Privacy Policy

Privacy Policy

North Star Spice (Pvt) Ltd ("we", "us", "our") is committed to protecting the personal information you share with us. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights under applicable law, including the Personal Data Protection Act No. 9 of 2022 of Sri Lanka (PDPA).

By submitting an enquiry form or otherwise engaging with our website at northstarspice.com, you acknowledge that you have read and understood this policy.

1. Personal Data We Collect

When you submit a trade enquiry or contact form on our website, we collect the following categories of personal data:

• Full name — to address you correctly in correspondence.
• Business email address — to respond to your enquiry and send order-related communications.
• Company / organisation name — to understand your business context and verify B2B eligibility.
• Phone number — for follow-up calls where you have requested a call-back or where urgency requires it.
• Country of operation — to determine applicable Incoterms, shipping routes, and regulatory requirements.
• Enquiry message content — to understand your product requirements and respond accurately.

We do not collect payment card details directly; any payment processing is handled by our appointed payment processors under their own privacy terms.

We do not knowingly collect personal data from individuals under the age of 18. Our services are directed exclusively at business professionals.

2. Legal Basis for Processing

We process your personal data on the following legal grounds:

• Legitimate interest — Processing is necessary to respond to your trade enquiry, manage the commercial relationship, and fulfil our obligations as an exporter. We have conducted a legitimate-interest assessment and concluded that our interests do not override your fundamental rights.
• Consent — Where you have opted in to receive our product newsletters or marketing updates, we process your email address on the basis of your freely given consent. You may withdraw consent at any time by clicking the unsubscribe link in any such email or by writing to us at the address below.
• Contractual necessity — Once a purchase order is confirmed, processing your name, company details, and delivery address is necessary to perform the contract.
• Legal obligation — We may process and retain certain data to comply with export-control regulations, customs documentation requirements, and Sri Lankan tax law.

3. Cookie Usage

Our website uses cookies and similar tracking technologies. Essential cookies are required for the site to function (session management, security tokens). Analytics cookies help us understand how visitors use the site so we can improve it. Please see our Cookie Policy for a full breakdown of cookies used, their purposes, and how to manage them.

4. Sharing Your Data

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your data with:

• Freight forwarders and logistics partners — to arrange shipment and customs clearance of your order.
• Payment processors — to facilitate wire transfers or online payments.
• IT service providers — including our web hosting provider and email delivery service, who act as data processors under contractual obligations to keep your data secure.
• Regulatory authorities — where required by Sri Lankan law or a court order.

5. International Data Transfers

As a spice exporter serving buyers worldwide, we may transfer your personal data to countries outside Sri Lanka, including countries within the European Union, the United Kingdom, the United States, and the Asia-Pacific region. Where we transfer data internationally, we implement appropriate safeguards such as:

• Standard contractual clauses approved by the relevant data-protection authority;
• Transfers to processors operating in jurisdictions with adequacy decisions; or
• Your explicit consent, where required.

6. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this policy:

• Enquiry records — retained for 2 years from the date of the enquiry, unless a transaction follows.
• Order and contract records — retained for 7 years from the date of the last transaction, in accordance with Sri Lankan commercial and tax law.
• Marketing consent records — retained until you withdraw consent, plus 1 year thereafter for compliance evidence.
• Website analytics data — retained in aggregated, anonymised form; IP-level data is not retained beyond 26 months.

When the retention period expires, data is securely deleted or anonymised.

7. Your Rights

Subject to the conditions of the Sri Lanka PDPA and, where applicable, the EU General Data Protection Regulation (GDPR), you have the following rights:

• Right of access — You may request a copy of the personal data we hold about you.
• Right to rectification — You may ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — You may request deletion of your personal data where we no longer have a lawful basis to retain it.
• Right to data portability — Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, machine-readable format.
• Right to object — You may object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
• Right to restrict processing — You may request that we limit how we use your data while a dispute is resolved.
• Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at info@northstarspice.com. We will respond within 30 days. We may need to verify your identity before processing your request.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include encrypted data transmission (TLS/HTTPS), access controls, and regular security reviews. However, no internet transmission is completely secure, and we cannot guarantee absolute security.

10. Cloudflare Turnstile

We use Cloudflare Turnstile to protect our website from spam and abuse. Use of Turnstile is subject to the Cloudflare Turnstile Privacy Addendum.

9. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before submitting any personal data.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by posting a revised version on this page with an updated "Last updated" date. Your continued use of our website after such changes constitutes your acceptance of the revised policy.

11. Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data-handling practices, please contact our Data Protection Officer at:

• Email: info@northstarspice.com
• Postal address: North Star Spice (Pvt) Ltd, No. 621/P/62, Kaduwela (10640), Colombo District, Western Province, Sri Lanka

You also have the right to lodge a complaint with the Data Protection Authority of Sri Lanka established under the Personal Data Protection Act No. 9 of 2022.

Governing law: This Privacy Policy is governed by and construed in accordance with the laws of Sri Lanka, including the Personal Data Protection Act No. 9 of 2022.