Your data, handled with care

Ceylon Harvest is operated by Ceylon Harvest (company no. Company details will be published before we open, Company details will be published before we open), acting as marketplace of record. We are the controller of the personal data described here. Growers who sell or host on Ceylon Harvest receive only the details they need to fulfil your order or booking. Contact our privacy team at Company details will be published before we open.

• Account details: your name, email and/or phone number, and language.
• Orders and bookings: what you bought or booked, delivery addresses, gift recipients and notes, and the payment method used. Card details are handled by Stripe and never reach our servers.
• Messages you exchange with growers, reviews and photos you post.
• For sellers and delivery partners: identity documents (NIC), payout details and farm location. NIC images are encrypted at rest, readable only by our verification team, and deleted if verification is rejected.
• Technical data: necessary cookies, and — only if you agree — analytics and marketing cookies. See our cookie policy.

• To run the marketplace: take payment, pass orders and bookings to growers, deliver, and support you (contract).
• To keep the platform safe: fraud prevention, moderation of reported content, and dispute resolution (legitimate interests).
• To keep accounting records as the law requires (legal obligation).
• To send seasonal news and reminders — only with your opt-in, which you can withdraw any time (consent).

The grower or host you buy from (name, delivery or meeting details, and messages), a delivery partner when a collection is arranged (recipient name, phone and address), our payment processor (Stripe), and messaging providers that deliver email, SMS and WhatsApp notifications. Phone numbers and emails in chat stay hidden until an order or booking is confirmed. We never sell personal data.

You can access, correct, export or delete your personal data, object to processing, and withdraw consent. From your account you can download everything we hold as a JSON file and delete your account yourself.

Deleting an account anonymises it: your name becomes “Deleted user”, your email, phone, sign-in methods, saved items and push devices are removed, and your messages are redacted. Orders, bookings and ledger entries are kept under a pseudonymous id because tax and accounting law require it. An account with an open order, booking or unpaid balance must settle those first.

Account data for as long as your account is open; transaction and ledger records for seven years; consent records for as long as they evidence your choice; NIC images only until verification is decided.

Data moves between the UK, the EU and Sri Lanka to fulfil orders and bookings. Where the destination lacks an adequacy decision we rely on standard contractual clauses.

Tell us first at Company details will be published before we open. You may also complain to the UK Information Commissioner’s Office or Sri Lanka’s Data Protection Authority.