Privacy Policy

This Privacy Policy describes how Spa Ceylon Ayurveda Wellness (“Spa Ceylon”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal information when you visit our website, use our services, interact with us online, or otherwise engage with our brand.

For legal and regulatory purposes, Spa Ceylon Ayurveda Wellness operates as part of SCJ LIFE STYLE TRADING CO LLC, a Free Zone LLC registered in the United Arab Emirates, with its principal address at Salma Ali Saif bin Hareb Al Muhairi, Al Murar, Deira, Dubai, United Arab Emirates.

1. Scope and Applicability

This Policy applies to all personal data collected by Spa Ceylon Ayurveda Wellness, including through our website (spaceylon.ae), mobile applications, digital channels, affiliated locations, and all business operations worldwide.

We comply with all applicable privacy laws, including the UAE Federal Decree-Law No. 45 of 2021 (PDPL), the UK Data Protection Act 2018, the EU General Data Protection Regulation (GDPR), and other international data protection regulations.

2. Information We Collect

We may collect and process the following categories of information:

• Contact and Identity Data: Name, address, email, phone number.
• Account and Transaction Data: Username, password (securely stored), purchase history, order preferences, payment data (processed via Stripe, PayPal, Apple Pay, Google Pay—never retained by us), loyalty program participation, and customer service records.
• Device and Technical Data: IP address, device and browser type, operating system, unique identifiers, session logs, and geolocation (when enabled).
• Usage and Analytics Data: Website usage, session duration, products viewed/purchased, clickstream, cookies, marketing engagement (Klaviyo, Meta, Google, Shopify Analytics).
• Communications Data: Emails, chat transcripts, inquiries, feedback, reviews, survey responses.
• Third-Party and Social Data: Data from social logins, integrations, and third-party technology/app partners.
• Logistics and Fulfillment Data: Delivery details, tracking information, and records shared with logistics, warehousing, and courier providers.
• Business Operations and Legal Data: Information related to compliance, audits, fraud prevention, dispute resolution, and contractual requirements.

We do not knowingly collect personal data from children under 16. If we learn that we have inadvertently collected such data, we will delete it promptly.

3. How We Collect Information

Information may be collected:

• Directly from you: Account registration, order placement, form submissions, customer service contact, or participation in promotions.
• Automatically: Through cookies, web beacons, pixels, analytics tools, log files, and other technologies.
• From trusted partners: Payment processors, logistics providers, marketing/analytics platforms, technology vendors, and group affiliates.

4. How We Use Information

We use your personal data to:

• Fulfill contracts, process orders and payments, deliver products and services, and provide customer support.
• Personalize your experience, recommend products, and optimize our platforms.
• Conduct lawful marketing, advertising, promotions, and communications (subject to your rights to opt out).
• Secure our business, prevent fraud, and protect customers.
• Conduct business operations, analytics, research, product development, and legitimate commercial interests.
• Comply with legal, regulatory, and tax obligations, and respond to requests from authorities.
• Enable seamless multinational operations, logistics, and group support, using approved technology partners and internal teams.

We may use anonymized or aggregated data for analytics, research, or business development.

5. Disclosure and International Transfers

We may share your data with:

• Spa Ceylon Ayurveda Wellness group entities and affiliates (including UAE, UK, EU, South Asia, and other global operations) on a strict business-need basis.
• Technology and business partners: Shopify (e-commerce platform), Stripe, PayPal, Apple Pay, Google Pay (payments), Klaviyo, Meta (Facebook/Instagram), Google Analytics/Ads, approved app and software vendors, loyalty/rewards providers, and IT/security partners.
• Logistics and fulfillment providers: Couriers, warehouses, and service partners for order processing and delivery.
• Marketing, analytics, and advertising partners: Klaviyo, Meta, Google, and similar platforms for lawful communications and performance analysis.
• Regulatory, legal, or government authorities: When required to comply with law, protect rights, or respond to official requests.
• In connection with business transactions: Such as a merger, acquisition, reorganization, or asset sale, under strict confidentiality.
• Other parties: Only with your explicit consent or where otherwise permitted by law.

If your data is transferred outside your home country, we implement legally recognized safeguards (e.g., Standard Contractual Clauses, data processing agreements) to ensure ongoing protection.

We do not sell your personal data.

6. Access and Use by Global Employees and Partners

Your information may be accessed by authorized Spa Ceylon Ayurveda Wellness employees, affiliates, contractors, and trusted business partners across jurisdictions as necessary to operate our business efficiently. Access is strictly controlled, logged, and limited to those who require it to perform their job duties, in line with legal and contractual requirements.

7. Data Security

We employ industry-standard technical, physical, and organizational measures, including:

• Encryption (SSL/TLS) for all web traffic and sensitive data.
• PCI DSS-compliant payment processing.
• Access controls, password and credential management.
• Multi-factor authentication for sensitive systems.
• Ongoing security monitoring, audits, and incident response.
• Strict internal policies for data access and confidentiality.

No system is 100% secure; you are responsible for maintaining the confidentiality of your account credentials.

8. Data Retention

We retain your personal data only as long as necessary for business, legal, and operational purposes:

• Fulfilling orders and service requests.
• Meeting legal, tax, and regulatory requirements (typically up to 7 years for transactions).
• Supporting customer service and marketing preferences.
• Protecting against fraud and security threats.

After the retention period, data is securely deleted or anonymized.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access, correct, or delete your personal data.
• Restrict or object to certain data processing.
• Withdraw consent (where applicable).
• Receive your data in a portable format.
• Opt out of direct marketing at any time.
• Lodge a complaint with your local data protection authority.

To exercise your rights or make a privacy inquiry, email online@spaceylon.ae. We may require verification of your identity.

10. Cookies and Tracking Technologies

We use cookies, web beacons, and similar technologies to:

• Enable secure website and shopping features.
• Remember preferences and settings.
• Analyze site performance, usage, and trends (using Shopify Analytics, Google Analytics).
• Power marketing, advertising, and personalization (Klaviyo, Meta, Google).

You can control cookies via your browser settings; disabling cookies may limit functionality.

11. Children’s Privacy

Our services are not directed to children under 16. If we become aware of personal data collected from a minor, we will delete it immediately.

12. Automated Processing, Analytics, and Business Innovation

We use automated tools and analytics to understand customer needs, optimize business processes, and personalize experiences. No decisions with significant legal or similar effects are made solely by automated means.

13. Changes to this Policy

We reserve the right to update this Policy at any time, to reflect business, technological, or legal developments. The current version will always be available on our website with the effective date above. We may notify you of material changes as required by law.

14. Contact Information

For all privacy-related inquiries or rights requests, contact:
Spa Ceylon Ayurveda Wellness
Salma Ali Saif bin Hareb Al Muhairi, Al Murar, Deira, Dubai, United Arab Emirates
Email: online@spaceylon.ae

You may also contact your local data protection authority (e.g., UAE TDRA, UK ICO) if you have concerns.

This Privacy Policy is effective as of July 14, 2025.