Privacy Policy

Who Is Responsible for Your Information?

Ama Lanka Gems (Pvt) Ltd, a company registered in Sri Lanka (registration number PV 00229301), is responsible for the personal information described in this policy, which the law calls the data controller.

Data controller

Ama Lanka Gems (Pvt) Ltd

Company registration

PV 00229301

Based in

Colombo, Sri Lanka

Privacy questions

hello@amalankagems.com

For anything in this policy, email us at hello@amalankagems.com. A person answers, not an automated system.

What Information Do We Collect?

We collect the details you give us when you get in touch, the order details needed to sell and deliver a stone, and a small amount of technical information recorded automatically when you use the site.

Information you give us

• A sourcing brief: the stone you are looking for, the carat range, your budget and treatment preference if you give them, what the stone is for, your name, your WhatsApp number or email address, and anything else you choose to tell us.
• Enquiries by email or WhatsApp, including anything you send in the conversation, such as a photograph of a stone or a ring you have in mind.
• Order details when you buy a stone: your name, delivery address, phone number and the bank transfer reference. We do not take card payments on this site and never hold card numbers.
• A review or feedback you agree to let us publish, in the words you approve.

Information recorded automatically

• When you send a brief, the server records the IP address it came from alongside the brief, and keeps a scrambled (hashed) copy for one hour so that automated submissions can be limited.
• If you arrive from one of our Google adverts, the click reference (gclid) and campaign labels are kept in your browser for the visit and included with your brief, so we know which advert brought you.
• Our web host keeps standard server logs: IP address, browser type, the pages requested and the time.
• Google Analytics and Google Ads set cookies that record the pages you visit, your device and browser, your approximate location and whether a brief was sent. The cookies section below lists each one.

We do not ask for sensitive personal information, and we do not need it to source a stone.

How Do We Use It?

We use your information to do what you asked: answer your brief, source and show you stones, and deliver the one you choose.

• To reply to a brief or enquiry, source matching stones and send you their laboratory reports and video.
• To arrange a viewing, a purchase, insured delivery and any return.
• To keep the records that tax, customs and export law require of a gemstone business in Sri Lanka.
• To measure whether our Google adverts bring people who send a brief, and to see how the site is used so we can improve it.
• To protect the site and the brief form from spam and abuse.

We do not sell personal information, we do not add you to a mailing list, and we do not send marketing you did not ask for. If you send us a brief, you hear from us about that brief.

What Is Our Legal Basis?

Where the UK GDPR or the EU GDPR applies to you, we rely on one of four legal bases, depending on what we are doing.

• Contract: replying to a brief, sourcing a stone you asked about, and delivering one you have bought are steps taken at your request before, and then under, a contract with you.
• Legitimate interests: keeping the site secure, preventing spam, measuring our advertising and understanding how the site is used. We weigh these against your interests and keep the information minimal.
• Legal obligation: keeping business, tax and export records.
• Consent: analytics and advertising cookies where your country requires consent for them. You can withdraw it at any time through your browser or the controls in the cookies section.

As a Sri Lankan company we also comply with the Personal Data Protection Act No. 9 of 2022 of Sri Lanka.

Who Do We Share It With?

We share personal information only with the people and services needed to answer you and deliver a stone. We never sell it.

• Our web and email hosting, which store the site and the inboxes your brief is delivered to.
• Google, which provides Google Analytics and Google Ads. Google processes the technical information described in the cookies section under its own privacy policy.
• Meta, when you message us on WhatsApp. Your messages are handled under WhatsApp's privacy policy.
• Specialist carriers and their insurers, such as Malca-Amit, DHL and FedEx, who need your name, address and phone number to deliver and insure a stone.
• Banks, to receive your payment and to refund it if you return a stone.
• Customs and export authorities, where the law requires a declaration for a shipment.

Within the house, the gemologist and the people handling your brief see only what they need to answer it.

Where Is It Kept?

We are based in Sri Lanka, so if you contact us from another country your information travels to us here, and some of it is processed by our service providers in other countries.

Google and Meta process data in the United States and elsewhere under the safeguards set out in their own privacy policies. Whatever the country, we hold your information to the standard described in this policy.

How Long Do We Keep It?

We keep information for as long as we need it for the purpose we collected it, then delete it.

• Briefs and enquiries: for as long as we are in conversation with you, and for up to two years after our last exchange, so we can pick up where we left off if you come back.
• Order and delivery records: for the period that tax, customs and export law requires us to keep them.
• The hashed IP address used to limit form spam: one hour.
• The advert reference kept in your browser: until you close the tab. Google's cookies last as long as the table below states.

Cookies and Similar Technologies

The site uses a small number of cookies and browser storage items, all of them listed here. None is needed for the brief form to work.

Your browser lets you block or delete cookies at any time. Google also offers a browser add-on that opts you out of Google Analytics and settings that control personalised adverts. Blocking cookies does not stop the brief form or the rest of the site from working.

What Are Your Rights?

You can ask us what we hold about you, have it corrected or deleted, or object to how we use it, and we will act on the request.

• Access: a copy of the personal information we hold about you.
• Correction: fixing anything that is wrong or incomplete.
• Deletion: removing your information where we no longer need it or the law lets you ask.
• Restriction and objection: pausing or stopping a use you disagree with, including any use based on our legitimate interests.
• Portability: receiving the information you gave us in a usable format.
• Withdrawing consent: for anything that relies on it, at any time.
• Complaint: to your data protection authority, which in the United Kingdom is the Information Commissioner's Office, in the European Union the authority in your country, and in Sri Lanka the Data Protection Authority.

To exercise any of these, email hello@amalankagems.com from the address you used with us, or message us on WhatsApp. We may ask you to confirm your identity before acting, and there is no charge.

How Do We Protect It?

Connections to the site are encrypted, briefs go to inboxes that only the people handling enquiries can open, and we hold no card details at all.

The brief form checks and limits what it receives to block automated abuse, and access to your information is limited to the people who need it to answer you. No system is perfectly secure, so if you believe your information has been compromised, tell us and we will investigate and let you know what we find.

Children

The site and our services are for adults. We do not knowingly collect information from anyone under 18, and if we learn that we have, we delete it.

Other Websites

Laboratory report verification pages, WhatsApp and the other sites we link to have their own privacy policies, which apply once you leave ours.

Changes to This Policy

When we change this policy we update the date at the top. A material change to how we use your information is explained here and, where we can, to you directly.