How SUPER SAVE LANKA (PVT) LTD protects your data

1. Data we collect

We collect only the data necessary to perform our services safely and lawfully, including:

• Identity data: KYC documents, PAN, passport copies, IEC, GST, company incorporation details, and authorized signatory information for shippers and consignees.
• Contact data: Names, phone numbers, email addresses, pickup and delivery addresses, and emergency escalation contacts.
• Shipment data: Commercial invoices, item descriptions, HS codes, declared values, tracking milestones, and proof-of-delivery artifacts.
• Payment data: Razorpay order IDs, payment instrument metadata, bank references (never full card numbers), and GST invoices.
• Device/cookie data: Browser, IP, and interaction logs generated by our website and dashboard to prevent fraud and improve usability.

2. Purpose and lawful use

We use personal data strictly for:

• Customer onboarding, risk evaluation, and compliance with KYC/AML obligations.
• Creating shipments, booking carriers, customs filing, and tracking notifications.
• Processing payments, refunds, credit notes, and statutory tax filings.
• Providing customer care, resolving disputes, and honoring legal notices.
• Product analytics and service improvement using aggregated or anonymized datasets.

Processing is based on user consent, contractual necessity, and legitimate interests allowed under the DPDP Act. Where law mandates retention (e.g., Customs or FEMA), we rely on statutory obligation ground.

3. Sharing with third parties

We never sell personal data. We share limited information with trusted processors that enable logistics fulfillment and payments:

• Carrier partners, airlines, postal operators, and last-mile couriers.
• Customs brokers, insurance providers, and warehouse operators bound by NDAs.
• Razorpay and banking partners for payment acceptance and settlement.
• Regulators, law enforcement, or courts when legally compelled.

Every processor agreement includes confidentiality, DPDP-compliant safeguards, and audit rights.

4. Data storage, retention, and security

We host data on ISO 27001-certified infrastructure located in India or compliant jurisdictions. Access is limited via role-based controls, encryption at rest, TLS in transit, and monitored audit trails.

• Shipment and invoice records: minimum 8 years (Customs/FEMA requirement).
• KYC records: 5 years post relationship termination (Razorpay/AML requirement).
• Web analytics logs: 12 months.

Upon expiry of the retention period, data is deleted or irreversibly anonymized unless litigation hold applies.

5. Your rights

Under the DPDP Act, you may:

• Request confirmation of processing and access to your personal data.
• Correct or update inaccurate information.
• Withdraw consent where processing is consent-based.
• Request deletion when data is no longer necessary or legally required.
• Lodge a complaint with the Data Protection Board of India.

Submit rights requests via info@colombomail.lk or contact our Grievance Officer. We verify the requester’s identity before acting and respond within 15 working days.

6. International transfers

Cross-border deliveries require sharing shipment data with destination customs and carriers. We ensure every transfer adheres to Section 16 of the DPDP Act by using standard contractual clauses or adequacy determinations when available.

7. Cookies and tracking

Our website uses essential cookies for authentication and optional analytics pixels to understand feature usage. You can manage cookie preferences through your browser settings. Disabling essential cookies may limit access to the dashboard.

8. Children’s data

Colombo Mail is a B2B logistics service and does not knowingly collect data of individuals under 18 years of age. If such information is inadvertently captured, please notify us for immediate deletion.

9. Updates to this policy

We review this policy annually or whenever regulations change. Material updates will be posted on this page with a revised “Last updated” date and, where required, notified via email.

10. Contact & grievance redressal

For privacy-related questions, email info@colombomail.lk or write to our registered office at No.4, Council Avenue, , Dehiwala, Western Province , Sri Lanka.

Grievance Officer: Compliance Desk, Grievance Officer

Email: info@colombomail.lk

Phone: (+94) 114 896 660