Your privacy.

We collect information needed to respond to enquiries, process orders and provide customer support.

We process your personal information to fulfil orders, respond to enquiries, manage returns, maintain business records and send our newsletter where you have subscribed. We do not use your personal information for automated decision-making that produces legal or similarly significant effects.

Our legal bases for processing personal information, where applicable under data protection law, are:

• Contract: To process and deliver your orders and manage returns.
• Legal obligations: To maintain accounting, tax and other legally required records.
• Legitimate interests: To respond to customer enquiries, protect our website, prevent fraud and improve our services, where these interests do not override your rights.
• Consent: To send marketing newsletters and use customer review photos where consent is required.

You may withdraw your consent at any time where processing is based on consent.

We share only the personal information necessary with service providers that help us operate our shop and fulfil orders. These may include:

• Payment processor: Stripe, for securely processing payments.
• Website hosting provider: Cloudways, for hosting and maintaining our website.
• Email provider: Google Workspace, for handling customer enquiries and order-related emails.
• Delivery partners: DHL Express and FedEx, for shipping orders and providing tracking information.
• Professional advisers: Legal, accounting and other professional advisers where necessary.

We do not sell your personal information to third parties. Service providers are permitted to process your information only as necessary to provide their services and in accordance with applicable data protection requirements.

Orders are managed from Sri Lanka, and some of our service providers may process personal information in other countries.

Where personal information is transferred outside the UK or the European Economic Area (EEA), we will use appropriate safeguards where required by applicable data protection law. These may include the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses (SCCs), together with any required transfer risk assessments or supplementary measures.

You may contact us using the details in this Privacy Policy to request further information about the safeguards applicable to international transfers of your personal information.

We keep personal information only for as long as necessary to fulfil the purposes described above and to meet our legal record-keeping obligations. Order and accounting records are retained for 7 years. Other retention periods are listed in the table above.

You may have the right to access, correct or request the deletion of your personal information, restrict or object to certain processing, and receive a copy of your information in a portable format, subject to applicable data protection laws.

Where we rely on your consent to process personal information, you may withdraw that consent at any time. For example, you can unsubscribe from our newsletter using the link included in our marketing emails. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Some rights are subject to conditions and exceptions under applicable law.

You may also lodge a complaint with a data protection authority. In the UK, you can contact the Information Commissioner's Office (ICO) at https://ico.org.uk/. In the EU, you can contact the relevant data protection authority in your country of residence.

We would appreciate the opportunity to address your concerns first. Please contact us using the details provided in this Privacy Policy.

For privacy questions or requests, email info.prettiestgems@gmail.com. Please share enough information for us to understand your request. We may need to verify your identity before responding, and we reply within one month.