Privacy Policy for LeafLine

Effective date: 30 June 2026
Last updated: 30 June 2026

1. Introduction

This Privacy Policy explains how Ceylon Tea Brokers PLC ("Ceylon Tea Brokers", "we", "us", or "our") collects, uses, stores, and protects information when you use the LeafLine mobile application ("the App").

LeafLine is the Ceylon Tea Brokers seller platform. It provides authenticated access to tea auction, valuation, financial, and related business information for authorised factory owners, estate representatives, and Ceylon Tea Brokers staff.

By downloading, installing, or using the App, you agree to this Privacy Policy. If you do not agree, please do not use the App.

2. Who This Policy Applies To

This policy applies to users who have been granted an account to access LeafLine, including:

• Factory owners and authorised estate representatives
• Ceylon Tea Brokers administrative and support users

The App is intended for business use by authorised adults. It is not directed at children under the age of 18.

3. Information We Collect

3.1 Account and authentication information

When you sign in or manage your account, we may collect and process:

• Username
• Password (processed for authentication; not stored by the App in plain text)
• One-time password (OTP) codes submitted during identity verification
• Phone number associated with your account (used for OTP delivery and account recovery)
• Password reset and temporary-password change details

3.2 Profile and access information

After authentication, we may collect and display:

• User ID
• Full name
• Email address (if provided on your account)
• Phone number (if provided on your account)
• Assigned roles and permissions
• Linked factory / tenant associations
• Selected active factory context within the App

3.3 Business and operational information

When you use the App, we retrieve business information associated with your authorised account, such as:

• Dashboard summaries
• Auction, acknowledgement, valuation, price detail, and unsold tea data
• Sales information
• Financial information, including loans, advances, claims, invoices, and credit notes
• Factory listings and related broking data

This information relates to your authorised business relationship with Ceylon Tea Brokers and the factories linked to your account.

3.4 Information stored locally on your device

The App stores certain information locally on your device using secure on-device storage, including:

• Access and refresh authentication tokens
• Cached profile details needed for App operation
• Your selected active factory
• Session-related preferences required to keep you signed in

3.5 Technical information

When you use the App, standard technical information may be processed as part of communication between the App and our servers, such as API request and response data required to provide App functionality and device and network information ordinarily transmitted when making secure internet connections.

We do not use the App to collect precise location data, contacts, photos, camera content, microphone recordings, or biometric data.

4. How We Use Information

We use the information described above to:

• Authenticate users and verify identity through OTP
• Provide secure access to authorised business data
• Enforce role-based access and permissions
• Allow users to switch between authorised factories or tenants
• Maintain session security and refresh authentication tokens
• Support password reset and temporary password change workflows
• Operate, maintain, secure, and improve the App and related services
• Comply with legal, regulatory, and contractual obligations

We do not use the App for behavioural advertising, sale of personal data, or unrelated marketing profiling.

5. How Information Is Shared

We do not sell your personal information.

We may share information only in the following circumstances:

• Within Ceylon Tea Brokers PLC — with staff and systems that need the information to operate the App and provide broking services
• Service providers — with trusted infrastructure or technology providers that host or support the App and related backend services, subject to appropriate confidentiality and security obligations
• Legal requirements — where required by applicable law, regulation, legal process, or governmental request
• Protection of rights — where necessary to protect the rights, safety, property, or security of Ceylon Tea Brokers, our users, or others

The App does not integrate third-party advertising SDKs or third-party analytics SDKs for tracking purposes.

6. Data Storage and Security

• Authentication tokens and selected session data are stored on your device using secure storage mechanisms provided by the mobile platform.
• Account, authentication, and business data are processed through Ceylon Tea Brokers-controlled backend services accessed over encrypted connections.
• We apply administrative, technical, and organisational measures designed to protect information against unauthorised access, loss, misuse, or alteration.

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security.

7. Data Retention

We retain information only for as long as necessary to:

• Provide the App and related services
• Maintain account security and auditability
• Meet legal, regulatory, and business record-keeping requirements

When information is no longer required, we delete or anonymise it in accordance with our retention practices, unless a longer retention period is required or permitted by law.

Locally stored App data is removed when you sign out or uninstall the App, subject to platform behaviour and any residual secure storage retained by the operating system.

8. Your Choices and Rights

Depending on applicable law, you may have rights to:

• Request access to personal information we hold about you
• Request correction of inaccurate information
• Request deletion or restriction of processing, where applicable
• Object to certain processing, where applicable
• Withdraw consent where processing is based on consent

Because LeafLine is a business application for authorised users, some requests may need to be handled through your account administrator or Ceylon Tea Brokers support.

To make a privacy request, contact us using the details in Section 12.

9. International Processing

Your information may be processed on servers or systems located outside your country of residence. Where this occurs, we take steps designed to ensure that appropriate safeguards are in place in accordance with applicable data protection requirements.

10. Third-Party Services and Links

The App communicates with Ceylon Tea Brokers backend services to deliver its functionality. The App does not embed third-party advertising networks or consumer analytics trackers.

If we provide links to external websites or documents, those third-party services are governed by their own privacy policies. We are not responsible for the privacy practices of third-party websites or services.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this document. If changes are material, we may provide additional notice within the App or through other appropriate channels.

Continued use of the App after an updated policy becomes effective constitutes acceptance of the revised policy, unless applicable law requires otherwise.

12. Contact Us

If you have questions about this Privacy Policy or our handling of information, contact:

Ceylon Tea Brokers PLC
481 T. B. Jayah Mawatha
Colombo 10
Sri Lanka

Email: general@ceylonteabrokers.com
Phone: +94 11 460 7777
Website: https://ceylonteabrokers.com