Privacy & Cookie Policy

1. Who We Are (Data Controller)

Ceylon Ish Tea Limited (“we”, “us”, or “our”) operates the website located at ceylonishteas.co.uk. We are committed to protecting your privacy in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Personal Data We Collect

When you browse our online boutique, register an inquiry, or complete an order, we collect:

• Identity & Contact Data: Full name, billing and shipping address, email address, and telephone number.
• Transaction & Order Data: Details about payments authorized, ordered tea selections, and order history.
• Payment Information: Handled securely by our PCI-DSS Level 1 compliant payment processor, Stripe. We never store raw debit/credit card numbers or CVC security codes on our servers.
• Technical & Usage Data: Internet protocol (IP) address, browser type, operating system, and interaction with our tea collections.

3. Legal Basis for Processing

We only process your personal data where we have a lawful legal basis under Article 6 of the UK GDPR:

• Performance of a Contract: To process and deliver your tea purchase, manage checkout, and communicate delivery milestones.
• Legitimate Interests: To prevent fraudulent transactions, provide responsive tea sommelier customer support, and improve our website performance.
• Legal Obligation: To maintain statutory accounting, tax records, and HMRC compliance for financial auditing.
• Consent: For voluntary subscription to our seasonal single-estate harvest newsletter (which you may withdraw at any time).

4. Sharing Your Data with Trusted Processors

We do not sell, rent, or trade your personal data. We disclose necessary data only to vetted service providers who assist our operations:

5. Cookies & Local Storage

Our website uses essential session cookies and local storage tokens (such as ceylonish_cart) strictly necessary to retain your tea items in your shopping basket as you navigate between pages. We do not employ third-party intrusive tracking cookies.

6. Your Statutory Rights

Under UK data protection law, you possess fundamental rights regarding your data:

• Right of Access: Request a complimentary copy of the personal information we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure: Request deletion of your records where there is no legal reason for us to retain them.
• Right to Object: Object to processing based on legitimate interests or direct marketing.

To exercise any of these rights, simply email our compliance officer at admin@ceylonishteas.co.uk. We respond within one calendar month.