1. Who we are

Tropical Seeds Corporation (Pvt) Ltd ("Tropical Seeds", "we", "us", "our") is a private limited company incorporated in Sri Lanka under registration number PV 00305615, with its registered office at No. 74, Union Place, Colombo 02, Sri Lanka. We supply agricultural seeds, fertilisers and related crop inputs to farmers, dealers, distributors and agri-businesses across Sri Lanka.

For the purposes of the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka (the "PDPA"), Tropical Seeds is the controller of the personal data described in this policy. This policy explains what personal data we collect, why we collect it, how we use, share and protect it, and the rights you have over it.

2. Who this policy applies to

This policy applies to personal data we process about:

• customers, dealers and distributors who buy from us, including the individuals who act for a business customer;
• visitors to our website at tropicalseedscorp.com and users of our online ordering and payment facilities;
• people who contact us by telephone, email, WhatsApp or through our field sales representatives;
• suppliers, growers and other business contacts.

It does not cover the personal data of our employees, which is governed by our internal staff policies.

3. The information we collect

• Identity and contact details: your name, business or farm name, postal and delivery address, telephone and mobile numbers, email address and, where you open a trade or credit account with us, your National Identity Card number or business registration details.
• Order and transaction details: the products you order, quantities, prices, discounts, invoices, credit notes, delivery details, outstanding balances and payment history.
• Payment details: when you pay online, your payment is processed by PayHere (see section 6). We receive the payment reference, payment status, amount, payment method type and, for card payments, the card brand and last four digits only. We never receive or store your full card number, expiry date or security code.
• Communications: the content of your messages to us, call notes, complaints, and records of delivery or payment arrangements agreed with our representatives.
• Technical data: when you use our website, your IP address, browser and device type, the pages you visit and the date and time of your visit, collected through server logs and cookies (see section 9).
• Marketing preferences: whether you have agreed to receive product news, seasonal offers or agronomic advice from us, and by which channel.

We do not knowingly collect special categories of personal data (such as health, religion or ethnicity) and ask that you do not send us such information.

4. How we collect it

We collect personal data:

• directly from you, when you place an order, register an account, request a quotation, make a payment or contact us;
• from our field sales representatives and authorised dealers, who record orders and contact details on our behalf;
• from PayHere, when you complete an online payment;
• automatically, through cookies and server logs when you use our website;
• from publicly available sources and trade references, where we assess an application for a credit account.

5. Why we use your information and our legal basis

Under the PDPA we must have a lawful basis for each use of your personal data. We use it for the following purposes:

Where we rely on legitimate interest we have weighed it against your interests and rights and concluded that they do not override ours. You may object to such processing at any time (see section 12).

6. Online payments through PayHere

Online payments on our website are processed by PayHere (Pvt) Ltd ("PayHere"), a Sri Lankan payment service provider whose systems are certified to the Payment Card Industry Data Security Standard (PCI DSS).

When you choose to pay online you are taken to a secure page operated by PayHere, where you enter your card, bank or mobile wallet details. Those details are collected by PayHere directly and encrypted in transit. Tropical Seeds does not see, receive or store your full payment card details. PayHere shares with us only the information needed to confirm and reconcile your payment, as described in section 3.

PayHere processes your payment data as a separate controller under its own privacy policy, available at www.payhere.lk. We encourage you to read it.

Refunds and reversals of online payments are handled in accordance with our Refund and Return Policy, published alongside this policy, and are returned to the original payment method through PayHere.

7. Who we share your information with

We do not sell personal data. We share it only as follows:

• Affiliated companies: Opex Agrin (Pvt) Ltd and Opex Cultiva (Pvt) Ltd, which share administration, logistics, IT systems and sales support with us, under the same standards set out in this policy.
• Payment providers: PayHere, and the banks that settle payments, for the purposes described in section 6.
• Delivery and logistics partners: transport providers and couriers who deliver your orders and receive your name, delivery address and contact number.
• IT and cloud service providers: the providers that host our website, our enterprise resource planning (ERP) and customer management systems, email and messaging services, including the WhatsApp Business platform operated by Meta Platforms, Inc. where you choose to communicate with us on WhatsApp. These providers act on our written instructions.
• Professional advisers: our auditors, accountants, lawyers and insurers, where necessary.
• Regulators and public authorities: the Department of Inland Revenue, the Department of Agriculture and its Seed Certification Service, the National Fertiliser Secretariat, courts, law enforcement and other authorities, where the law requires or permits disclosure.
• A buyer or successor: if we sell, merge or reorganise our business, in which case the recipient will be bound by this policy.

8. Transfers outside Sri Lanka

Some of our service providers store or process data on servers located outside Sri Lanka, for example in cloud data centres in India, Singapore or the European Union. Where we transfer personal data outside Sri Lanka we do so in accordance with section 26 of the PDPA, relying on contractual safeguards with the recipient and on the destination providing an adequate level of protection, or on your consent where the law requires it. You may ask us for details of the safeguards in place.

9. Cookies

Our website uses cookies and similar technologies. Essential cookies are needed for the site to work, including keeping you signed in and passing your order to PayHere securely. Analytics cookies help us understand how the site is used so that we can improve it, and are set only with your consent where the law requires it. You can control cookies through your browser settings. Disabling essential cookies may prevent online ordering from working.

10. How long we keep your information

We keep personal data only for as long as we need it for the purposes above:

• Order, invoice, payment and account records: for at least the period required by Sri Lankan tax and company law (currently a minimum of five years from the end of the relevant year of assessment), and longer while a balance, claim or dispute remains open.
• Seed and fertiliser traceability records: for the period required by the applicable agricultural regulations.
• Enquiries and correspondence that did not lead to a sale: up to two years.
• Marketing preferences: until you withdraw consent, plus a short record that you did so.
• Website logs: up to twelve months.

When data is no longer needed we delete it or irreversibly anonymise it.

11. How we protect your information

We use technical and organisational measures appropriate to the risk, including encryption of data in transit (TLS), access controls that limit data to staff who need it for their work, secure cloud hosting with audit logging, and regular backups. Card payments are handled entirely on PayHere's PCI DSS-certified systems.

No system is completely secure. If we become aware of a personal data breach that is likely to harm you, we will notify the Data Protection Authority of Sri Lanka and, where required, you, as the PDPA requires.

12. Your rights

Under the PDPA you have the right to:

• be informed about how we process your data, which this policy does;
• access the personal data we hold about you and receive a copy of it;
• have inaccurate or incomplete data corrected;
• have your data erased where it is no longer needed, or where you withdraw consent and no other lawful basis applies;
• withdraw consent at any time where processing is based on consent, without affecting processing already carried out;
• object to processing based on legitimate interest, including direct marketing;
• not be subject to a decision based solely on automated processing that has a significant effect on you, and to ask for human review of such a decision.

To exercise any of these rights, contact us using the details in section 16. We may ask you to verify your identity. We will respond within the time limits set by the PDPA and will not charge a fee unless the law allows it. If you are unhappy with our response you may lodge a complaint with the Data Protection Authority of Sri Lanka.

13. Marketing and WhatsApp messages

We send product news, seasonal offers and agronomic advice by SMS, WhatsApp, email or post only where you have agreed to receive them or, for existing customers, where the law permits us to tell you about similar products. Every marketing message tells you how to stop receiving them, and you can opt out at any time by contacting us.

Transactional messages, such as order confirmations, delivery updates and payment receipts, are not marketing and will continue while you have an active order or account with us.

14. Children

Our products and services are supplied to businesses and to adults engaged in agriculture. Our website is not directed at children under 18 and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, please contact us and we will delete it.

15. Links to other websites

Our website may link to websites we do not control, including PayHere, banks and social media platforms. Their privacy policies, not ours, govern any data you provide to them.

16. How to contact us

• Data protection contact: Data Protection Contact, Tropical Seeds Corporation (Pvt) Ltd
• Post: Tropical Seeds Corporation (Pvt) Ltd, No. 74, Union Place, Colombo 02, Sri Lanka
• Email: [email protected]
• Telephone: +94 77 732 5877
• Business hours: Monday to Friday, 8.30 am to 5.00 pm

17. Changes to this policy

We may update this policy from time to time. The effective date at the top shows when it was last changed. Significant changes will be announced on our website and, where appropriate, sent to you directly. This policy is governed by the laws of Sri Lanka.