Privacy Policy

Effective date: 15-Oct-2026

Last updated: 15-Oct-2026

1. Who we are

This Privacy Policy explains how Silvermill Natural Beverages (Pvt) Ltd collects, uses, stores and protects personal information when you visit www.silvermillgroup.com (the “Website”) or contact us through it.

Silvermill Natural Beverages (Pvt) Ltd is a company incorporated in Sri Lanka. It operates the Website for itself and for the companies of the Silvermill Group (together, “Silvermill”, “we”, “us” or “our”). For the purposes of applicable data protection law, Silvermill Natural Beverages (Pvt) Ltd is the controller of personal information collected through the Website.

Registered address: Silvermill Natural Beverages (Pvt) Ltd, 148/1, Kynsey Road, Colombo 08, Sri Lanka.
Privacy contact: [email protected]

The Website is informational. It does not sell products, take payments or offer user accounts. This policy applies only to the Website and to communications that start from it. It does not apply to third-party websites that we link to.

We process personal information in line with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka (as amended), and, where they apply to you, other data protection laws such as the EU and UK General Data Protection Regulation (GDPR) and the privacy laws of US states including California.

2. Information we collect

We collect only the information needed to answer your inquiry and to run the Website. You can browse the Website without giving us your name or contact details.

Source	Information	Required?
Contact Us form	Name, country, contact details (email address and/or telephone number), product(s) of interest, and anything you write in your message	Name, country and one contact detail are required to reply
Inquiries page and emails to [email protected]	Your name, email address, company or organisation, signature details, the content of your message and any attachments you choose to send	Only what you choose to send
Automatically, when you use the Website	IP address, approximate location (country/city, derived from IP), browser and device type, operating system, referring page, pages viewed, time and date of visit, and cookie identifiers	Collected automatically; see Section 4 to control cookies
Spam and abuse protection (Google reCAPTCHA)	Device and browser characteristics, mouse and keyboard interaction data and IP address, used to tell humans from bots	Needed to submit forms

Please do not send us sensitive personal information through the Website, such as health details, financial account numbers, government identity numbers, or information about religion, ethnicity or political views. We do not ask for it and do not need it to answer business inquiries.

If you send us personal information about another person (for example, a colleague to copy on a reply), please make sure you are allowed to share it.

3. How we use your information and why

We use personal information only for Silvermill’s internal business purposes and to communicate directly with you. We do not use it to make automated decisions that have legal or similarly significant effects on you.

Purpose	Information used	Legal basis
Reply to your inquiry and give you the product or company information you asked for	Contact form and inquiry details	Steps taken at your request before a possible contract; our legitimate interest in answering business inquiries
Pass your inquiry to the right Silvermill business or sector so it can reply	Contact form and inquiry details	Legitimate interest in handling inquiries efficiently
Keep an internal record of inquiries for follow-up during the retention period	Contact form and inquiry details	Legitimate interest
Keep the Website secure and block spam, fraud and abuse	Technical data, reCAPTCHA data	Legitimate interest in security
Understand how the Website is used and improve its content	Analytics cookies and technical data	Your consent, where the law requires it
Measure our LinkedIn and Meta (Facebook/Instagram) campaigns and show relevant Silvermill content on those platforms	Advertising cookies and pixel data	Your consent, where the law requires it
Meet legal obligations and protect our legal rights	Any relevant information	Legal obligation; legitimate interest

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You may object at any time (see Section 10).

We will not send you marketing newsletters or promotional campaigns unless you ask us to or give your consent. Replies to your own inquiry are not marketing.

4. Cookies and third-party tools

Cookies are small text files placed on your device. Similar technologies include pixels, tags and scripts.

We use them in four categories:

Category	Tools	What they do	Can you refuse?
Strictly necessary	Website hosting, cookie-consent tool, Google reCAPTCHA	Deliver pages, remember your cookie choices, protect forms from spam	No, the Website needs them to work
Analytics	Google Analytics, loaded through Google Tag Manager	Count visits and show which pages are used, in aggregate	Yes
Advertising and measurement	Meta Pixel; LinkedIn Insight Tag	Measure the effect of our posts and campaigns and let us show Silvermill content to Website visitors on Meta and LinkedIn	Yes
Embedded content	YouTube videos; Google Maps	Play videos and show our locations; Google may set cookies when you view or play them	Yes

Google Tag Manager itself does not set cookies. It loads the other tools on this list.

Your choices. When you first visit, a cookie banner lets you accept, reject or customise non-essential cookies. Where the law requires consent (for example, in the EU, UK and Sri Lanka), we do not load analytics, advertising or embedded-content cookies until you agree. You can change your choice at any time through the “Cookie settings” link in the Website footer. You can also block or delete cookies in your browser settings, and opt out of Google Analytics with Google’s browser add-on.

Third-party providers. Google, Meta and LinkedIn collect data through these tools under their own privacy policies and may combine it with other data they hold about you. We do not control that processing.
Please see:

We use YouTube’s privacy-enhanced mode where available. The Website does not currently respond to browser “Do Not Track” signals. We do honour Global Privacy Control (GPC) signals as an opt-out of advertising cookies.

5. Who we share it with

We do not sell, rent or trade your personal information, and we do not give your contact details to other companies for their own marketing. Information you submit through the Website is used for Silvermill’s internal reference and to communicate with you directly.

We share personal information only in these limited cases:

Silvermill Group companies. Your inquiry may go to the Silvermill company or sector best placed to answer it, including our operations in Sri Lanka, Indonesia and India. They may use it only to respond to you.
Service providers who work for us. These include Amazon Web Services (AWS), which hosts the Website and its database, and our email service provider. They process data only on our instructions, under contract, and may not use it for their own purposes.
Cookie and analytics providers. If you accept analytics or advertising cookies, Google, Meta and LinkedIn receive the data described in Section 4. Under some US state laws, allowing advertising cookies may count as “sharing” personal information for cross-context behavioural advertising. You can opt out through “Cookie settings” or a Global Privacy Control signal.
Legal and safety reasons.We may disclose information if required by law, court order or a competent authority, or to protect the rights, property or safety of Silvermill, our employees or others.
Business changes. If a Silvermill business is reorganised, merged or sold, personal information may pass to the successor, which must protect it under this policy.

6. International transfers

Silvermill is based in Sri Lanka, and the Website receives visitors from around the world. Your information may therefore be transferred to, stored in or accessed from countries other than your own. This includes Sri Lanka, the country where our AWS data centre is located ([AWS region, e.g. Asia Pacific (Singapore)]), and the countries where our Group companies and service providers operate. Data protection laws in these countries may differ from those where you live.

When we transfer personal information across borders, we use safeguards required by applicable law. These include contractual commitments such as the European Commission’s Standard Contractual Clauses (and the UK addendum) with service providers, and any safeguard instruments specified by the Data Protection Authority of Sri Lanka. Contact us for more information about these safeguards.

7. How we protect your information

We store information submitted through the Website in a database on our web server hosted by Amazon Web Services. We use technical and organisational safeguards appropriate to the risk. These include:

encryption of data in transit (HTTPS/TLS) and at rest in the database;
access limited to authorised Silvermill staff who need it to handle inquiries, protected by strong authentication;
network security controls, security monitoring and regular patching;
logging of administrative access; and
an information security programme and incident response procedures run by Silvermill’s IT and Information Security team.

No website or internet transmission is completely secure, so we cannot guarantee absolute security. If a personal data breach is likely to put your rights at risk, we will notify you and the relevant authorities as the law requires.

8. How long we keep it

We keep inquiry and contact form information for no longer than six (6) months from the date we receive it. We then delete it or anonymise it permanently. This applies to the Website database and to emails received at [email protected].

There are two exceptions:

if your inquiry leads to a business relationship, the information you have given us will be handled under the terms of that relationship; and
if we must keep information longer to meet a legal obligation or to establish, exercise or defend a legal claim, we keep it only as long as that requires.

Cookie lifetimes vary by provider and are shown in the cookie settings panel. Analytics data is retained in Google Analytics for [14] months.

9. Age requirement

The Website is meant for businesses and adults. It is not directed at anyone under 18 years of age. You must be 18 or older to submit information through the Website. We do not knowingly collect personal information from anyone under 18. If you believe a minor has sent us information, please contact us and we will delete it.

10. Your rights

Depending on where you live, you may have the right to:

access – the personal information we hold about you and get a copy;
correct – inaccurate or incomplete information;
delete – your information (“right to be forgotten”);
restrict – or object to our use of it, including use based on legitimate interests;
withdraw consent – at any time, for example by changing cookie settings, without affecting earlier processing;
receive your data – in a portable format, where applicable;
opt out of the “sale” or “sharing” of personal information for targeted advertising (US state laws). We do not sell personal information. To opt out of sharing, reject advertising cookies or use a Global Privacy Control signal; and
complain – to a data protection authority, such as the Data Protection Authority of Sri Lanka, the supervisory authority in your EU country, or the UK Information Commissioner’s Office.

To exercise any of these rights, email [email protected] with the subject line “Privacy Request”. We may ask you to confirm your identity before acting. We will reply within one month. Where the law allows, we may extend this by up to two further months for complex requests, and we will tell you why. We will not treat you differently for exercising your rights.

11. Changes to this policy

We may update this Privacy Policy to reflect changes to the Website, our practices or the law. The “Last updated” date at the top shows when it last changed. If we make significant changes, we will show a notice on the Website.

12. Contact us

If you have questions about this Privacy Policy or how we handle your information, please contact:

Silvermill Natural Beverages (Pvt) Ltd.
148/1, Kynsey Road, Colombo 08, Sri Lanka.
Email: [email protected]

13. Governing law

This Privacy Policy is governed by the laws of the Democratic Socialist Republic of Sri Lanka. Any dispute about it shall be resolved by arbitration in Colombo, Sri Lanka, as set out in our Terms and Conditions. This does not affect your right to complain to a data protection authority or any rights you have under the mandatory data protection laws of your country of residence.