDPA. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

13. Complaints

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the Data Protection Authority of Sri Lanka established under Part IX of the PDPA.

We encourage you to contact us first at bctiles5@gmail.com so that we may attempt to resolve your concern directly.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

15. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

See also: Terms and Conditions