Privacy Policy

1. About this notice

TEXRO operates this garment-accessory sourcing website. This notice explains information used when you browse, prepare a sourcing brief, contact a director or use the private content-administration service. It describes services currently implemented.

2. Who is responsible and how to contact us

The site identifies the business as TEXRO PVT LTD. [Business confirmation required: exact legal controller name and business address]. [Business confirmation required: dedicated privacy contact email and responsible person or team]. Until confirmed, contact a director using the telephone and WhatsApp methods on our Contact page and identify your message as a privacy enquiry. Do not send identity documents or sensitive information in your initial request.

3. Information used by this website

Browsing. The server receives information needed to deliver pages and assets, such as IP address, request URL, browser headers and request time. The supplied hosting configuration enables access logging. [Business confirmation required: live hosting and logging arrangements].

Sourcing brief. Your answers stay in this page until you select Send request. That action sends your selected material, market, support request, name, company, email, optional phone number and requirement text through AWS to Ravi, Sanjaya and Manjula at TEXRO LANKA, so they can respond. The customer email is included in the message and used as its reply address. The form does not save answers to browser storage. Refreshing clears unsent answers.

Direct contact. Choosing a telephone or WhatsApp link opens the relevant communications service. If you then call or send a message, TEXRO receives information you provide, such as contact details and sourcing requirements. WhatsApp handles its own data under its privacy terms. An external-link click can disclose technical information to the destination before a message is sent.

Cookie choices. The public website stores category choices, a decision, timestamp and policy/schema versions in this browser. It does not assign a visitor identifier or transmit a consent log to TEXRO.

Private administrators. The separate CMS processes staff names, email addresses, roles, protected password credentials, second-factor and recovery credentials, optional passkey details, sign-in/session information, IP and browser details, content changes and security audit records. Authorised staff can upload images and descriptions for publication. Locally recovered editor text is stored only when staff enable draft recovery.

There is no public newsletter subscription, recruitment form, visitor file upload, analytics, advertising tag, tracking pixel, third-party embedded media or automated visitor profiling in this implementation. Please avoid unnecessary sensitive personal information in correspondence and content uploads.

4. How information is collected

Information comes directly from browser requests, interface choices, communications you choose to send and authorised staff's use of the CMS. Fonts, videos, models and bundled images are served from this website. Published images may contain people; editors should confirm an appropriate basis for publication.

5. Purposes

• Deliver resources and keep the website working.
• Prepare and deliver the sourcing request you choose to send, and enable TEXRO to respond.
• Respond to communications you choose to send to a director.
• Remember and apply cookie preferences.
• Authenticate staff, protect administrator access, prevent misuse, manage content and record security-relevant activity.

No visitor analytics or advertising processing is configured. Offline customer correspondence and subsequent supplier communications need [Business confirmation required: enquiry handling, recipients and business recordkeeping].

6. Processing grounds

Optional consent-requiring technologies, if introduced, remain disabled until you allow their category. Remembering a requested cookie choice and securing a staff sign-in serve those specific requested functions.

Responding to enquiries may involve steps at your request before a contract; website delivery and security may involve legitimate operational interests, subject to applicable law and appropriate assessment. [Legal review required: confirm grounds for each business and administrator activity, legal obligations and applicability of overseas regimes]. Accepting cookies is not consent to every use of information or to marketing communications.

7. Cookies and similar technologies

Read the Cookie Policy for the inventory and durations. Use Cookie Settings on this page or in the footer to review or change browser choices. No public analytics or advertising services are currently installed.

8. Recipients and services

The hosting operator processes requests and may hold logs. [Business confirmation required: hosting provider, operating location, IT support access and processor arrangements]. The CMS stores information in this application's database; no external CMS SaaS integration is configured.

WhatsApp is an external destination when you choose its link. Telephone links open your device's calling service. Sourcing requests are delivered using Amazon Simple Email Service (SES) to ravi@texrolanka.com, sanjaya@texrolanka.com and manjula@texrolanka.com. The configured AWS region is Sydney (ap-southeast-2); the recipient mail providers also process the message. Subsequent correspondence uses the recipients' email services.

Private administrator password checks can query Have I Been Pwned's Pwned Passwords service. The server sends a five-character prefix of a password hash and receives possible matches; it does not send the password or full hash. The check can be disabled in server configuration. The service also receives server connection metadata. Public visitors do not use it.

9. Processing outside Sri Lanka

External communications and the administrator password-check service may process information outside Sri Lanka. Actual hosting locations, recipients, contracts and transfer safeguards cannot be established from the application alone. [Business/legal confirmation required: locations, international transfers and applicable safeguards].

10. Retention

The submission service stores request references, content hashes and hashed network addresses for duplicate prevention and rate limiting, with expiry times of up to 24 hours; AWS removes expired records asynchronously. It does not store the enquiry body in its database or application logs. The delivered email remains in the recipients' mailboxes under TEXRO's correspondence retention policy [Business confirmation required: retention period]. Operational application logs expire after 14 days.

Cookie settings are valid for 180 days and removed when an expired record is next read. A private sign-in session has an eight-hour overall limit and fifteen-minute inactivity limit; an intermediate sign-in cookie lasts up to ten minutes. Access expiry is not deletion of every related security record.

Local editor drafts remain until save, discard, sign-out, disabling recovery or browser deletion, without automatic time expiry. The supplied backup script defaults to fourteen-day pruning of dated database snapshots but keeps the latest snapshot and separately copied uploads. It does not define retention for every data type or backup system.

[Business confirmation required: approved retention and deletion schedules for correspondence, hosting logs, accounts, audit/security records, uploads and backups]. Information should be retained only for its appropriate purpose and applicable obligations.

11. Security

The application includes access controls, protected credentials, second-factor sign-in and security checks. The supplied production configuration supports encrypted connections. Actual hosting and organisational safeguards require confirmation. No website or communications channel is guaranteed completely secure.

12. Rights and requests

Depending on the law in force, its application to the processing and relevant exceptions, you may be able to request access, correction, deletion or object to processing. Withdrawal is available for processing relying on consent. Restriction, portability and additional protections may be available where another applicable regime, such as the GDPR, grants them.

Sri Lanka's Personal Data Protection Act, No. 9 of 2022 has been amended by Act No. 22 of 2025. Rights and procedures must be assessed against applicable commencement orders and rules. This notice does not assert that every provision or overseas regime applies to every visitor.

Use the contact in section 2 or ask a director through the Contact page, describing the request and your connection to TEXRO. Proportionate information may be needed to verify identity. [Business/legal confirmation required: request-handling process, contact and applicable deadlines]. Contact the relevant authority where applicable law provides a complaint route; see the Sri Lanka Data Protection Authority.

13. Children

This is a business sourcing website, not a service designed for children. It does not operate a child registration service. If a child's personal information has been supplied unnecessarily, contact us for review. No unsupported age threshold is imposed here.

14. Other websites

External websites and communications services have their own privacy practices. Our cookie settings do not control a service after you leave this website.

15. Updates

The last-updated date appears above. Revised text will be published here. Material changes to consent-requiring technologies or the consent version will request a fresh browser choice. [Business confirmation required: additional communication of significant privacy changes].