Privacy Policy

We may collect the following categories of personal data:

• Contact details such as your name, email address, phone number and delivery address.
• Order and transaction history, including products purchased and payment status.
• Account credentials and preferences if you create an account.
• Communication preferences, including whether you have opted in to receive marketing communications.
• Technical data such as IP address, browser type and usage information collected via cookies (see our Cookie Policy).

We use your personal data to:

• Process and fulfil your orders, including delivery and returns.
• Communicate with you about orders, enquiries and customer support.
• Send marketing communications where you have consented, which you can opt out of at any time.
• Improve our website, products and services.
• Comply with legal and regulatory obligations.

We do not sell your personal data. We may share it with trusted third parties who help us operate our business — including payment processors, logistics and delivery partners, IT service providers, and e-commerce platforms (such as Shopee, where orders placed through our Shopee store are processed under Shopee's own terms and privacy policy) — strictly to the extent necessary to provide our services. These parties are required to protect your data and use it only for the agreed purposes.

Your personal data may be transferred to, stored in or processed in countries outside Singapore — for example, where our cloud service providers, logistics partners, or our associated manufacturing operations in Sri Lanka operate. When transferring personal data overseas, we ensure the recipient provides a standard of protection comparable to that under Singapore's PDPA, by contractual means or other appropriate safeguards.

We retain your personal data only for as long as necessary to fulfil the purposes set out in this policy, or as required by applicable law and tax obligations.

In the event of a data breach that is likely to result in significant harm to you or affects 500 or more individuals, we will notify the Personal Data Protection Commission (PDPC) within three (3) business days of becoming aware of the breach, and notify affected individuals as soon as practicable, as required by the PDPA.

We send marketing emails only to customers who have explicitly opted in via the newsletter checkbox on our registration form, or who have subsequently opted in through their account settings. You can withdraw consent and unsubscribe at any time by clicking the unsubscribe link in any marketing email or by contacting us. If you registered for an account before our explicit opt-in mechanism was in place and wish to review or update your marketing preferences, please contact us at biz@ceylonblends.com.sg. We do not send unsolicited marketing messages to phone numbers or mobile numbers registered on Singapore's Do Not Call (DNC) Registry.

Under the PDPA you have the right to: access and correct your personal data; withdraw consent to its collection, use or disclosure; and request the portability of personal data you have provided to us in a structured, commonly used format (to the extent this right applies under the PDPA). To exercise any of these rights, please contact us at biz@ceylonblends.com.sg.

We implement reasonable administrative, technical and physical safeguards to protect your personal data against unauthorised access, disclosure or loss. However, no method of transmission over the internet is completely secure.

If you have questions about this Privacy Policy or how we handle your data, please contact our Data Protection Officer at biz@ceylonblends.com.sg or WhatsApp +65 8538 5705.