Privacy Policy

Ceylon Lustre operates an online atelier for certified natural Ceylon gemstones and fine jewellery, with insured delivery for collectors in Sri Lanka and worldwide via ceylonlustre.com.

For the Personal Data Protection Act, No. 9 of 2022 ("PDPA"), Ceylon Lustre is the controller of the personal data described here. If anything in this notice conflicts with Sri Lankan law, the law prevails.

Our contact details:

Depending on how you use the store, we may process:

• Account & contact: name, email, phone number, and hashed password if you register.
• Orders & delivery: shipping address, city, order items, amounts in LKR, and payment status.
• Atelier inquiries: gemstone or jewellery preferences and messages you send via contact form, email, phone, or WhatsApp.
• Payments: payment confirmation from licensed gateways (such as PayHere and Koko). We do not store full card numbers.
• Technical logs: IP address, browser details, and security logs used for fraud prevention and session integrity.

We process personal data to:

• Fulfil gemstone and jewellery orders, including certificates and insured dispatch.
• Process payments (card, Koko, bank transfer) and confirm order status.
• Send order, dispatch, and delivery updates by email or SMS where configured.
• Manage accounts, returns, bespoke inquiries, and customer support.
• Protect the store from fraud and abuse, and meet tax and accounting duties.

We do not sell or rent your personal information for third-party marketing.

We only share what is needed with trusted processors: payment providers, courier and insurance partners, hosting and database providers, and email/SMS gateways. They must keep your information confidential and handle it under PDPA expectations.

We use essential cookies and local storage so your cart, login session, and checkout stay secure. Blocking these may stop account or checkout features from working correctly.

We keep order and account records for as long as needed for fulfilment, warranties, accounting, tax, and dispute resolution. When records are no longer required, we delete or anonymise them.

We use TLS encryption in transit and practical administrative and technical safeguards. Please keep your account password private and tell us if you suspect unauthorised access.

You may request access, correction, deletion (where the law allows), withdrawal of consent, or raise an objection to certain processing. Contact us at info@ceyloanlustre.com. We verify requests and respond within the timeframes set by Sri Lanka's Data Protection Authority.

We may update this policy when our practices or the law change. The latest version is always published on this page with a revised date.

Also read our Terms of Service and Returns page. For day-to-day help, use Contact.