Privacy policy

Privacy Policy

Last updated: August 26, 2026

1. Introduction

Ceylon Spice Garden respects your privacy and is committed to handling personal information responsibly and transparently.

This Privacy Policy explains how Ceylon Spice Garden (“Ceylon Spice Garden,” “we,” “us,” or “our”) collects, uses, stores, shares, and otherwise processes personal information when you:

  • Visit ceylonspicegarden.com

  • Browse or purchase our products

  • Create or use an account

  • Subscribe to marketing communications

  • Contact customer support

  • Submit a review

  • Participate in a promotion

  • Interact with our advertisements

  • Otherwise use our website, online store, or related services

Collectively, these are referred to as the “Services.”

Our online store is powered by Shopify.

This Privacy Policy should be read together with our:

If there is a conflict between this Privacy Policy and another policy concerning the collection, use, or disclosure of personal information, this Privacy Policy controls for that privacy-related issue.

2. Who Is Responsible for Your Personal Information

For personal information processed in connection with operating Ceylon Spice Garden, Ceylon Spice Garden acts as the data controller or equivalent responsible business where applicable law uses that terminology.

Our contact information is:

Ceylon Spice Garden

Email: support@ceylonspicegarden.com

Postal contact:
539 W Commerce St #3498
Dallas, TX 75208
United States

Certain companies that provide services to us may act as processors, service providers, contractors, or independent controllers depending on the circumstances and applicable law.

Shopify may also process certain information for its own purposes as explained in its privacy policies.

3. Personal Information

For purposes of this policy, personal information means information that identifies, relates to, describes, or can reasonably be linked to an identifiable individual.

Personal information generally does not include information that has been irreversibly anonymized or de-identified so that it can no longer reasonably identify an individual.

The exact information we process depends on how you interact with us.

4. Information You Provide Directly

We may collect information that you provide directly to us, including:

Contact Information

Such as:

  • Name

  • Billing address

  • Shipping address

  • Email address

  • Telephone number

Order Information

Such as:

  • Products ordered

  • Product variants

  • Quantities

  • Order value

  • Discounts

  • Shipping method

  • Order history

  • Returns

  • Refunds

  • Cancellations

Account Information

If you create a customer account, we may process information such as:

  • Account name

  • Email address

  • Account preferences

  • Saved addresses

  • Order history

  • Other account settings

Authentication credentials may be processed through Shopify or another service provider.

Customer Support Information

When you contact us, we may receive:

  • Your messages

  • Emails

  • Photographs

  • Order information

  • Product complaints

  • Return requests

  • Quality concerns

  • Shipping inquiries

  • Customs documentation

  • Other information you choose to provide

Reviews and Feedback

If you submit a review, testimonial, rating, photograph, comment, or other feedback, we may process that information for review management, customer service, moderation, and other purposes described in this policy.

Customs and Delivery Information

For certain international shipments, additional information may be required to complete delivery or customs clearance.

We process only information reasonably required for shipment, customs documentation, legal compliance, or related purposes.

5. Payment and Transaction Information

Payments made through our store are processed using Shopify and/or authorized payment providers.

Depending on the payment method, payment providers may collect information such as:

  • Card details

  • Bank or financial account information

  • Billing information

  • Payment authorization information

  • Fraud-prevention information

Ceylon Spice Garden generally receives transaction information necessary to manage your purchase, which may include:

  • Payment method

  • Payment status

  • Transaction identifier

  • Billing information

  • Limited payment details made available by the payment provider

Your complete payment-card credentials may be collected and processed directly by Shopify or another authorized payment provider rather than stored directly by Ceylon Spice Garden.

Payment providers process information according to their own legal obligations and privacy policies.

6. Information Collected Automatically

When you visit or use our Services, certain information may be collected automatically.

This may include:

  • IP address

  • Browser type

  • Device type

  • Operating system

  • General geographic information derived from your IP address

  • Pages viewed

  • Products viewed

  • Links clicked

  • Search activity

  • Cart activity

  • Referring website

  • Date and time of visits

  • Session information

  • Interaction with advertisements or marketing campaigns

  • Other website usage and technical information

This information may be collected through:

  • Cookies

  • Pixels

  • Tags

  • Web beacons

  • Local storage

  • Software development kits

  • Similar technologies

7. Information We Receive From Other Sources

We may receive personal information from third parties including:

  • Shopify

  • Payment processors

  • Shipping carriers

  • Postal services

  • Fraud-prevention providers

  • Analytics providers

  • Advertising platforms

  • Customer-review platforms

  • Customer-support tools

  • Social media platforms

  • Other technology or business-service providers

We may also receive information when a customer directs another person or business to provide information to us.

8. How We Use Personal Information

We process personal information only where we have an appropriate business or legal purpose.

We may use personal information for the purposes described below.

9. Processing and Fulfilling Orders

We use personal information to:

  • Process purchases

  • Confirm orders

  • Process payments

  • Prepare orders

  • Arrange shipping

  • Create shipping labels

  • Provide tracking

  • Complete customs documentation

  • Communicate about delivery

  • Handle returns

  • Issue refunds

  • Provide replacements

  • Process cancellations

  • Resolve product concerns

This processing is necessary to provide products and services requested by customers.

10. Customer Service

We process personal information to:

  • Respond to inquiries

  • Identify customer orders

  • Investigate complaints

  • Assist with tracking

  • Investigate damaged or lost shipments

  • Handle return requests

  • Investigate product-quality concerns

  • Provide requested documentation

  • Resolve disputes

  • Maintain our customer relationship

Customer communications may be retained where reasonably necessary for customer service, legal compliance, fraud prevention, chargebacks, disputes, or recordkeeping.

11. Security and Fraud Prevention

We may use personal information to:

  • Authenticate transactions

  • Detect suspected fraud

  • Prevent unauthorized payments

  • Protect customer accounts

  • Protect our website

  • Detect malicious activity

  • Investigate misuse

  • Prevent abuse

  • Maintain the security of our systems

  • Protect Ceylon Spice Garden, customers, Shopify, payment providers, and others

This may include reviewing information such as:

  • IP address

  • Payment status

  • Order history

  • Delivery information

  • Fraud indicators

  • Device information

12. Payment Disputes and Chargebacks

If a payment dispute, chargeback, or payment-provider investigation is opened, we may process and disclose information reasonably necessary to respond.

This may include:

  • Customer name

  • Order information

  • Billing details

  • Shipping address

  • Tracking

  • Delivery evidence

  • Customer communications

  • Product listing information

  • Return requests

  • Refund information

  • Product photographs

  • Batch information

  • Quality-control records

  • Other transaction evidence

Information may be provided to:

  • Shopify

  • Payment processors

  • Banks

  • Card issuers

  • Card networks

  • Payment-dispute providers

  • Professional advisers

  • Other parties reasonably involved in resolving the dispute

13. Marketing Communications

Where permitted by applicable law, we may use personal information to send communications about:

  • Products

  • Promotions

  • Discounts

  • New products

  • Abandoned carts

  • Special offers

  • Other Ceylon Spice Garden news

You can unsubscribe from promotional email communications at any time using the unsubscribe link contained in the email.

Opting out of marketing does not prevent us from sending non-promotional communications concerning:

  • Existing orders

  • Shipping

  • Customer support

  • Security

  • Returns

  • Refunds

  • Account administration

  • Legal or policy notices

Where applicable law requires consent before sending a particular type of marketing communication, we will rely on consent or another legally permitted basis.

14. Advertising and Measurement

We may use advertising and measurement services to:

  • Measure advertising performance

  • Understand how customers find our website

  • Measure conversions

  • Understand website interactions

  • Create audiences

  • Display relevant advertisements

  • Limit repeated advertising

  • Improve our marketing

These services may use:

  • Cookies

  • Pixels

  • Tags

  • Device identifiers

  • IP addresses

  • Website activity

  • Shopping activity

  • Advertising identifiers

Where applicable law requires consent for advertising cookies, personalized advertising, or similar tracking technologies, those technologies are used in accordance with your consent choices.

We do not use this Privacy Policy to claim that a particular advertising platform is active unless that service is actually enabled on our website.

15. Analytics

We may use analytics technologies to understand:

  • Website traffic

  • Pages customers visit

  • Navigation behavior

  • Product interest

  • Website performance

  • Technical problems

  • Customer experience

Analytics providers may process device, browser, IP-address, session, and interaction information.

Where applicable law requires consent for analytics cookies or similar technologies, their use is governed by your consent choices.

16. Improving Our Business and Services

We may use information to:

  • Improve our website

  • Improve product listings

  • Understand customer demand

  • Improve customer support

  • Diagnose technical problems

  • Develop products and services

  • Analyze business performance

  • Prevent misuse

  • Improve fulfillment and shipping operations

Where this processing relies on legitimate interests, we consider whether our interests are compatible with the rights and reasonable expectations of affected individuals.

17. Legal and Regulatory Purposes

We may process personal information when reasonably necessary to:

  • Comply with applicable law

  • Meet accounting obligations

  • Meet tax requirements

  • Respond to valid government requests

  • Respond to lawful court orders

  • Exercise or defend legal claims

  • Enforce our policies

  • Investigate fraud

  • Protect our legal rights

  • Cooperate with regulators

  • Maintain legally required business records

18. Legal Bases for Processing – EEA and UK

If European Economic Area or United Kingdom data-protection law applies to our processing, we rely on one or more lawful bases depending on the activity.

Contract

We may process information because it is necessary to enter into or perform a contract with you.

Examples include:

  • Processing your order

  • Receiving payment

  • Shipping products

  • Providing customer support related to your purchase

  • Processing returns

  • Issuing refunds

Legal Obligation

We may process information where required to comply with a legal obligation.

Examples can include:

  • Tax records

  • Accounting records

  • Customs requirements

  • Legal requests

  • Regulatory obligations

Legitimate Interests

We may process information where necessary for our legitimate interests or those of another party, provided those interests are not overridden by your rights.

These interests may include:

  • Fraud prevention

  • Website security

  • Business administration

  • Customer service

  • Improving our Services

  • Protecting our legal rights

  • Preventing abuse

  • Certain measurement and marketing activities where permitted

Consent

We rely on consent where required or where consent is the appropriate legal basis.

This may include certain:

  • Marketing communications

  • Advertising cookies

  • Analytics cookies

  • Personalized advertising

  • Similar tracking technologies

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect processing lawfully carried out before withdrawal.

19. Cookies and Similar Technologies

Our website uses cookies and similar technologies.

Cookies are small files or pieces of information stored on or accessed from your browser or device.

They can perform different functions.

20. Necessary Cookies

Necessary cookies support functions essential to operating the website or completing a customer-requested transaction.

These can include:

  • Shopping-cart functions

  • Checkout

  • Security

  • Fraud prevention

  • Account login

  • Session management

  • Privacy preferences

Where legally permitted, necessary technologies may operate without optional consent because the requested Service cannot function properly without them.

21. Analytics Cookies

Analytics technologies help us understand how visitors use the Services and how the website performs.

Where applicable law requires consent, analytics cookies or similar technologies are activated according to your privacy choices.

22. Advertising and Personalization Cookies

Advertising technologies may be used to:

  • Measure advertisements

  • Attribute purchases

  • Create advertising audiences

  • Personalize advertising

  • Limit advertising frequency

Where applicable law requires consent, these technologies are used only in accordance with the consent choices communicated through our available privacy or cookie controls.

23. Managing Cookie Preferences

Where available, you can manage non-essential cookie and tracking preferences through the cookie banner, privacy settings, or privacy-choice tools displayed on our website.

You may also configure your browser to:

  • Block cookies

  • Delete cookies

  • Notify you when cookies are set

However, blocking necessary cookies may interfere with functions such as:

  • Shopping cart

  • Checkout

  • Login

  • Security features

Browser controls alone may not control every form of website or advertising technology.

Where required by applicable law, we provide mechanisms for managing relevant consent or opt-out preferences.

24. Withdrawal of Cookie Consent

Where we rely on consent for cookies or tracking technologies, you may change or withdraw your consent through the privacy controls made available on the website where supported.

Withdrawing consent does not affect the lawfulness of processing performed before consent was withdrawn.

25. How We Disclose Personal Information

We may disclose personal information where reasonably necessary for the purposes described in this policy.

Recipients may include the following categories.

Shopify

Our store is hosted and supported by Shopify.

Information may be processed by Shopify to provide ecommerce, checkout, security, customer, analytics, payment, and related services.

Payment Providers

We may disclose information to payment providers for:

  • Payment processing

  • Fraud detection

  • Refunds

  • Chargebacks

  • Transaction administration

Shipping and Logistics Providers

We may provide necessary information to:

  • Postal services

  • Couriers

  • Freight providers

  • Fulfillment providers

  • Customs agents

  • Customs authorities

for delivery and customs-clearance purposes.

Technology and Service Providers

We may work with providers assisting with:

  • Website hosting

  • IT services

  • Data storage

  • Customer support

  • Email services

  • Security

  • Fraud prevention

  • Analytics

  • Reviews

  • Marketing

  • Advertising

Such providers receive information as reasonably necessary for the relevant service.

Professional Advisers

Information may be disclosed where necessary to:

  • Lawyers

  • Accountants

  • Auditors

  • Insurers

  • Tax advisers

  • Other professional advisers

Government Authorities and Legal Recipients

We may disclose information when reasonably required to:

  • Comply with law

  • Respond to valid legal process

  • Protect legal rights

  • Investigate fraud

  • Protect customers or others

Business Transactions

Information may be transferred as part of a:

  • Merger

  • Acquisition

  • Financing

  • Restructuring

  • Sale of assets

  • Sale or transfer of the business

Any recipient will remain subject to applicable privacy obligations.

26. Relationship With Shopify

Shopify provides the ecommerce platform used to operate our store.

Information you submit through our Services may be processed by Shopify and Shopify service providers in countries other than your own.

Shopify may process certain information:

  • On our behalf

  • As a service provider or processor

  • For its own purposes as permitted by applicable law and its own privacy policies

Certain Shopify features may use information about interactions with our store and other Shopify services to provide enhanced commerce, personalization, security, or advertising-related features.

For information about Shopify's own privacy practices, please review the Shopify Consumer Privacy Policy:

https://www.shopify.com/legal/privacy

Shopify may also provide privacy controls at:

https://privacy.shopify.com/

27. Sale, Sharing, and Targeted Advertising

Ceylon Spice Garden does not sell personal information for money.

However, some privacy laws use broad definitions of terms such as:

  • “sale”

  • “sharing”

  • “targeted advertising”

  • “cross-context behavioral advertising”

Under those laws, certain disclosures to advertising or analytics partners may be considered a “sale” or “sharing” even where no money is paid for the information.

Where applicable law provides an opt-out right, you may exercise it through the privacy controls available on our website or by contacting us.

28. Global Privacy Control

Some browsers or browser extensions transmit a Global Privacy Control (GPC) signal.

Where applicable law requires us to recognize a valid GPC signal and our technology is capable of receiving it, we will treat the signal as an applicable opt-out request for that browser or device.

A browser-based signal may not automatically apply to other devices or browsers unless we can reasonably associate them.

29. Your Privacy Rights

Depending on where you live and which privacy laws apply, you may have rights concerning your personal information.

These may include the right to:

  • Request access to personal information

  • Request information about how personal information is used

  • Correct inaccurate information

  • Request deletion

  • Request restriction of processing

  • Object to certain processing

  • Receive portable information

  • Withdraw consent

  • Opt out of certain targeted advertising

  • Opt out of certain sale or sharing

  • Appeal certain privacy-request decisions

  • Lodge a complaint with a data-protection authority

These rights are not absolute and may be subject to legal exceptions.

For example, we may need to retain certain information to:

  • Complete an order

  • Maintain legally required financial records

  • Prevent fraud

  • Resolve a dispute

  • Exercise legal rights

  • Comply with tax or accounting requirements

30. Right to Object to Direct Marketing

Where applicable, you have the right to object to the use of personal information for direct marketing.

You may unsubscribe from promotional emails using the unsubscribe link included in our messages.

We will continue to send transactional or service messages where necessary, such as communications concerning:

  • Orders

  • Shipping

  • Refunds

  • Customer service

  • Account security

31. How to Exercise Your Privacy Rights

You may submit an applicable privacy request by emailing:

support@ceylonspicegarden.com

Please clearly describe the right you wish to exercise.

We may need to verify your identity before fulfilling certain requests.

Verification may involve asking for information reasonably necessary to confirm that you are the individual associated with the relevant records.

We will not discriminate against you for exercising a privacy right protected by applicable law.

32. Authorized Agents

Where applicable law permits you to use an authorized agent to submit a privacy request, we may require reasonable evidence that the agent is authorized to act on your behalf.

We may also ask you to verify your identity directly where permitted.

33. Appeals and Complaints

If you believe we have improperly handled your personal information, please contact us first at:

support@ceylonspicegarden.com

Where applicable law provides a right to appeal a privacy-request decision, you may request an appeal by contacting us.

You may also have the right to complain to the data-protection or privacy authority responsible for your jurisdiction.

34. European Economic Area and UK Complaints

Individuals in the European Economic Area may have the right to lodge a complaint with the competent data-protection authority in their country.

Individuals in the United Kingdom may have the right to contact the UK Information Commissioner's Office (ICO).

We encourage you to contact us first so we have an opportunity to address the concern.

35. Sri Lanka Data Protection

Where applicable, Ceylon Spice Garden processes personal information in accordance with applicable Sri Lankan data-protection requirements, including requirements under the Personal Data Protection Act, No. 9 of 2022, as amended, as relevant provisions become operational.

We may update our policies, contracts, security procedures, and data-governance practices as the Sri Lankan data-protection framework develops or additional regulatory requirements take effect.

36. International Data Transfers

Because we operate internationally and use global technology, ecommerce, payment, shipping, analytics, and other service providers, personal information may be processed outside the country where you live.

Countries receiving information may have privacy laws different from those in your jurisdiction.

Where applicable law requires safeguards for international transfers, we and/or our service providers use legally recognized mechanisms as applicable, which may include:

  • Adequacy decisions

  • Standard contractual clauses

  • Approved contractual safeguards

  • Other lawful transfer mechanisms

Specific transfer mechanisms can depend on the service provider, destination country, and applicable law.

37. Data Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and for legitimate business or legal requirements.

Retention may depend on factors including:

  • Whether you have an active customer account

  • Order fulfillment

  • Customer-support requirements

  • Returns and refunds

  • Chargeback periods

  • Fraud prevention

  • Tax requirements

  • Accounting requirements

  • Product or shipment disputes

  • Legal limitation periods

  • Regulatory requirements

  • Enforcement of agreements

Different categories of information may therefore be retained for different periods.

When information is no longer reasonably required, we may:

  • Delete it

  • Anonymize it

  • De-identify it

  • Securely retain it where deletion is not immediately possible or legally permitted

38. Security

We use reasonable administrative, organizational, and technical measures designed to protect personal information.

Depending on the information and systems involved, these measures may include:

  • Access controls

  • Platform security

  • Payment-provider security

  • Fraud-prevention systems

  • Authentication

  • Restricted employee or contractor access

  • Other appropriate safeguards

However, no system, website, network, transmission method, or storage system can be guaranteed to be completely secure.

You should not send passwords, full payment-card details, or other highly sensitive information through unsecured communication channels unless specifically required through an authorized secure method.

39. Personal Data Breaches

If we become aware of a personal-data breach, we will investigate it and take reasonable steps appropriate to the circumstances.

Where applicable law requires notification to:

  • A regulator

  • A data-protection authority

  • An affected individual

we will provide such notification in accordance with applicable legal requirements.

40. Children's Privacy

Our Services are directed toward customers who can lawfully enter into purchases and transactions in their jurisdiction.

We do not knowingly seek to collect personal information from children who are not legally permitted to use the Services independently.

If you are a parent or guardian and believe that a child has provided personal information to us improperly, please contact:

support@ceylonspicegarden.com

We will review the matter and take appropriate action where required.

41. Sensitive Personal Information

We generally do not request sensitive personal information unless it is reasonably necessary for a particular transaction, legal requirement, customs procedure, or customer request.

Please do not send unnecessary sensitive information through ordinary email.

Where sensitive information is processed, we will handle it according to applicable law and the purpose for which it was provided.

42. Third-Party Websites

Our Services may contain links to websites, platforms, or services operated by third parties.

Examples may include:

  • Social media

  • Payment providers

  • Shipping carriers

  • Review platforms

  • Other external websites

We do not control the privacy practices of independent third parties.

Before providing personal information to an external website, you should review that provider's privacy policy.

A link from our website does not by itself mean that we are responsible for the independent third party's privacy practices.

43. Social Media

If you interact with Ceylon Spice Garden through a social-media platform, the platform may process information about your interaction according to its own privacy practices.

Information you make publicly available through social media may also be visible to other users.

44. Business Customers

For wholesale and other business-to-business transactions, we may process business contact information such as:

  • Employee name

  • Company

  • Business email

  • Business telephone number

  • Position

  • Delivery information

  • Tax or customs information

  • Communications

  • Order history

Such information may still constitute personal information where it relates to an identifiable individual.

We handle such information according to this Privacy Policy and applicable law.

45. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

  • Changes in law

  • Regulatory developments

  • Changes to our technology

  • Changes to Shopify services

  • Changes to our business

  • New service providers

  • Changes to advertising or analytics practices

  • Improvements in privacy practices

When we update the policy, we will revise the Last updated date.

Where applicable law requires additional notice or consent for a material change, we will take the required steps before applying that change.

46. Contact Us

If you have questions about this Privacy Policy, our privacy practices, or a privacy request, contact:

Ceylon Spice Garden

Email: support@ceylonspicegarden.com

Postal contact:
539 W Commerce St #3498
Dallas, TX 75208
United States

Please write “Privacy Request” in the subject line when contacting us about a data-protection request so we can identify and handle your request efficiently.