We, at Royal Ceramics Lanka PLC (“we”, “us”, “our” and “Rocell”) are committed to respecting your privacy. This Privacy Policy is applicable to your use of this website for the purpose of creating and maintaining an account with us, purchasing of products, making inquiries through the website and in respect of other services provided by us in facilitating the completion and delivery of your respective order. This policy does not, however, apply or extend to any purchases made at any one of our retail outlets. 

This policy outlines how we collect, use, share and otherwise process Personal Data (as hereinafter defined) and includes information on the categories of Personal Data collected by us, the purposes for which it is processed and shared, as well as the rights available to you in your capacity as a “data subject” in respect of your Personal Data. 

Please read through the following carefully to understand our views and practices regarding Personal Data and how we treat it. 

By accepting our services, you acknowledge that you have read and understood this Privacy Policy. 

The term and expression “Personal Data”, for these purposes, may broadly be defined as information that relates to and can identify a particular natural person.

We collect and process a variety of Personal Data about you based on the nature, duration and extent of your interaction with us in completing your purchase made through our website. This may include categories of Personal Data such as your:

•     contact details – including, for example, your full name, title, contact number, email address, permanent address, correspondence address and delivery address;

•     financial information – including, for example, purchase history, payment details and preferred mode of payment;

•     online presence – including, for example, the duration and frequency of your visits to our website, website interaction information, your IP address and device details.

provided, further, that we shall inform you as and where required by applicable law where, and to the extent, that we process any other categories of Personal Data relating to you.

Any processing of Personal Data that is deemed to be a “special category of Personal Data” by applicable law, will be processed in accordance with and subject to the conditions, specifications and restrictions stipulated by applicable law (including – in particular, the

Personal Data Protection Act, No. 09 of 2022 or “PDPA”).

As you interact with us, we may collect your Personal Data in a number of different ways, including the following sources:

•     Directly from you – such as when you place an order via the website or interact with our personnel in making inquiries regarding your order placed through our website – either over the telephone, through emails or otherwise.

•     Online – such as when you log in, access and use our website through your web browser and your google or social media credentials – in which instance, like most other websites, we use cookies, pixels and similar technology to gather details about your interaction with our platform.

•     Other third parties – such as, our delivery personnel, logistic companies, payment processors, other service providers and our business partners.

We collect and process your Personal Data for a number of legitimate business purposes – which include, but are not limited to, the following:

•      to effectively provide you with our services, including facilitating the selection, purchase and delivery of our products through this website, efficient customer support in communicating with you about your order(s), account management and the processing of payments;

•      to improve our website, troubleshooting services, including improving functionality, analysing performance, fixing errors and improving the usability and effectiveness of our services;

•      to pursue our business relationship with you, to contact you regarding your account on the platform and keep you updated about our products and services and other business development activities;

•      to comply with legal and statutory obligations (including the laws relating to taxation, consumer protection and industry-specific regulations), to protect and enforce our rights, and / or otherwise respond to requests for information issued by government or statutory authorities;

•      for safety or security reasons, such as to detect and / or prevent fraud or the misuse of any of our products or services; and

•      for our own internal purposes, such as for monitoring, analysing and evaluating the performance of our products and services and maintaining internal records.

We may also anonymize, tokenize and / or aggregate Personal Data in a manner where you may no longer be personally identifiable. In such instances, you acknowledge and agree that we may utilize such non-Personal Data for any lawful purpose without further notice to you.

As a general policy, we process your Personal Data for as long as it may be required to:

•      to make our products and services available to you;

•       to comply with our statutory and legal obligations; and / or

•      to fulfil the legitimate business purposes for which such Personal Data was collected, as described in Part 4 of this Policy.

Once your relationship or engagement with us has ended, we may still retain your information in our systems and records to, for example, comply with any record keeping obligations imposed on us under applicable law.

Furthermore, if, at any instance, your Personal Data has been collected solely on the basis of your consent and not in accordance with any other lawful basis of processing as recognized by applicable law, then such Personal Data shall be retained until the purpose for which it was processed is fulfilled, or until you duly revoke the consent previously granted to us – whichever may occur first.

For the fulfilment the purposes set out in Part 4 above and in relying on the lawful bases of processing as permitted by applicable law, we may disclose and / or transfer your Personal Data to the following categories of third parties:

•      Service providers and partner entities – to the extent necessary to facilitate, deliver and / or improve our products and services, we may disclose your Personal Data to third-party service providers and business partners, such as delivery personnel, web-hosting companies, information technology service providers, payment processors and logistics companies.

•      To third parties for legal, security or safety purposes – we may disclose your Personal Data to professional advisors, law enforcement and / or other government agencies and state instrumentalities in order to comply with legal and statutory requirements, to enforce and defend our legal and equitable rights, as well as to protect the rights, property and safety of our personnel, customers and associated third parties. Further, we will also disclose your information to third parties in the event that we transfer, sell, dispose of any part of our business or assets or the ownership in the company, in which case, we will, to the extent necessary to ensure continuity of business operations, disclose your Personal Data to a purchaser or transferee of such business or assets subject to the terms of this Policy.

•      To any group companies – we may disclose your personal data within the Rocell group for the purpose of maintaining our professional relationship with you and keeping you informed of our products and services.

•      Other third parties with your consent – in situations not covered by the above categories of personnel, we will seek your consent prior to disclosing your Personal Data to third parties.

We take reasonable effort to monitor and update our security standards in relation to your Personal Data, by implementing appropriate and commercially acceptable contractual, technical and organizational measures to help prevent the loss, misuse of and unauthorized access to your Personal Data.

Despite our best efforts, however – we cannot guarantee the absolute security of such Personal Data, given that no means of data transmission or storage is 100% secure. The payments you make for products on our website are processed through bank payment portals and the information which you supply to them is not within our control and subject to their privacy policies. Furthermore, when you access a link to a third-party site, you acknowledge that you will be leaving our website and, accordingly, that we cannot control, endorse or be held responsible for the security of any such third-party website.

As a data subject, you are vested with certain rights in respect of your Personal Data, subject to the specifications and restrictions imposed by applicable law. Such rights include:

•      The right to request access to your Personal Data – this enables you to request a copy of your Personal Data processed by us.

•      The right to request the rectification of your Personal Data – this enables you to request us to correct and / or complete any Personal Data that we hold in relation to you which may be demonstrably inaccurate and / or incomplete.

•      The right to request the erasure of your Personal Data – this enables you to request us to delete or remove your Personal Data to the extent specified and limited by the PDPA.

•      The right to withdraw consent – where and to the extent certain Personal Data is processed solely on the basis of your consent, this enables you to withdraw your consent – provided, however, that no such withdrawal shall affect the legality of any processing prior to such withdrawal.

•      The right to object to further processing – in certain limited circumstances, as stipulated by the PDPA, you may request us to refrain from further processing your Personal Data. However, where such Personal Data is fundamental and indispensable to the provision of our services, we may be prevented from offering our services to you thereafter.

•      The right to review an automated decision – in the limited  circumstances that a decision has been arrived at solely on the basis of automated processing, this enables you to request us to review such decision – subject to the conditions prescribed by the PDPA.

In exercising your rights, you must ensure that your requests are:

•      Communicated in writing and addressed to [email protected];

•      Set out the nature of the request and the respective right being exercised by you; and

•      fairly and reasonably identify the Personal Data in respect of which you wish to exercise such right.

We will respond to all data subject requests within the time frame(s) prescribed by applicable law. In doing so, we reserve the right to request and require you to provide additional information where, and to the extent, such information is necessary in order to process your request (for e.g., where you have failed or neglected to reasonably identify the Personal Data to which your request relates). We also reserve the right to decline processing any requests that are manifestly unfounded, fraudulent or otherwise not permitted by applicable law.

Where, and to the extent, you have any further queries, concerns or clarifications regarding the processing of your Personal Data by us, you may contact the Data Protection Authority of Sri Lanka in respect of the same.

As technology, applicable law and our business operations continue to change and evolve, we reserve the right and discretion to amend and modify this Privacy Policy from time to time.

Therefore, we encourage you to periodically review this Policy to ensure that you are aware of and updated on the manner and extent to which your Personal Data is processed by us.

This policy is effective from the [6] of [8] 2024