Privacy Policy

When This Privacy Policy Applies

This Privacy Policy applies to personal information collected through our website and through related website-based enquiries, orders and communications.

Pussalla is a Sri Lankan business with local and international business activities. Privacy and data protection requirements can differ depending on where a customer or website visitor is located, the nature of the interaction and the laws that apply to the particular processing activity.

The fact that our website can be accessed from another country does not, by itself, mean that every privacy law of that country applies to us. Where a particular data protection law applies to our processing, we will take the steps required by that law.

Information We May Collect

Depending on how you interact with us, we may collect the following types of information:

• Personal and contact information: Such as your name, email address, telephone number and other contact details you choose to provide.

• Order and transaction information: Such as products ordered, quantities, delivery details, billing information, payment status and information needed to process an order. We do not intend to collect or store full payment-card details where these are handled directly by a payment provider.

• Business and enquiry information: If you contact us as a business customer, distributor, importer, retailer or other business contact, we may collect information relating to your company, role, enquiry, purchasing requirements and communications with us.

• Communications: Information you provide when you contact us by email, telephone, contact forms or other communication channels connected with the website.

• Website and technical information: Such as IP address, browser type, device information, approximate location derived from technical information, pages visited, referring pages and information about how the website is used.

• Cookie and similar technology information: Information collected through cookies, pixels, analytics tools or similar technologies, depending on the technologies used on the website and your choices where consent is required.

How We Use Information

We may use personal information for purposes including:

• Processing and fulfilling orders.

• Communicating with customers and responding to enquiries.

• Providing quotations or information requested by business customers and prospective customers.

• Managing deliveries, returns, refunds and other order-related matters.

• Processing or confirming payments through applicable payment providers.

• Maintaining and improving our website, products and customer experience.

• Understanding website usage and website performance.

• Preventing fraud, misuse, security incidents and other unlawful activity.

• Complying with legal, regulatory, accounting and record-keeping requirements.

• Sending marketing communications where permitted and, where required, with your consent.

Legal Bases Where EU or UK Data Protection Law Applies

If the EU General Data Protection Regulation (GDPR), UK GDPR or another law requiring a lawful basis for processing applies to particular processing activities, the relevant lawful basis may include:

• Performance of a contract: where processing is necessary to process an order, provide a requested service or take steps at your request before entering into a contract.

• Legal obligation: where processing is necessary to comply with a legal or regulatory requirement.

• Legitimate interests: where processing is necessary for our legitimate business interests and those interests are not overridden by applicable rights and interests.

• Consent: where the law requires consent, including for certain marketing or non-essential cookies and similar technologies.

The appropriate legal basis depends on the specific processing activity. Where consent is relied upon, you may withdraw it where permitted by law, although this will not affect processing carried out before withdrawal.

Cookies and Similar Technologies

Our website may use cookies and similar technologies to support essential website functions, remember preferences, understand website usage and improve performance.

Some cookies or similar technologies may be necessary for the website to function. Others, such as certain analytics, advertising or non-essential tracking technologies, may require consent depending on the technology used, your location and the law that applies.

Where consent is required, we will provide an appropriate mechanism for you to make and manage your choices. You may also be able to manage cookies through your browser settings.

The actual cookies and third-party technologies used on the live website should be reviewed periodically so that this policy and any cookie notice accurately reflect the website's current configuration.

How We Share Information

We may share personal information where reasonably necessary to operate our business and provide our services. This may include sharing information with:

• Payment processors and financial service providers.

• Delivery, courier, logistics and shipping providers.

• Website hosting, technical support and IT service providers.

• Email, communication, customer-management or business software providers.

• Professional advisers, auditors or service providers where reasonably necessary.

• Government authorities, regulators or law-enforcement bodies where we are legally required or permitted to do so.

• Other parties where you have asked us to share information or where sharing is otherwise permitted by applicable law.

We do not intend to sell personal information to third parties. Where service providers process personal information on our behalf, we will seek to use appropriate contractual and organisational safeguards as required by applicable law.

International Data Transfers

Because Pussalla operates from Sri Lanka and may use service providers or business partners located in other countries, personal information may be transferred, stored or processed outside the country in which it was collected.

Where a data protection law applicable to the relevant processing requires specific safeguards for an international transfer, we will use an appropriate transfer mechanism or other safeguard required by that law.

Data Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

No website, electronic transmission or storage system can be guaranteed to be completely secure. We therefore cannot promise absolute security, but we will take reasonable steps appropriate to the information and risks involved.

How Long We Keep Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to provide services, maintain business and transaction records, resolve disputes, enforce agreements and comply with legal, accounting or regulatory obligations.

Retention periods may differ depending on the type of information and the reason it is held. Where applicable law requires a specific retention period, we will follow that requirement.

Your Privacy Rights

Depending on your location and the law applicable to the processing, you may have rights relating to your personal information, which can include:

• Requesting access to personal information we hold about you.

• Requesting correction of inaccurate or incomplete information.

• Requesting deletion of information where the law provides such a right.

• Requesting restriction of processing in circumstances provided by law.

• Objecting to certain processing, including certain processing based on legitimate interests.

• Requesting portability of certain information where applicable.

• Withdrawing consent where processing is based on consent.

• Making a complaint to the relevant data protection authority where applicable.

These rights are not absolute and may be subject to legal conditions or exceptions. The rights available to you depend on the law that applies to your situation.

EU Privacy Requirements

Depending on the nature of our activities and the circumstances in which personal information is processed, the EU GDPR may apply to particular processing activities.

For example, the GDPR can apply to organisations outside the European Union where they offer goods or services to individuals in the EU or monitor their behaviour in the EU, subject to the requirements and scope of the law.

The accessibility of our website from the EU, by itself, does not mean that the GDPR applies to every visitor or every processing activity. Where the GDPR applies, we will comply with the requirements applicable to the relevant processing.

Where the GDPR requires an EU representative for our processing activities, we will appoint one in accordance with the applicable requirements. Where a statutory exemption from that appointment requirement applies, we will assess and apply the exemption as appropriate.

If you are located in the EU and believe the GDPR applies to our processing of your personal information, you may contact us using the details in this policy regarding your applicable rights.

UK Privacy Requirements

Depending on the nature of our activities and the circumstances in which personal information is processed, the UK GDPR and other applicable UK data protection requirements may apply.

For example, UK data protection law can apply to organisations outside the UK where they offer goods or services to individuals in the UK or monitor their behaviour in the UK, subject to the applicable requirements and scope.

The accessibility of our website from the UK, by itself, does not mean that UK GDPR applies to every visitor or every processing activity. Where UK data protection law applies, we will comply with the requirements applicable to the relevant processing.

Where applicable UK law requires us to appoint a UK representative, we will do so in accordance with the applicable requirements.

Individuals in the UK may also have the right to complain to the UK Information Commissioner's Office (ICO) where the relevant UK data protection rules apply.

US Privacy Requirements

The United States does not have one single comprehensive privacy law that applies in the same way to every business. Federal and state privacy laws may apply depending on the nature of the business, the information processed, the customer’s location and other legal thresholds.

Where a US privacy law applies to our processing, we will provide the rights, notices and choices required by that law.

For example, certain California privacy requirements can apply to businesses that meet specified legal thresholds and other conditions. Pussalla will assess such requirements based on its actual business activities and applicable thresholds rather than assuming that every US visitor is subject to the same rights.

Direct Marketing

We may use contact information to send information about our products, services, business developments or offers where permitted by law.

Where consent is required for a particular marketing communication, we will obtain the required consent before sending it.

You can ask us to stop sending marketing communications at any time. Where an unsubscribe mechanism is provided, you can use it to manage marketing preferences.

We may continue to send service-related or transactional communications where necessary, such as order confirmations, delivery updates or responses to enquiries.

Children's Privacy

Our website and services are intended primarily for customers and business contacts rather than children. We do not knowingly seek to collect personal information from children through the website.

If you believe a child has provided personal information to us, please contact us so that we can review the matter and take appropriate steps where required by applicable law.

Third-Party Websites and Services

Our website may contain links to third-party websites or may use third-party services such as payment, delivery, analytics, communication or other technology providers.

Those third parties may have their own privacy policies and terms. We are not responsible for the privacy practices of websites or services that we do not control.

Customers should review the privacy information provided by relevant third parties where appropriate.

Exercising Your Privacy Rights

If you would like to make a privacy request or ask a question about how we process your personal information, contact us using the details below.

Please provide enough information for us to understand your request and, where necessary, verify your identity before providing access to or making changes to personal information.

Where a particular law sets a deadline for responding to a valid privacy request, we will respond within the period required by that law.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our website, services, business practices or applicable legal requirements.

The “Last Updated” date at the top of this policy will indicate the most recent revision. We encourage you to review this policy periodically.