Privacy Policy
How UPR collects, uses, stores, protects and manages personal data when you visit our website, contact us or make an enquiry.
- Effective date
- 06th October 2026
- Last updated
- 06th October 2026
1 Introduction
Welcome to UPR — Using Plastic Responsibly.
At UPR, we believe that responsibility extends beyond how materials are designed, manufactured, used and managed. It also applies to how information is collected, used and protected.
This Privacy Policy explains how UPR collects, uses, stores, protects and manages personal data when you visit or interact with our website, contact us, submit an enquiry, request information, or otherwise communicate with us through our digital channels.
UPR is connected with Polydime Plastics (Pvt) Ltd and reflects a broader approach to responsible plastics, innovation, manufacturing and sustainability.
For the purposes of this Privacy Policy, “UPR,” “we,” “us” or “our” refers to the entity responsible for the relevant processing activity, as applicable. Depending on the nature of an enquiry, product, service or business relationship, personal data may be processed by UPR, Polydime Plastics (Pvt) Ltd, or another relevant associated entity.
This Privacy Policy should be read together with our Terms & Conditions.
2 Our commitment to privacy
We respect your privacy and are committed to handling personal data responsibly, transparently and securely.
This Privacy Policy is intended to explain:
- what personal information we may collect;
- how we collect it;
- why we use it;
- how we protect it;
- when it may be shared;
- how long we may retain it;
- your rights regarding your personal data; and
- how you can contact us about privacy-related matters.
We aim to collect and use personal data only where there is a legitimate reason to do so and in accordance with applicable data protection and privacy laws.
For users in Sri Lanka, this includes the Personal Data Protection Act No. 9 of 2022, as amended from time to time. Sri Lanka’s Data Protection Authority identifies the PDPA as the country’s principal framework regulating the processing of personal data and protecting the rights of data subjects.
3 Who is responsible for your personal data?
The entity responsible for personal data processing may depend on how and why your information is collected.
UPR is connected with Polydime Plastics (Pvt) Ltd. Where an enquiry, commercial relationship, product request or other interaction relates directly to Polydime Plastics (Pvt) Ltd, that entity may process your personal data for the relevant purpose.
Where appropriate, UPR and Polydime Plastics (Pvt) Ltd may work together in responding to enquiries, managing business communications, providing information, supporting customers or carrying out related business activities.
The appropriate entity responsible for a particular processing activity may therefore depend on the nature of your interaction with us.
- Data controller / responsible entity
- Polydime Plastics Industries Pvt Ltd
- Registered / business address
- No 122, Stratford Avenue, Colombo 5, Sri Lanka
- Privacy contact email
- info@polydime.com
- Telephone
- +94 777 306 412
4 What personal data may we collect?
The information we collect depends on how you interact with UPR.
This may include:
Information you provide directly
When you contact us, submit a form, request information or communicate with us, we may collect:
- name;
- company or organisation name;
- job title or professional role;
- email address;
- telephone or mobile number;
- business address;
- country or location;
- information contained in your enquiry;
- product or service interests;
- information relating to your business requirements; and
- any other information you voluntarily provide.
Website and technical information
When you visit our Website, certain technical information may be collected automatically, depending on the Website’s configuration and technologies in use.
This may include:
- IP address;
- browser type;
- device type;
- operating system;
- language preferences;
- pages visited;
- approximate interaction times;
- referring website or source;
- website activity;
- device identifiers; and
- other technical or usage information.
Not all of these categories will necessarily be collected in every interaction.
5 How do we collect personal data?
We may collect personal data through:
- website contact forms;
- enquiry forms;
- email communications;
- telephone or other direct communications;
- business meetings and correspondence;
- requests for product or technical information;
- applications or submissions made through the Website;
- cookies and similar technologies;
- analytics and website performance tools, where enabled; and
- other lawful business interactions.
We may also receive relevant business contact information from companies, professional networks, business partners or other lawful sources where appropriate.
6 How do we use your personal data?
We may use personal data for legitimate business and operational purposes, including to:
- respond to enquiries;
- provide requested information;
- communicate about products, technologies and solutions;
- understand customer and business requirements;
- provide technical or commercial information;
- arrange meetings or discussions;
- manage potential or existing business relationships;
- respond to requests submitted through the Website;
- improve Website functionality and user experience;
- understand how visitors use our Website;
- maintain Website security;
- detect and prevent misuse, fraud or security incidents;
- maintain business records;
- comply with legal and regulatory obligations;
- protect our rights and legitimate interests; and
- perform other purposes that are reasonably connected to your interaction with us.
Where you request information about a product, technology or solution associated with Polydime Plastics (Pvt) Ltd, your information may be shared with the relevant internal team or associated entity so that your request can be appropriately handled.
7 Legal basis for processing personal data
Where applicable, we process personal data on a lawful basis recognised under applicable data protection legislation.
Depending on the circumstances, this may include:
- your consent;
- taking steps at your request before entering into a contract;
- performing a contract or providing a service;
- complying with a legal or regulatory obligation;
- protecting legitimate business interests; or
- other lawful grounds available under applicable law.
The appropriate legal basis will depend on the nature and purpose of the processing.
Where consent is relied upon, you may have the right to withdraw that consent, subject to applicable law and any legitimate consequences of doing so.
8 Business and commercial enquiries
UPR operates in a business-to-business environment involving plastics, packaging, manufacturing, technology and related industrial solutions.
If you contact us regarding a product, technology, quotation, partnership, manufacturing requirement or other business opportunity, we may process information necessary to evaluate and respond to your request.
This may include your:
- name;
- company;
- professional position;
- contact details;
- product requirements;
- technical requirements;
- estimated quantities;
- intended application;
- location or market; and
- other information relevant to your enquiry.
Where necessary, we may share this information with the appropriate UPR or Polydime Plastics (Pvt) Ltd team so that the enquiry can be handled by the appropriate person.
9 Marketing communications
Where permitted by applicable law, we may use your contact information to send relevant business, product, technology, industry or company communications.
This may include information about:
- new products or technologies;
- packaging and material solutions;
- company developments;
- industry insights;
- events;
- announcements; and
- other information that may reasonably be relevant to your business interests.
Where applicable, you will be given an opportunity to opt out of marketing communications.
You may also contact us at any time to request that your information no longer be used for direct marketing, subject to applicable legal requirements.
11 Website analytics
We may use analytics technologies to understand how visitors interact with our Website and to improve its performance.
Depending on the tools implemented on the Website, information may include:
- pages visited;
- time spent on pages;
- navigation patterns;
- device and browser information;
- approximate geographic information;
- referral sources; and
- technical information.
The specific analytics services used may change over time.
Where third-party analytics providers are used, their processing may also be subject to their own privacy policies and terms.
13 Who may receive your personal data?
We may disclose personal data where reasonably necessary for the purposes described in this Privacy Policy.
This may include disclosure to:
- authorised employees and representatives;
- relevant departments within UPR;
- Polydime Plastics (Pvt) Ltd, where relevant;
- professional advisers;
- technology and hosting providers;
- website and IT service providers;
- analytics or communication service providers;
- logistics or operational service providers, where applicable;
- legal, regulatory or governmental authorities where required; and
- other service providers acting on our behalf.
Where third parties process personal data on our behalf, we aim to use appropriate contractual, organisational and technical measures to protect that information.
We do not disclose personal data to unrelated third parties for their own purposes unless permitted or required by applicable law or otherwise appropriately authorised.
14 International data transfers
Some of our technology, hosting, communication, analytics or other service providers may operate outside Sri Lanka.
Where personal data is transferred, stored or processed outside Sri Lanka, we will seek to do so in accordance with applicable data protection requirements and any applicable restrictions relating to cross-border processing.
The safeguards applied may depend on the service provider, type of data, purpose of processing and applicable law.
15 How long do we keep personal data?
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by applicable law.
Retention periods may depend on:
- the nature of the information;
- the purpose for which it was collected;
- whether an ongoing business relationship exists;
- legal, regulatory or contractual requirements;
- legitimate business requirements; and
- the need to establish, exercise or defend legal claims.
When personal data is no longer required, we will take reasonable steps to securely delete, anonymise or otherwise dispose of it, subject to applicable legal or operational requirements.
16 How we protect your personal data
We take reasonable technical and organisational measures to protect personal data against:
- unauthorised access;
- accidental loss;
- unlawful disclosure;
- alteration;
- misuse;
- destruction; and
- other unauthorised processing.
Security measures may include access controls, authentication, secure systems, restricted access to information and other safeguards appropriate to the nature of the information and associated risks.
However, no website, electronic communication system or method of storing information can be guaranteed to be completely secure.
You should therefore avoid submitting highly sensitive or confidential information through ordinary Website forms unless specifically requested through an appropriate secure channel.
17 Your data protection rights
Subject to applicable law and any relevant conditions or exemptions, you may have rights regarding your personal data.
These may include rights relating to:
- access to personal data;
- correction or updating of inaccurate information;
- deletion or erasure in applicable circumstances;
- restriction or objection to certain processing;
- withdrawal of consent where processing is based on consent;
- receiving information about certain processing activities; and
- other rights provided under applicable data protection law.
The exact scope and manner in which these rights may be exercised will depend on the applicable legal framework and circumstances.
Sri Lanka’s PDPA establishes rights for data subjects and regulates the responsibilities of entities processing personal data.
18 How to exercise your rights
If you would like to request access to, correction of, deletion of, or other action concerning your personal data, please contact us using the details below.
- Privacy contact
- info@polydime.com
- Address
- No 122, Stratford Avenue, Colombo 5, Sri Lanka
Please provide sufficient information to allow us to identify your request and locate the relevant personal data.
We may need to verify your identity before processing certain requests, particularly where disclosure of personal information is involved.
We will handle valid requests in accordance with applicable legal requirements.
19 Children’s privacy
The Website is primarily intended for businesses, professionals and general adult audiences.
We do not knowingly seek to collect personal data from children through the Website.
If you believe that a child has provided personal data to us without appropriate consent or authorisation, please contact us so that we can assess the matter and take appropriate action.
20 Third-party websites
The Website may contain links to third-party websites, platforms or services.
We are not responsible for the privacy practices, content, security or data processing activities of third-party websites.
Once you leave the UPR Website, the privacy policy of the relevant third party will apply.
We recommend reviewing the privacy policy of any third-party website before providing personal information.
21 Data breaches and security incidents
If we become aware of a personal data breach or security incident involving personal data, we will assess the incident and take appropriate steps in accordance with applicable law.
Depending on the circumstances, this may include:
- investigating the incident;
- containing and mitigating the impact;
- securing affected systems;
- assessing risks to individuals;
- maintaining appropriate records;
- notifying relevant authorities where legally required; and
- communicating with affected individuals where required or appropriate.
We do not guarantee that security incidents can always be prevented, but we are committed to responding responsibly when they occur.
22 Data relating to Polydime Plastics (Pvt) Ltd
Because UPR is connected with Polydime Plastics (Pvt) Ltd, certain enquiries or interactions may involve both UPR and Polydime Plastics (Pvt) Ltd.
For example, where you request information relating to manufacturing capabilities, packaging solutions, material technologies or products associated with Polydime Plastics (Pvt) Ltd, your enquiry may be directed to or shared with the relevant Polydime team.
Only information reasonably necessary to handle the relevant enquiry or business activity should be shared for this purpose.
The entity responsible for processing your information may depend on the nature of the interaction and the service or product concerned.
23 Confidential business information
A Privacy Policy concerns the handling of personal data and should not be interpreted as an agreement to protect all information submitted through the Website as confidential business information.
If you have commercially sensitive, proprietary or confidential technical information, please contact us before submitting it.
Where a separate confidentiality or non-disclosure agreement applies, that agreement will govern the treatment of the relevant confidential information.
24 Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in:
- applicable privacy and data protection laws;
- regulatory requirements;
- our business activities;
- Website functionality;
- technologies and service providers;
- data processing practices; or
- our privacy and security practices.
When we make changes, we will publish the updated Privacy Policy on this page and revise the “Last Updated” date.
We encourage you to review this page periodically to remain informed about how we handle personal data.
25 Governing law
This Privacy Policy shall be governed by and interpreted in accordance with the applicable laws of Sri Lanka, unless mandatory applicable law provides otherwise.
Where applicable, personal data processing will be subject to the requirements of Sri Lanka’s data protection framework, including the Personal Data Protection Act No. 9 of 2022, as amended from time to time.
The Data Protection Authority of Sri Lanka is responsible for regulating personal data processing and safeguarding data subjects’ privacy under the country’s data protection framework.
26 Contact us about privacy
If you have questions, concerns or requests regarding this Privacy Policy or the way your personal data is handled, please contact us.
- Entity
- UPR — Using Plastic Responsibly, connected with Polydime Plastics (Pvt) Ltd
- Privacy contact
- info@polydime.com
- Telephone
- (+94) 777 306 412
- Address
- No 122, Stratford Avenue, Colombo 5, Sri Lanka
- Website
- www.upr.lk
When contacting us, please include “Privacy Request” in the subject line where appropriate.
27 Our privacy principle
At UPR, Using Plastic Responsibly is about more than materials.
It is about taking responsibility for the decisions we make, from the materials we develop and the products we manufacture to the information entrusted to us by the people and businesses we work with.
Your personal data deserves the same principle: collected responsibly, used responsibly and protected responsibly.
12 Social media and third-party platforms
UPR may maintain or link to social media profiles and other third-party platforms.
If you interact with us through platforms such as LinkedIn, Facebook, Instagram, YouTube or other services, the relevant platform may independently collect and process your personal data.
Your use of those platforms is governed by their respective privacy policies and terms.
We do not control the privacy practices of third-party platforms and recommend reviewing their policies before submitting personal information through those services.