Privacy & Data
Protection Notice

This Notice applies to all individuals who visit our website at www.cblnaturalfoods.com, submit enquiries, download resources, or otherwise interact with our digital services. It governs personal data collected both directly and automatically through web technologies.

This Notice does not extend to employees, contractors, or job applicants of CBL Natural Foods, who are subject to separate internal data protection policies.

As a business-to-business platform, we limit data collection to what is proportionate and strictly necessary. We do not process special categories of personal data.

Information You Provide Directly

• Full name and professional title
• Business email address
• Company or organisation name
• Business telephone number
• Country and region of operation
• Substance of your enquiry or message

Data Collected Automatically

• IP address (anonymised where required)
• Browser type, version, and language
• Operating system and device classification
• Pages visited and navigation sequence
• Date, time, and duration of visit
• Referring URL or search engine

Where the GDPR or UK GDPR applies, every processing activity is grounded in one or more of the following lawful bases:

Legitimate Interests — Article 6(1)(f)

Applied to B2B communications, website security, and fraud prevention. We conduct Legitimate Interests Assessments to verify these interests are balanced against individual rights.

Consent — Article 6(1)(a)

Required for non-essential cookies. Consent is freely given, informed, and withdrawable without detriment at any time.

Contractual Necessity — Article 6(1)(b)

Applied where you have initiated pre-contractual steps, such as requesting a formal commercial proposal.

Legal Obligation — Article 6(1)(c)

Applied where processing is required to comply with tax, regulatory, or judicial obligations.

California residents are afforded specific rights under the CCPA as amended by the CPRA. The following disclosures are made in compliance with these statutes.

Categories Collected

• Identifiers

  — name, business email, IP address, device identifiers

• Commercial Information

  — product and service enquiry details

• Internet Activity

  — browsing history, interaction data, referring URLs

• Professional Information

  — job title, employer name, business contact details

Your California Rights

• Right to Know

  — request disclosure of personal information collected about you

• Right to Delete

  — request erasure of personal information we hold

• Right to Correct

  — request correction of inaccurate personal information

• Right to Non-Discrimination

  — we will not penalise you for exercising these rights

CBL Natural Foods is headquartered in Sri Lanka and is subject to the Personal Data Protection Act No. 9 of 2022.

• Lawfulness & Purpose Limitation

  — data collected only for explicitly stated and lawful purposes

• Data Minimisation

  — only data strictly necessary for each purpose is collected

• Accuracy

  — reasonable steps are taken to maintain data accuracy

• Storage Limitation

  — retained only as long as necessary per our schedule

• Integrity & Confidentiality

  — appropriate technical and organisational safeguards are in place

• Accountability

  — records of processing activities are maintained

We do not sell, rent, or trade personal data. Recipients are limited to:

• Cloud Infrastructure

  — Microsoft Azure (corporate tenant)

• Web Analytics

  — Google Ireland Limited, under DPAs incorporating SCCs

• IT Service Partners

  — under contractual confidentiality obligations

• Legal & Professional Advisers

  — where necessary for legal proceedings

• Regulatory & Judicial Authorities

  — where required by law or court order

Personal data may be transferred internationally in the ordinary course of our global operations. Where transfer restrictions apply, we rely on:

• Standard Contractual Clauses

  — 2021 EC modular clauses or UK IDTA

• Adequacy Decisions

  — where the destination is formally recognised as adequate

• Cloud Security Frameworks

  — Azure and Google operate under ISO 27001 and SOC 2 with embedded SCCs

We implement a layered security architecture comprising:

• TLS/SSL encryption for all data transmitted to and from the Website
• Microsoft Azure enterprise cloud security with RBAC and tenant-level identity management
• Network-level protections: firewalls, DDoS mitigation, intrusion detection
• Strict need-to-know access controls for all personnel
• Regular vulnerability scanning, patch management, and security assessments

This Website is designed exclusively for business professionals. It is not directed towards individuals under 16. We do not knowingly collect personal data from minors. If you believe a minor has submitted data, contact us at privacy@cblnaturalfoods.com immediately.

Our Website may contain hyperlinks to third-party websites. This Notice does not govern those external sites. We accept no responsibility for their privacy practices. Review the privacy notice of any external site before submitting personal information.

• Internal detection and escalation within 24 hours
• Risk assessment to determine nature, scope, and consequences
• Supervisory authority notification within 72 hours where required
• Communication to affected individuals where high risk to rights and freedoms exists
• Full documentation and post-incident review to prevent recurrence

We reserve the right to amend this Notice from time to time. The current version is always available on this page with the effective date and version number. Where amendments are material, we will take reasonable steps to notify you.