EU General Data Protection Regulation & Store Policies

Privacy Policy & GDPR Disclosure

Last updated: September 2026 — Compliant with EU GDPR (Regulation EU 2016/679)

1. Allergy & Liability Policy

Important Notice: By purchasing products from Ceylon Kauppa, you acknowledge and agree that it is your sole responsibility to check the ingredients and allergen information for each product before consumption.

Some of our authentic Sri Lankan natural foods, dry fish, dehydrated fruits, and spices may contain or be manufactured in facilities that process nuts, gluten, seafood, soy, dairy, or other potential allergens. Ceylon Kauppa assumes no liability or responsibility for any allergic reactions, health issues, or damages resulting from the consumption of products purchased through our store.

2. Data Controller & Principle of Data Minimization

The data controller is Ceylon Kauppa, operating from Oulu, Finland. We strictly adhere to the principle of data minimization. We only collect the minimal personal data required to fulfill orders and provide customer service:

Customer identity: Full name, email address, and phone number.
Delivery: Street address, postal code, city, and optional delivery notes.
Order items: Products purchased, quantities, and order reference ID.
Optional marketing consent: Explicit opt-in checkbox (unchecked by default).

Zero Financial Data Stored: We do not collect, process, or store credit card numbers or bank credentials anywhere in our application. Payments are coordinated separately via WhatsApp or external payment links.

3. Third-Party Processors & Infrastructure

We partner exclusively with reputable infrastructure providers under strict Data Processing Agreements:

Supabase EU

Database and authentication hosted strictly in the EU (Frankfurt, Germany) with Row Level Security (RLS) policies.

WhatsApp (Meta)

Order summaries are transmitted via direct WhatsApp chats (operated by Meta Platforms Ireland Ltd) for customer coordination.

Brevo

Transactional confirmation emails and newsletters are delivered securely through Brevo servers located in the European Union.

4. Your GDPR Rights (Articles 15-21)

As a European resident, you have full legal rights regarding your personal data:

Right of Access & Portability: You can download all personal records and order history in structured JSON format directly from your Account Settings.
Right to Rectification: You can update your saved name, phone, and delivery address anytime in your account.
Right to Erasure: You can submit an automated deletion request in your account or by emailing us.
Right to Withdraw Consent: You can toggle marketing opt-in off at any time.

5. Contact Information

For any inquiries, requests for data export, or deletion assistance, contact:

Ceylon Kauppa
Location: Oulu, Finland
Email: ceylonkauppa@gmail.com
WhatsApp: +358413277291