The fine print
Privacy policy
What we collect when you write to us or buy a stone, who else sees it, how long we keep it and how to have it back or removed. Written to be read rather than agreed to.
Last updated 26 August 2026
Who we are
This site is run by Ceylon Veritas Gems, a gem house trading from 38, Negombo Road, Kandana 11320, Sri Lanka. We sell loose Ceylon gemstones and have them set to order. This policy covers this website and the enquiries, orders and correspondence that come through it.
If you would rather ask a person than read a policy, write to info@ceylonveritasgems.com and a gemmologist replies.
The short version
The whole policy is below, and it is worth reading. This is what it comes to.
- We collect what you send us and what an order needs, and nothing beyond that.
- We do not sell your details, rent them, or use them to build an advertising profile.
- We do not add you to a mailing list because you asked about a stone.
- You can ask what we hold, ask for a copy, ask us to correct it or ask us to delete it.
- One email reaches a person about any of this, and the reply comes in writing.
What we collect, and when
When you write to us
The contact and enquiry forms on this site ask for your name, your email address and your message, and nothing else is required to send one. If you write by email or on WhatsApp instead, we hold that conversation in the same way: what you chose to tell us, for as long as it is useful to the question you asked. WhatsApp messages sit on WhatsApp's own service as well as with us, under their terms rather than ours.
When you buy a stone
An order needs a name, a delivery address, a contact number for the courier and an email address for the paperwork. We keep the invoice, what was bought, where it went and the report the stone travelled with, because a gemstone sale has to be traceable to the stone and its report years later.
This website does not take card payments and stores no card numbers. Payment is arranged separately, by card or by bank transfer, and the record we hold of it is the invoice and the fact that it was settled.
When you only read the site
Like every website, this one sits on a server that logs the requests it receives: the address the request came from, the page asked for, the time and the browser making it. Those logs exist so the site can be kept running and secure. We do not use them to identify individual readers, and we run no analytics product, no advertising pixel and no visitor tracking script on this site.
What we do not do
We do not sell, rent or trade your details. We do not use them to build a profile for advertising, and we do not pass them to anyone whose business is advertising. We do not put you on a mailing list because you asked a question, and we do not make automated decisions about you.
Cookies and the requests this site makes
This site sets no advertising or tracking cookies. WordPress, which runs it, sets a small number of its own: a cookie that checks whether your browser accepts cookies at all, and, if you are a member of staff signing in to the admin, cookies that keep you signed in. A reader who never signs in and never submits a form is not asked to carry a cookie for our benefit.
What is worth knowing, and what most policies leave out, is that a page can reach other companies' servers simply by loading. These are the ones this site reaches, and why.
| What it is | Whose server | When it happens |
|---|---|---|
| The two typefaces | Google Fonts | Every page load, so the fonts they see are the fonts we chose. |
| The layout stylesheet | jsDelivr | Every page load. |
| The carousel script | Cloudflare cdnjs | Every page load. |
| The WhatsApp button | Only when you press it, and then you are on their service. | |
| A report lookup | The laboratory that issued it | Only when you follow the verify link on a stone. |
A request of that kind carries your network address and which page asked for the file, because that is how the web fetches anything. We chose those hosts for speed and reliability, not to learn anything about you, and we receive nothing back from them about who you are. Each of them has its own privacy terms, and following a link takes you under them.
Who else sees your details
Only the people an order cannot happen without, and only the part each of them needs.
- The courier, who needs the delivery name, address and telephone number to hand a parcel to a person and take a signature.
- The bank, for a transfer, which sees what any bank sees when money moves.
- Sri Lanka Customs and the customs service at your end, which are given the declaration a gemstone export requires by law.
- The companies that host this website and carry our email, which hold the data because the service runs on their machines.
- Our accountants and, if we are ever obliged to, a court or a regulator with a right to ask.
We are in Sri Lanka and most of our buyers are not, so an order crosses borders by its nature: your delivery details travel to the country the parcel is going to. Where the law of your country gives you rights over that transfer, those rights stand.
How long we keep things
An enquiry that does not become an order is kept while it is still a live conversation and then no longer. A sale is different: we keep the invoice and the record of which stone went where for as long as the accounting and tax rules that apply to us require, and so that a stone can be tied back to its report and its buyer long afterwards, which is the whole point of a certified stone. Server logs turn over on the host's own cycle. If you want something gone sooner, ask, and if we are allowed to delete it we will.
Your rights over your data
Whoever you are and wherever you write from, you can ask us what we hold about you, ask for a copy of it, ask us to correct it if it is wrong, ask us to delete it, or tell us to stop using it for something. You do not need to give a reason and it costs nothing. One email is enough, and the answer comes in writing.
Sri Lanka's Personal Data Protection Act sets out rights of that kind for people whose data is handled here, and the United Kingdom's and the European Union's data protection rules do the same for buyers there. We do not ask which set applies before answering: the request gets answered.
The one thing we may not be able to do is erase a completed sale on request, because the record of who bought which stone is also an accounting record and a link to a laboratory report. If that is the case we will say so plainly rather than quietly keep it.
How we look after it
The site is served over an encrypted connection, admin access is limited to the people who need it, and we keep the software behind it up to date. No one can honestly promise that nothing will ever go wrong; what we can say is that if a breach ever affected your details, we would tell you rather than hope you did not notice.
Children
This is not a site for children and we do not knowingly collect anything about them. If you think a child has sent us their details, write to us and we will remove them.
Changes to this policy
If how we handle data changes, this page changes with it and the date at the top moves. We do not quietly widen what we do with your details and leave the policy standing.
How to reach us, and how to complain
Write to info@ceylonveritasgems.com, telephone +94 (77) 638 2473, or post to 38, Negombo Road, Kandana 11320, Sri Lanka. Any of the three reaches a person.
If you are not satisfied with how we have handled your data, tell us first and give us the chance to put it right. You are also entitled to complain to a regulator: in Sri Lanka that is the data protection authority established under the Personal Data Protection Act, and in the United Kingdom or the European Union it is your own national supervisory authority. Complaining to them does not require our permission and does not affect anything else.