Privacy Policy

This Privacy Policy describes how Spa Ceylon Ayurveda Wellness - Malta (“Spa Ceylon”, “we”, “us”, or “our”) collects, uses, discloses, stores, and protects personal information when you visit our website, purchase our products, use our services, interact with us online, or otherwise engage with us.

For legal and regulatory purposes, the Spa Ceylon Malta online store is operated by CSDSC Ltd., a Limited Liability Company registered in Malta under company registration number C 115152, with its registered office at 114, Telghet Birkirkara, San Giljan, STJ 1144, Malta. CSDSC Ltd. is the data controller for the personal data described in this Policy unless another controller is identified to you at the time your information is collected.

1. Scope and Applicability

This Policy applies to personal data collected through our Malta website (spaceylon.mt), online store, customer service channels, digital communications, marketing activities, social media interactions, and other services operated by or on behalf of Spa Ceylon Malta.

We process personal data in accordance with applicable data protection and privacy laws, including the EU General Data Protection Regulation (GDPR), the Malta Data Protection Act (Chapter 586), and applicable Maltese rules concerning electronic communications, direct marketing, cookies, and similar technologies.

Where another law applies because of your location or the nature of a particular transaction, we will comply with that law to the extent required.

2. Information We Collect

We may collect and process the following categories of information:

• Contact and Identity Data: Name, billing address, delivery address, email address, telephone number, and other information you provide when placing an order or contacting us.
• Account and Transaction Data: Account information, purchase history, order details, product preferences, transaction records, loyalty or rewards participation where available, and customer service records.
• Payment Data: Payment information required to complete your purchase. Payments are processed through Shopify Payments and/or other authorised payment providers made available at checkout. Complete card details are not normally stored directly by us.
• Device and Technical Data: IP address, device type, browser type, operating system, identifiers, session information, security logs, and approximate location information derived from your device or IP address.
• Usage and Analytics Data: Information about how you use the Site, including pages visited, products viewed, purchases, referring pages, clicks, session activity, and interactions with our online services.
• Marketing Data: Marketing preferences, subscriptions, advertising interactions, campaign engagement, and information relating to promotional communications.
• Communications Data: Emails, inquiries, customer service communications, feedback, reviews, survey responses, complaints, and other correspondence with us.
• Third-Party and Social Media Data: Information received through social media platforms, integrations, technology providers, advertising platforms, and other third-party services where permitted by law.
• Logistics and Fulfilment Data: Delivery addresses, delivery instructions, tracking information, delivery status, and information required by warehouses, delivery partners, and couriers to fulfil your order.
• Business Operations and Legal Data: Information required for fraud prevention, accounting, taxation, regulatory compliance, legal claims, disputes, audits, security, and contractual requirements.

We aim to collect only the personal data reasonably required for the purposes described in this Policy.

3. How We Collect Information

Information may be collected:

• Directly from you: When you create an account, place an order, subscribe to communications, complete a form, contact customer service, submit a review, participate in a promotion, or otherwise provide information to us.
• Automatically: Through cookies, pixels, analytics technologies, log files, device information, and other technologies used when you access or interact with the Site.
• From service providers and business partners: Including payment processors, delivery providers, ecommerce platforms, fraud prevention services, marketing providers, analytics providers, technology vendors, and authorised Spa Ceylon group or brand partners.
• From social media and advertising platforms: Where you interact with our social media accounts, advertisements, or services provided through those platforms and the platform is permitted to share that information with us.

4. How We Use Information

We use personal data where we have a lawful basis to do so. Depending on the circumstances, this may include processing that is necessary to perform a contract with you, comply with a legal obligation, pursue our legitimate business interests, or where you have provided consent.

We may use your personal data to:

• Process and fulfil orders, accept payments, arrange delivery, manage returns and refunds, and provide customer support.
• Create and manage customer accounts and maintain your account preferences.
• Respond to questions, complaints, requests, reviews, and other communications.
• Operate, maintain, secure, troubleshoot, and improve our Site and services.
• Prevent fraud, unauthorised transactions, misuse, security incidents, and other unlawful activity.
• Maintain financial, transaction, accounting, and tax records required by law.
• Understand Site performance, customer behaviour, and service usage through analytics where legally permitted and, where required, subject to your cookie choices.
• Recommend or personalise products and content where permitted by law.
• Send marketing, promotional, and advertising communications where we have your consent or another lawful basis that permits us to do so.
• Manage promotions, customer programmes, competitions, rewards, or loyalty services where offered.
• Comply with legal, regulatory, taxation, accounting, product safety, court, law enforcement, or other lawful requirements.
• Establish, exercise, or defend legal claims and protect our rights, customers, employees, and business.
• Support authorised Spa Ceylon brand, franchise, ecommerce, technology, logistics, and operational activities where necessary and legally permitted.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal will not affect processing that was lawful before your consent was withdrawn.

Where we rely on legitimate interests, we consider whether those interests are reasonably necessary and whether your rights and interests require a different approach.

We may use information that has been properly anonymised or aggregated so that it no longer identifies you for reporting, analytics, planning, research, and business purposes.

5. Disclosure and International Transfers

We may disclose personal data where reasonably necessary to the following categories of recipients:

• Spa Ceylon group, brand, franchise, and authorised support entities: Where access is required for legitimate operational, ecommerce, customer support, brand management, technical, or administrative purposes.
• Ecommerce and technology providers: Including Shopify and approved applications, hosting providers, security providers, software vendors, and other technology providers used to operate the Site.
• Payment providers: Including Shopify Payments, banks, card networks, payment processors, digital wallet providers, and other payment services selected or made available during checkout.
• Logistics and fulfilment providers: Including delivery partners, couriers, warehouses, fulfilment providers, and other parties required to process and deliver orders.
• Marketing, communications, analytics, and advertising providers: Including authorised email, advertising, social media, and analytics platforms where those services are used and where the required legal basis or consent exists.
• Professional advisers: Including accountants, auditors, lawyers, insurers, consultants, and other advisers where reasonably required.
• Regulatory, tax, legal, judicial, or government authorities: Where disclosure is required or permitted by applicable law.
• Business transaction parties: Where reasonably necessary in connection with a proposed or completed merger, acquisition, financing, restructuring, sale of assets, transfer of business, or similar corporate transaction.
• Other parties: Where you have authorised the disclosure or where disclosure is otherwise permitted or required by law.

Some service providers, Spa Ceylon entities, brand partners, or technology providers may be located outside Malta or the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we will use a lawful transfer mechanism where required. Depending on the destination and circumstances, this may include a European Commission adequacy decision, Standard Contractual Clauses, or another safeguard or legal transfer mechanism recognised under applicable data protection law.

You may contact us for further information about the safeguards applicable to international transfers of your personal data.

We do not sell your personal data.

6. Access and Use by Global Employees and Partners

Personal data may be accessed by authorised Spa Ceylon personnel, CSDSC Ltd. personnel, service providers, contractors, brand partners, and other authorised parties where access is reasonably required to perform their duties or provide services relating to the Malta business.

This may include authorised personnel located outside Malta or the EEA.

Access to personal data is limited according to business need and is subject to appropriate access controls, confidentiality requirements, contractual obligations, and applicable data protection requirements.

Where an international transfer of personal data takes place, the safeguards described in Section 5 will apply where required.

7. Data Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction.

Depending on the systems and services involved, these measures may include:

• Encrypted HTTPS/SSL/TLS connections for web traffic.
• Secure payment processing through authorised payment providers.
• Access controls and account permission management.
• Password and credential security controls.
• Multi-factor authentication for appropriate business systems.
• System monitoring, logging, security updates, and incident management procedures.
• Restrictions on internal and third-party access to customer information.
• Confidentiality and data protection requirements for authorised personnel and service providers.

No internet service or electronic storage system can be guaranteed to be completely secure. You should also protect your account credentials and notify us if you believe your account or personal information has been compromised.

8. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, regulatory, contractual, accounting, taxation, fraud prevention, security, and dispute resolution requirements.

Retention periods may vary depending on the type of information and why it is being processed. This may include retaining information for:

• Processing and maintaining records of orders, payments, deliveries, returns, and refunds.
• Meeting Maltese taxation, VAT, accounting, and other statutory record-keeping requirements.
• Managing customer accounts and customer service requests.
• Maintaining records of marketing consent, preferences, objections, and unsubscribe requests.
• Preventing fraud, misuse, chargebacks, and security incidents.
• Managing complaints, disputes, legal claims, and regulatory matters.

When personal data is no longer required, it will be deleted, anonymised, or otherwise securely disposed of in accordance with our applicable retention procedures and legal obligations.

9. Your Rights

Subject to the conditions and limitations provided by applicable data protection law, you may have the right to:

• Access the personal data we hold about you and obtain information about how it is processed.
• Correct inaccurate or incomplete personal data.
• Request deletion of personal data where the legal conditions for erasure are met.
• Restrict processing of personal data in certain circumstances.
• Object to processing based on legitimate interests in circumstances provided by law.
• Object to direct marketing at any time.
• Withdraw consent at any time where processing is based on your consent.
• Receive or transfer your data in a portable format where the right to data portability applies.
• Request information about international transfer safeguards where applicable.
• Lodge a complaint with a competent data protection supervisory authority.

To exercise your rights or make a privacy inquiry, please contact us at [INSERT CONFIRMED PRIVACY / CUSTOMER CARE EMAIL].

We may request information reasonably necessary to verify your identity before responding to a request. This is intended to prevent unauthorised access to or disclosure of personal data.

We will respond to valid data protection requests within the timeframe required by applicable law.

You also have the right to lodge a complaint with the Information and Data Protection Commissioner (IDPC), Malta if you believe that your personal data has been processed in breach of applicable data protection law.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Site, maintain security, remember preferences, understand Site usage, and, where you have provided the required consent, support analytics, personalisation, advertising, and marketing.

Cookies used on the Site may include:

• Strictly Necessary Cookies: Required for functions such as security, checkout, shopping cart operation, account access, payment processing, and other services requested by you.
• Preference Cookies: Used to remember choices and settings where applicable.
• Analytics Cookies: Used to understand Site usage, performance, and customer interaction where permitted and, where required, after you provide consent.
• Advertising and Marketing Cookies: Used for advertising, campaign measurement, remarketing, and similar purposes where the required consent has been provided.

Non-essential cookies and similar tracking technologies will only be used where we have obtained the consent required by applicable law.

You can accept, reject, or manage non-essential cookies using the cookie consent controls or Cookie Settings made available on the Site. Where processing relies on your consent, you may change or withdraw that consent at any time.

You can also manage certain cookies through your browser settings. Blocking strictly necessary cookies may affect the operation of some Site functions.

Further information about individual cookies, their purposes, providers, and applicable retention periods may be provided through our cookie consent tool or separate Cookie Policy.

11. Children’s Privacy

Our Site and ecommerce services are intended for a general consumer audience and are not specifically directed to young children.

Under Maltese data protection rules concerning information society services, where processing relies on a child’s consent, a child aged 13 years or older may provide the relevant consent in the circumstances permitted by law.

Where a child is under 13 and consent is required as the lawful basis for the processing, that consent must be given or authorised by the holder of parental responsibility as required by applicable law.

We do not knowingly seek to collect personal data from children under 13 on the basis of their own consent.

If you believe that a child has provided personal data to us in circumstances that do not comply with applicable law, please contact us so that we can investigate and take appropriate action.

12. Automated Processing, Analytics, and Personalisation

We may use automated systems and analytics tools to understand Site usage, identify customer preferences, detect fraud, improve our services, measure marketing performance, and provide relevant product or content recommendations.

Where personalisation, advertising, or analytics requires consent under applicable law, those activities will be subject to your applicable consent choices.

We do not currently use solely automated decision-making that produces legal effects or similarly significant effects on customers within the meaning of the GDPR.

If we introduce processing of that nature in the future, we will provide the information and safeguards required by applicable data protection law.

13. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, business operations, service providers, or applicable legal and regulatory requirements.

The latest version will be published on the Site together with its effective date.

Where required by law, we will provide additional notice or obtain consent before making a material change that affects how personal data is processed.

14. Contact Information

For privacy-related questions, requests, or concerns, please contact:

Spa Ceylon Ayurveda Wellness - Malta
CSDSC Ltd.
Company Registration Number: C 115152
VAT Registration Number: MT32738934
114, Telghet Birkirkara
San Giljan, STJ 1144
Malta
Website: spaceylon.mt
Email: [INSERT CONFIRMED PRIVACY / CUSTOMER CARE EMAIL]

If you believe that your data protection rights have been infringed, you may also lodge a complaint with:

Information and Data Protection Commissioner (IDPC), Malta
Website: idpc.org.mt

This Privacy Policy is effective as of August 12, 2026.