Privacy Policy

Steamsbury (Pvt) Ltd (“we”, “us”, or “our”) is committed to protecting the privacy and personal data of individuals who access our website and register as members. This Privacy Policy sets out how we collect, process, store, and protect personal data in compliance with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka (“PDPA”).

By using our website and registering as a member, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy.

1. Controller of Personal Data

For the purposes of the PDPA, Steamsbury (Pvt) Ltd is the Data Controller in respect of all personal data collected through this website. We have appointed a Data Protection Officer (DPO) to oversee our data protection strategy and ensure compliance with local regulations.

2. Personal Data We Collect

When you sign up to become a member, we collect the following personal data:

• Full Name
• Phone Number
• Email Address
• Date of Birth

We do not collect sensitive personal data (such as health information or religious beliefs) unless expressly required and lawfully permitted under the PDPA.

3. Children’s Privacy

Our website and membership services are intended for individuals who are at least 18 years of age. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected personal data from a child under the age of 18 without verifiable parental consent, we will take immediate steps to delete such information from our records.

4. Lawful Basis for Processing

Personal data is processed in accordance with the lawful bases stipulated under the PDPA, including:

• Consent provided by you at the time of registration.
• Performance of a contract, namely the provision and administration of membership services.
• Legitimate interests of Steamsbury (Pvt) Ltd, provided such interests do not override your fundamental rights.
• Compliance with legal and regulatory obligations.

5. Purpose of Processing

Your personal data is processed for the following purposes:

• To register, verify, and manage your membership.
• To communicate regarding benefits, promotions, and service updates.
• To provide birthday-related or age-specific offers.
• To improve our products, services, and customer engagement.
• To comply with applicable laws and regulatory directives.

6. Direct Marketing and Opt-Out Rights

We may use your personal data to send you promotional materials. You have the absolute right to opt-out of direct marketing at any time by:

• Clicking the ‘unsubscribe’ link in any of our marketing emails.
• Contacting us directly via the details provided in Section 14.

Opting out of marketing does not affect our ability to send you essential administrative messages regarding your account.

7. Disclosure of Personal Data

Steamsbury (Pvt) Ltd does not sell, rent, or trade personal data. Data may be disclosed only:

• To authorised third-party service providers (e.g., IT hosting, email delivery) subject to strict confidentiality agreements.
• To regulatory authorities or law enforcement where required by Sri Lankan law.

8. Data Security Measures

We implement appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, or alteration. Access is restricted to authorised personnel on a strict "need-to-know" basis.

9. Data Retention

Personal data will be retained only for as long as necessary to achieve the purposes for which it was collected or as required by law. Upon completion of the retention period, data will be securely deleted or irreversibly anonymised.

10. Rights of Data Subjects

In accordance with the PDPA, you are entitled to:

• Request access to your personal data.
• Request rectification of inaccurate or incomplete data.
• Request erasure of data, subject to statutory limitations.
• Object to or request restriction of processing.
• Withdraw consent at any time.

11. Cookies and Website Technologies

This website do not use cookies. This website do not collect personally identifiable information unless voluntarily provided by you.

12. Third-Party Links

Our website may contain links to external sites or social media platforms. Steamsbury (Pvt) Ltd is not responsible for the privacy practices of these third parties, and we encourage you to read their respective policies.

13. Cross-Border Data Transfers

If personal data is transferred outside Sri Lanka (e.g., for cloud storage), we ensure that such transfers comply with the PDPA and that appropriate safeguards are in place to protect your information.

14. Contact Information

For inquiries, requests to exercise your rights, or complaints, please contact our Data Protection Officer:

15. Amendments to This Privacy Policy

We reserve the right to update this policy at any time. Revisions will be published on this page with an updated effective date. Continued use of the website constitutes acceptance of the revised policy.