1. General

Your privacy is important to us and we are committed to responsibly handling your personal data taking all reasonable steps to protect your information from misuse and to keep it secure in compliance with the Privacy Act 1988 (“Privacy Act”) and the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”).

2. About CEYLON TÉYILAI TEA (tēyilai tea)

We operate websites, platforms and applications that facilitate the ordering of food and/or beverages from our tea factory, and tēyilai tea shop businesses (each a “Venue” and together “ Venues”) who directly supply food and/or beverages to you.

From time to time, we may provide or facilitate other ancillary services to end customers and/or to Venues, including by connecting Venues and end customers with third party delivery services (“Delivery Providers”).

3. Consent

Your consent to this Privacy Policy is the legal basis upon which we can collect, use, store, process and disclose your personal information.

You acknowledge and agree that:

• by clicking on the “I Agree” field (or any similar field or link designated to indicate your acceptance of this Privacy Policy) and using our Services, you are consenting to providing us with your personal information and agree to your personal information being collected, stored, used, processed and disclosed in accordance with this Privacy Policy; and
• you have had a sufficient opportunity to access and review this Privacy Policy and you have read and agreed to its terms.

If you do not wish to provide personal information to us, then you are not obliged to do so. However, please be aware that this will affect your use of any and all websites, platforms, applications, products or services (“Services”) offered by us.

We reserve the right to review, amend, update or change this Privacy Policy from time to time to reflect our practices and obligations under the law. Any changes will take effect when they are made or posted on our website, platform or application and you are electronically notified of the same.

4. Scope

This Privacy Policy applies to:

• all personal information that is collected, stored, used, processed and disclosed by us when you use our Services;
• the use of personal information that is collected, stored, used, processed and disclosed when you participate in our events, promotions or contests or otherwise interact with us (eg through social media); and
• how we process your personal information, who we might share it with and what controls and rights you have in respect of it.

how we process your personal information, who we might share it with and what controls and rights you have in respect of it.

5. Personal Information we collect

Personal information has the meaning given to it under your local data protection laws and generally means information which relates to an individual who can be identified from that information.

Where practicable, we will give you the option of interacting with us anonymously or using a pseudonym. Generally, though, to provide you with the Services you have requested, it is necessary for us to collect personal information from you.

The personal information that we collect from you may include:

• full name (including any previous name(s));
• address(es) (including any previous address(es));
• date of birth;
• email address;
• telephone number(s);
• credit/debit card details (including card type, card number, security number and expiry date);
• social media account details (including social media profiles and URL details);
• information on your dietary requirements and preferences; and
• other personal information that you agree to provide to us.

From time to time you may have the option to participate in surveys or other activities intended to improve the Services offered by us which may involve providing additional personal information. Your participation in such activities is subject to your consent.

In some cases, the personal information that we collect from you may include personal information that is considered to be sensitive information under your local data protection laws (eg your allergies). We will only collect sensitive information in compliance with the local data protection laws and/or with your consent and/or where it is reasonably necessary for or directly related to the Services that you have requested from us. To the extent permitted by the local data protection laws you consent to us collecting that sensitive information for the purpose for which it was collected and being stored, used, processed and disclosed as set out in this Privacy Policy.

6. How we collect your Personal Information

We will only collect personal information through lawful and fair means and not in any unreasonably intrusive way. The ways we collect personal information include:

• where you expressly provide this information to us;
• from your interactions with us and/or our personnel (including feedback), including by telephone, text message, e-mail, social media, and in person;
• from your use of our Services;
• from the electronic devices you may use to access our Services (including information collected from your browser’s cookies); and
• from your participation in surveys, reviews, contests or marketing promotions.

Whenever possible, we will collect your personal information directly from you. However, in some situations, we may also collect your personal information from a third party (eg a family member or other agent or representative).

By providing your personal information to a third party, you will be deemed to have authorised that third party to provide your personal information to us. We will rely on the authority of that third party and you will be deemed to have consented to your personal information being collected by us and being stored, used, processed and disclosed as set out in this Privacy Policy.

If you use our Services on behalf of another person, you agree that you have obtained that person’s authority to provide the personal information and their consent for us to collect, store, use, process and disclose their personal information in accordance with this Privacy Policy. You should let us know immediately if you become aware that your personal information has been provided to us by a third party without your consent or if you did not obtain consent before providing another person’s personal information to us.

Where we receive unsolicited personal information, we will determine, within a reasonable period of time, whether or not we would be permitted to collect that personal information. Where we are not permitted to do so, we will destroy that personal information or ensure it is de-identified as soon as practicable. Otherwise, we may collect, store, use, process and disclose that personal information in accordance with the terms of this Privacy Policy.

7. How we use your Personal Information

We use your personal information for the purpose for which it was provided to us, related purposes, purposes for which you consent, and as otherwise required or permitted by the local data protection laws. Such purposes include:

• facilitating the Services that you have requested;
• notifying a Venue and/or Delivery Partner in respect of any order you make using the Services;
• provision of information about any Services provided by us that may be relevant to you;
• responding to your enquiries;
• to identify you when you log into tēyilai online or otherwise contact us;
• processing payments you have authorized; and
• any other purposes identified at the time of collecting your personal information.

In addition, you permit us to use your personal information:

• where you have consented to the use or disclosure;
• where we reasonably believe that use or disclosure is necessary to lessen or prevent a serious, immediate threat to someone's health or safety or the public's health or safety;
• where we reasonably suspect that unlawful activity has been, is being or may be engaged in and the use or disclosure is a necessary part of our investigation or in reporting the matter to the relevant authorities;
• where we reasonably believe that use or disclosure is necessary for the prevention, investigation, prosecution and punishment of crimes or wrongdoings or the preparation for, or conduct of, proceedings before any court or tribunal (or the implementation of orders of a court or tribunal or on behalf of an enforcement body);
• to develop and improve our (and our related entities’) business, products and services;
• in servicing our relationship with you by creating and maintaining a customer profile or presenting options that we think may interest you based on your browsing and preferences and on your past use of the Services;
• to involve you in market research, gauging customer satisfaction and seeking feedback;
• to facilitate your participation in loyalty programs;
• for research and analysis in relation to our (and our related entities’) business, products and services; and
• for our internal accounting and administration.

Where permitted by local data protection laws, we may use your personal information to send you targeted electronic marketing and promotional communications related to our Services (and those of third parties) that we think may interest you, unless you have requested not to receive such information. We will only use your personal information for targeted electronic marketing and promotional communications if you have consented to it (which consent may be express or, where permitted by local data laws, inferred). You can opt out of receiving any targeted electronic marketing or promotional communications by following the unsubscribe prompt provided in the communication.

8. When we disclose to third parties

By using our Services and/or by providing us with your personal information (or allowing another person to do so), you acknowledge and consent to us disclosing some or all of your personal information to third parties in accordance with this Privacy Policy and in accordance with local data protection laws. This includes disclosure of your personal information and details:

• to Venues for the purposes of facilitating the food and/or beverage order you have placed as well as for marketing and promotional activities undertaken by the Venues;
• to Delivery Providers for the purposes of delivering your order (where the Venue offers delivery functionality and you request delivery);
• to payment service providers for any payments you make via the Services (we use a third party payment service provider that is required to take reasonable steps to protect your information);
• to our contractors, suppliers and service providers including without limitation:
• suppliers of IT based solutions that assist us in providing products and services to you;
• distributors of electronic marketing and promotional communications;
• marketing, market research, research and analysis and communications agencies; and
• external business advisers;
• to our related brands and or to a potential related party (or prospective investor);
• to a person that uses the Services on your behalf and/or a person you have authorised;
• in accordance with requirements or authorisations under applicable laws or to comply with our legal obligations; and
• to any other persons contemplated by this Privacy Policy.

From time to time, we may also provide summarised or aggregate, non- personal data to third parties for business research, internal marketing to existing Venues and Delivery Partners and/or external marketing purposes (including but not limited to recruiting new Venues and Delivery Partners or exploring other ancillary opportunities).

Without your consent, we will not disclose your personal information to any third party (except for those described above), unless such disclosure is required by local data protection laws or the GDPR and/or where we reasonably believe that it is necessary to lessen or prevent a threat to life, health or safety or for action to be undertaken by an enforcement body, or where allowed to do so in accordance with the local data protection laws.

9. How we disclose to third parties

At all times, with respect to the disclosure of your information to third parties described in clause 8, the third parties that we disclose your personal information to:

• are required to provide GDPR compliant services;
• must take reasonable steps, to our satisfaction, to ensure that personal information disclosed by us is protected against misuse, interference, loss and unauthorized access, modification and disclosure;
• must ensure that each of its employees who access, use or disclose personal information are aware of and comply with the obligations under this Privacy Policy when they are accessing, using or disclosing the personal information; and
• must, if they become aware of any misuse, interference, loss, or unauthorized access, modification or disclosure of personal information disclosed by us, immediately notify us.

To the maximum extent provided by the relevant laws, we are not responsible or liable for the protection and privacy of any personal information which is provided to third parties. This means that, where your personal information has been disclosed, you accept and agree that the disclosed personal information will be held by third parties and may be used by them in accordance with the Privacy Act and any privacy policy they may have and in such circumstances, the third party recipient will be solely responsible for their use of this personal information.

10. Overseas disclosure

We may disclose your personal information to our related bodies corporate and external service providers located overseas for some of the purposes listed in this Privacy Policy, including by disclosing information to our data hosting and Cloud-based IT service providers and other external service providers located in the United States of America. Where we do so, we take the steps referred to under clause 12 to ensure that the overseas recipients of your personal information do not breach the privacy obligations relating to your personal information.

11. Information Processing

Processing your personal information is lawfully undertaken by us:

• in accordance with your consent;
• by necessity for the performance of a contract to which you are a party or in taking steps for your entry into that contract;
• to comply with our legal obligations;
• for our legitimate interests and the legitimate interests of third parties,except where such interests are overridden by your interests or yourfundamental rights and freedoms requiring the protection of yourpersonal information subject to this Privacy Policy.

12. Storage and Security

We take all reasonable and lawful steps to keep personal information secure, accurate and up to date and only retain your personal information for as long as reasonably required to satisfy the purpose for which they were collected and used (unless a longer period is necessary for our legal obligations or to defend a legal claim). This means that:

• personal information is stored on secure servers if in digital format, or in locked areas if in hardcopy format and these repositories are protected in controlled facilities (in some cases, these facilities may be located offshore and/or in cloud-based servers that have represented to us that they are GDPR compliant);
• our employees and data processors are obliged to respect the confidentiality of any personal and/or sensitive information or data;
• we only permit authorised personnel to access your information; and
• we ensure all personal details are de-identified and transferred anonymously before any information, which is stored securely, is provided to external organisations for data analysis or disclosed to any third parties (except where that disclosure is directly contemplated by this Privacy Policy.

We will take reasonable steps to protect your personal information as you transmit your information from your electronic device to us and to protect such information from loss, misuse, and unauthorised access, use, modification, disclosure, alteration, or destruction. However, electronic transmission of information is never completely secure or error-free. As a result, while we strive to protect users' personal information, we cannot ensure or warrant the security of any information electronically transmitted by a user, and users provide their personal information at their own risk. To the maximum extent provided by the relevant laws, we are not responsible or liable for the electronic transmission of personal information to us or to third parties.

13. Cookies and Geolocation Statement

A cookie is a small data file that is placed on your computer or mobile device when you visit a website. Website owners widely use cookies in order to make their websites work, or to work more efficiently, as well as to provide reporting information. We and our third party providers use cookies to:

• personalise your visit to any websites operated by us (as a cookie allows a web server to 'remember' visitors on subsequent visits without having to prompt them for information previously supplied. A cookie can also remember Venues and items (including food and/or beverages) previously viewed by a site visitor);
• provide information about us to you while you browse; and
• obtain non-identifying information about your demographic group and general interests.

Additionally, when you use our Services, we may collect information about the location from which that use occurred (this will be in accordance with the settings of your particular device). This location data may be used by us for the purposes of personalising messaging and or offers.

You may elect to disable cookies and/or geolocation sharing at any time. In such circumstances, you may still be able to utilise some of our Services (however, some functionality may be limited).

14. Your Data Protection Rights

• Access: You have the right to request we provide you with a copy of personal information that we have collected from you. We may charge you a small fee for this service.
• Rectification: You have the right to request we correct, amend or update any personal information you believe is inaccurate or incomplete.
• Account Closure: If you have created an account with us, we will delete that account upon your request or within a reasonable time thereafter.
• Erasure: You have the right to request that we erase or destroy your personal information in certain circumstances, including where you withdraw your consent, where your data is no longer required for collection purposes or where your personal information has been unlawfully processed;
• Restrict Processing: You have the right to request that we restrict the processing of your personal information under certain conditions, including where processing is inconsistent with the reason for which the personal information was collected.
• Object to Processing: You have the right to object to us processing your personal information under certain circumstances, including the right to object to profiling, automation and direct marketing.
• Data Portability: You have the right to request we transfer the personal information we have collected to another organization or directly to you, under certain circumstances.
• Legitimate Interests: To the extent that we are relying on our legitimate interests to use your personal data, you also have the right to object to such use (unless we can either demonstrate compelling legitimate grounds for the use that override your interests, rights and freedoms, or where we need to process the data for the establishment, exercise or defence of legal claims).
• Responses: Without undue delay and not later than within a month, we will respond to your request to invoke your rights consistent with applicable law.
• Revocation: You may revoke your consent for receiving marketing communications at any time, free of charge by following the instructions in any marketing communication. You can also control these preferences in your profile settings. We will then stop applying the research results to you at an individual level and will stop sending you marketing communications.
• Questions: In case you have a question or complaint about how tēyilai tea processes your personal information, you can contact us by email. Alternatively, you may consider lodging a complaint with a supervisory data protection authority.

15. Complaints

Formal complaints about a breach of this Privacy Policy must be made in writing. We reserve the right to request any supporting evidence and/or information to substantiate the complaint/breach.

We will refer your complaint to the responsible officer at CEYLON TÉYILAI TEA, who will investigate the issue and determine the steps we will undertake to resolve your complaint. We will contact you if we require any additional information from you and will notify you in writing of the determination in relation to your complaint.

If you are not satisfied with our determination, you can contact us to discuss your concerns or make a formal complaint.

16. Other Websites

The Services we operate may contain links to other websites (" Third Party Links"). We do not endorse such Third Party Links and are not responsible for any content contained therein. If you decide to access any Third Party Links, you do so entirely at your own risk.

17. Social Media

From time to time, our Services may utilise social media integrations and functionality. Where, these social media functions are incorporated into our Services, the features may be hosted and/or operated by a third party social media operator. By using this functionality, you agree and accept that we (and if applicable, the third party operator) may collect information with regard to your use of that functionality.

Additionally, where you have an account with a third party social media operator, you acknowledge that the third party operators may combine or integrate your use of our Services with your account.

In some circumstances:

• the third party social media operators may share information with us in accordance with their own privacy policies; and
• we may share your information with third party social media operators for the purposes of facilitating the service of targeted advertisements and marketing.

18. How to contact us

If you have any questions or concerns about this Privacy Policy or its implementation, or wish to contact us in relation to your data protection rights, you may contact:

CEYLON TÉYILAI TEA’s Privacy Officer:

Mailing address: 36 Cromwell Road, Camberley, GU15 4HY England. Telephone: +44 7498 775 203 or +48 579 358 361 / +90 555 361 0033. Email: info@teyilaitea.com