Privacy Policy

Who we are

Our website address is srilankaexport.com. SriLankaExport.com is an independent private B2B marketplace owned and operated by Harker International (Pvt) Ltd (Registration No. PV 00338032), based in Kandy, Sri Lanka. We are not affiliated with the Sri Lanka Export Development Board (EDB) or the Government of Sri Lanka. We connect independently verified Sri Lankan exporters with global buyers. For data-protection inquiries, contact dpo@harker.international.

This Privacy Policy is the consolidated notice covering the laws of Sri Lanka, the European Union, the United Kingdom, and the United States. Jurisdiction-specific supplements appear in the dedicated sections below: California Privacy Notice for California residents, the Data Processing Addendum for B2B Controller/Processor relationships, and Legal Notice for representative information.

Laws this Policy is aligned with

• Sri Lanka Personal Data Protection Act No. 9 of 2022 (PDPA): the operator’s home-jurisdiction privacy law. The Data Protection Authority established under the PDPA is the supervisory authority for Harker International’s processing in Sri Lanka.
• EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR): applies where we process Personal Data of EU residents.
• UK General Data Protection Regulation as retained in UK law by the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018.
• California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CCPA / CPRA): supplementary notice and rights apply per California Privacy Notice.
• Other jurisdictions where we process Personal Data of residents and where local law applies on a non-occasional basis (Australia Privacy Act 1988, India DPDPA 2023, etc.).

What data we collect

When you use SriLankaExport.com we may collect (collected only for the stated business purpose; the categories that apply depend on whether you are a buyer or vendor and what you do on the platform):

• Account data: name, email address, company name, country, phone number.
• Google sign-in (only if you choose it): Google sends us your name, email address, Google account identifier and a link to your Google profile photo (sometimes also your language setting). We keep your name, email address and Google account identifier to create or sign in to your account, and do not store the photo link. We never receive your Google password. You can disconnect Google under My Account > Account details, and Google’s Privacy Policy applies to the sign-in itself.
• Passkeys (only if you set one up): to let you sign in with Face ID, a fingerprint or your device PIN, we store a public key, a random identifier and the date it was added and last used. Your face, fingerprint and PIN never leave your device and are never sent to us. You can remove a passkey under My Account > Account details.
• Unfinished checkouts: if you enter your email at checkout and do not finish, we save your email, name, phone, country and cart for up to 30 days, so we can send you one reminder with a link back to your cart (the link works for 14 days). We never save card details. To have it deleted sooner, email info@srilankaexport.com.
• Vendor onboarding & KYC data: Sri Lanka business registration documents, ownership and beneficial-owner identification (passport / NIC of directors and 25%+ shareholders), EDB registration / directory listing details where applicable (vendor-reported), tax / customs references, and bank account details for marketplace settlement.
• Vendor product documentation: vendor-submitted certification copies (Organic, ISO, HACCP, Halal, Fairtrade, SLS, Lion Logo, GI, etc.), specification sheets, COA, and any supporting product documents.
• Buyer due-diligence data: for higher-risk transactions, company registration, beneficial-owner identification, end-use and end-user statements, and source-of-funds information per our AML & KYC Statement.
• RFQ, messaging, and support records: the content of Requests for Quotation, in-platform messages between buyers and vendors, and support correspondence with our team.
• Order, transaction, and payment-related data: order history, commercial invoices, shipping addresses, payment confirmations, refund records, and payment-channel references (we do not store full card numbers; where card payments are offered, the licensed card gateway handles them directly).
• Buyer acknowledgment records: timestamp, IP address, and clause version of acceptance for the buyer acknowledgment checkbox on RFQ / order forms, recorded under the Sri Lanka Electronic Transactions Act.
• Comments: when you leave comments on the site we record the data shown in the comments form, plus your IP address and browser user agent to help detect spam.
• Technical data: IP address, browser type, device information, and pages visited, collected via standard server logs and cookies.

Cookies

If you leave a comment on our site you may opt in to saving your name, email address, and website in cookies, for your convenience, so you do not have to fill in details again on subsequent comments. These cookies last for one year.

If you visit our login page we set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in we set additional cookies to save your login information and screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks.

Embedded content from other websites

Articles and pages on this site may include embedded content (e.g. videos, images, social posts). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website. These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content.

Supplier and product videos. Videos on store and product pages are hosted on YouTube and played through the YouTube embedded player, using YouTube API Services. Until you click a video, your browser loads only its thumbnail image from YouTube; the player itself loads when you click, in YouTube’s privacy-enhanced mode (youtube-nocookie.com). By watching a video you agree to the YouTube Terms of Service, and Google’s Privacy Policy applies to the data YouTube collects. The short silent previews that play when you rest your mouse on a video on a desktop computer are served from our own servers and do not contact YouTube.

Who we share your data with

We do not sell your personal data. We share data only with the categories of recipients below, and only to the extent necessary for the stated purpose. Cross-border transfers may occur because some recipients are located outside Sri Lanka; cross-border transfers are governed by the safeguards described in the “International transfers” section further down.

• Vendors: when you submit an enquiry or place an order, the relevant Sri Lankan exporter receives the contact details necessary to fulfill the trade. Where your enquiry concerns an exporter listed in our public Exporter Directory who has not yet onboarded, our Trade Desk receives your enquiry first and facilitates the introduction to that exporter.
• Hosting providers: the application and database are hosted by Hostinger on infrastructure that geo-locates in the United States. Backups are stored on the same infrastructure plus the Harker International office system.
• Payment processors: Hatton National Bank Sri Lanka handles bank transfers (BACS), and card payments via HNB IPG are being added. These providers handle payment information directly; we do not store full card numbers. Each provider is licensed in its jurisdiction.
• Logistics partners: shipping addresses, consignee details, and shipment documents are shared with the freight forwarder, customs broker, and carrier needed to deliver the shipment.
• Verification partners: where required for marketplace verification, AML / KYC screening, sanctions screening, or fraud prevention, we may share limited Personal Data with verification, screening, or trust-and-safety partners (e.g. sanctions list providers, identity-verification providers, fraud-signal aggregators).
• Professional advisors: lawyers, accountants, auditors, and compliance consultants engaged by Harker International, bound by professional confidentiality.
• Analytics & service providers: Google Analytics, transactional email (authenticated SMTP), and similar service providers. The full sub-processor list is in the Data Processing Addendum.
• Government authorities: where required by law, court order, regulatory request, or the Financial Transactions Reporting Act No. 6 of 2006 (Sri Lanka FIU), we share the minimum necessary Personal Data with the requesting authority.

If you request a password reset, your IP address will be included in the reset email.

For tax-related data sharing, tax invoices issued to Buyers, WHT certificates issued to Vendors, customs and IRD reporting, see the Tax & VAT Disclosure.

How long we retain your data

For users who register on our site, we store the personal information they provide in their profile until the account is closed. Order, invoice, and tax records are retained for at least 7 years as required by Sri Lankan and EU tax law. Comments and their metadata are retained indefinitely so we can recognize and approve follow-up comments automatically.

Your rights over your data

If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided. You can also request that we erase any personal data we hold about you. This does not include data we are obliged to keep for administrative, legal, or security purposes (such as tax records).

The following rights are available to you, with the precise scope depending on the law that applies to you:

• Access: a copy of the Personal Data we hold about you (GDPR Art. 15; UK GDPR Art. 15; PDPA § 13; CCPA Right to Know).
• Rectification / Correction: correction of inaccurate Personal Data (GDPR Art. 16; PDPA § 14; CCPA Right to Correct).
• Erasure / Deletion: deletion of Personal Data, subject to legal-retention exceptions (GDPR Art. 17; PDPA § 15; CCPA Right to Delete).
• Restriction: restrict our processing of your Personal Data (GDPR Art. 18; PDPA § 16).
• Portability: receive your Personal Data in a portable format (GDPR Art. 20; CCPA Right to Data Portability).
• Objection: object to processing based on legitimate interests, including direct marketing (GDPR Art. 21; PDPA § 17).
• Opt-out of Sale / Sharing: we do not sell or share Personal Data; see the California Privacy Notice for the affirmative statement and the mechanism.
• Withdraw consent: where processing is based on your consent, withdraw it at any time without prejudice (GDPR Art. 7; PDPA § 18).
• Complain to the supervisory authority: lodge a complaint with the Data Protection Authority of Sri Lanka, the supervisory authority in your EU Member State, the UK Information Commissioner’s Office, or the California Attorney General, as applicable.

To exercise any right, email dpo@harker.international with subject “Data-Subject Request: [right]”. We respond within 30 days (Sri Lanka PDPA, GDPR, UK GDPR) or 45 days (CCPA).

Sri Lanka PDPA 2022: specific notice

Under the Personal Data Protection Act No. 9 of 2022 of Sri Lanka (the “PDPA”):

• Harker International (Pvt) Ltd is the Controller of Personal Data submitted directly to us (account, transactional, communications).
• The legal basis for processing is performance of a contract with you (PDPA § 6(1)(b)), compliance with a legal obligation (PDPA § 6(1)(c)), and our legitimate interests in operating the marketplace and preventing fraud (PDPA § 6(1)(f)). Where consent is the basis, we record it and you may withdraw it.
• The Data Protection Authority of Sri Lanka is the supervisory authority. We register with the Authority as required.
• Sri Lankan data subjects have all the rights listed in the “Your rights over your data” section above. To exercise them, email dpo@harker.international.
• Data Protection Impact Assessments are conducted where required by PDPA § 28 prior to high-risk processing operations.

EU Representative under GDPR Article 27

Harker International is established outside the European Union but processes Personal Data of EU residents on a non-occasional basis. Under GDPR Article 27, the appointment of a Representative within the Union is required.

Designation status: Designation in progress; appointment will be completed within 30 days of the “Last updated” date at the top of this Policy. The appointed Representative’s name and contact details will be added to this section and to the Legal Notice once the formal mandate is executed.

In the interim, EU-resident data subjects and EU supervisory authorities may direct GDPR communications to dpo@harker.international. Communications are acknowledged within 48 hours.

UK Representative under UK GDPR Article 27

For the purposes of UK GDPR Article 27, the same designation timeline applies. UK data-subject rights may be exercised through the same interim channel.

California residents

If you are a California resident, you have additional rights and we make additional disclosures under CCPA / CPRA. The full California-specific notice is at California Privacy Notice. The notice includes the affirmative statement that we do not sell or share your Personal Information for cross-context behavioural advertising, and the “Do Not Sell or Share My Personal Information” mechanism required by Cal. Civ. Code § 1798.135.

Where your data is sent

International transfers. Visitor comments may be checked through an automated spam detection service. Site data is hosted by Hostinger on infrastructure that geo-locates in the United States (the shared VPS at IP 157.173.214.173 resolves to US infrastructure, verified 2026-05-30); we previously believed the shared VPS was in Lithuania (EU) and have corrected the disclosure. Where Personal Data of EU / UK / Swiss residents is transferred to the United States, we do not currently maintain executed Standard Contractual Clauses or an equivalent transfer mechanism with Hostinger; we will execute Hostinger’s standard DPA / SCC framework before significant volumes of EU data flow through the platform, and disclose the safeguards then. In the interim, EU / UK data subjects who want their data hosted in the EU may contact dpo@harker.international to discuss alternatives; we may decline service where the transfer cannot lawfully be made. Transfers between EU / UK and Sri Lanka are made under the EU Standard Contractual Clauses (2021/914) and, where applicable, the UK International Data Transfer Addendum, supplemented by the security measures in the DPA.

How we secure your data

The site runs on HTTPS with TLS 1.3, payment information is handled by our licensed payment providers and never stored on our servers, vendor and admin accounts require strong passwords, and the application is updated regularly to patch security vulnerabilities. Personal Data breaches affecting your data are notified to the supervisory authority within 72 hours and to you without undue delay where the breach is likely to result in a high risk to your rights and freedoms (PDPA § 23, GDPR Art. 33-34).