Who is the controller of your data

The data controller for personal data collected through truenatura.com is Harker International (Private) Limited, registered in Sri Lanka (Registration No. PV 00338032), with its principal office in Kandy, Sri Lanka. For all data-protection inquiries, write to info@harker.international.

What this notice covers

This notice describes:

• Why we process your personal data (the “lawful bases”)
• The rights you have under GDPR (the “data subject rights”)
• How to exercise those rights with us
• Your right to complain to a supervisory authority

For a full account of what data we collect, how we use it, who we share it with, and how long we keep it, see our Privacy Policy.

Lawful bases for processing

We rely on the following lawful bases under Article 6 of the GDPR:

Your rights under GDPR

If you are in the EEA or the UK, you have the following rights with respect to your personal data:

1. Right of access (Art. 15)

You can ask for a copy of the personal data we hold about you, together with information about how and why we process it.

2. Right to rectification (Art. 16)

You can ask us to correct any inaccurate or incomplete data we hold about you.

3. Right to erasure / “right to be forgotten” (Art. 17)

You can ask us to delete your personal data, subject to legal exceptions. We cannot delete order, invoice, and tax records before the 7-year statutory retention period — but we can anonymise the customer-identifying portions on request.

4. Right to restriction of processing (Art. 18)

You can ask us to suspend processing of your data while a dispute is resolved — for example, if you’ve contested the accuracy of the data we hold.

5. Right to data portability (Art. 20)

You can ask us to provide your personal data in a structured, machine-readable format (CSV or JSON) so you can transfer it to another service.

6. Right to object (Art. 21)

You can object to processing based on legitimate interests — including direct-marketing processing — at any time. For direct marketing, the easiest way is to click “unsubscribe” in any marketing email.

7. Right to withdraw consent (Art. 7(3))

Where we rely on your consent (for marketing emails or analytics cookies), you can withdraw consent at any time. Withdrawal doesn’t affect the lawfulness of processing carried out before withdrawal.

8. Rights related to automated decision-making (Art. 22)

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. Fraud screening uses a combination of automated signals (IP reputation, address verification) and human review for any case that affects an order.

How to exercise your rights

Email info@harker.international with the subject line “Data Subject Request”. Please include:

• The right you wish to exercise (access, rectification, erasure, etc.)
• The email address associated with your True Natura account (so we can locate your data)
• Any specific data or order references your request concerns

We may ask you to verify your identity before acting on a request, particularly for access or erasure. We respond to all requests within 30 days. If your request is unusually complex, we may extend by a further two months and will tell you why.

Exercising any of these rights is free. We may charge a reasonable fee or refuse manifestly unfounded or excessive requests.

Right to complain to a supervisory authority

If you believe we have mishandled your data, you have the right to lodge a complaint with your local data protection authority. We’d appreciate the chance to address your concerns first, but you can always go directly to:

• UK: Information Commissioner’s Office (ICO) — ico.org.uk
• Ireland: Data Protection Commission — dataprotection.ie
• EU member states: see the EDPB member list for your country’s authority

International transfers

True Natura’s website and database are hosted on servers located in the United States (Hostinger International Limited). Order processing also takes place in Sri Lanka, and payment processing is handled by Stripe (US). Where we transfer your personal data from the EEA or UK to the United States, we rely on the EU–US Data Privacy Framework and the European Commission’s Standard Contractual Clauses (SCCs), with supplementary measures where required by the Schrems II decision. Transfers from the EEA/UK to Sri Lanka are made under SCCs; Sri Lanka is not the subject of a current EU adequacy decision.

Changes to this notice

We may update this notice from time to time as the law evolves or our practices change. The “Last updated” date at the top of the page reflects the most recent revision.