Third-Party Subprocessors
Last updated: October 26, 2026 · Effective Date: October 26, 2026
Commitment to Data Processing Transparency
Ishq Gems (Pvt) Ltd ("Ishq Gems", "we", "us", or "our"), registered in Sri Lanka under Registration No. PV00335214 and licensed by the National Gem and Jewellery Authority (License No. 20264DL38350), engages verified third-party service providers ("subprocessors") to assist in providing our luxury marketplace, escrow verification, and international gem export fulfillment services.
Before onboarding any subprocessor, we conduct rigorous security, regulatory, and legal due diligence. Each entity is bound by strict contractual Data Processing Agreements (DPAs) incorporating technical and organisational safeguards compliant with the Sri Lanka Personal Data Protection Act No. 9 of 2022 (PDPA), the General Data Protection Regulation (EU/UK GDPR), and applicable international trade laws.
1. Cloud Infrastructure & Core Database Providers
These subprocessors host the application code, manage encrypted database records, handle SSL termination, and protect platform availability against denial-of-service threats.
| Provider | Purpose | Data Processed | Location | Security Standard |
|---|---|---|---|---|
| Contabo GmbH | Core application server hosting and container runtime | Encrypted platform data, API requests, audit logs | European Union / Germany | ISO 27001, GDPR Compliant, SOC 2 Type II |
| MongoDB Atlas (AWS) | Primary multi-tenant encrypted database | User accounts, catalog listings, orders, disputes, verification records | EU (Frankfurt) / Asia Pacific | ISO 27001, SOC 2 Type II, HIPAA, PCI DSS |
| Redis Enterprise / Cloud | In-memory caching, rate limiting, and real-time bidding synchronization | Session tokens, temporary bid states, rate limit counters | European Union / Germany | SOC 2 Type II, ISO 27001 |
| Cloudflare, Inc. | Global DNS, edge caching, SSL/TLS 1.3 encryption, and DDoS defense | IP addresses, request headers, CDN-cached assets | Global Edge Network (285+ cities) | SOC 2 Type II, ISO 27001, PCI DSS Level 1 |
2. Payment Processing & Commercial Banking Partners
Ishq Gems never stores full credit or debit card numbers on our infrastructure. Card transactions are tokenized via Stripe, and commercial export bank wires are cleared through Nations Trust Bank PLC in accordance with Central Bank of Sri Lanka foreign exchange regulations.
| Provider | Purpose | Data Processed | Location | Security Standard |
|---|---|---|---|---|
| Stripe, Inc. | Card payment processing, 3D Secure 2.0 authentication, fraud detection | Billing contact details, card token identifiers (full card numbers never reach Ishq Gems) | United States & Global | PCI DSS Level 1 Service Provider |
| Nations Trust Bank PLC | Official commercial export bank wire transfers (TT) and escrow remittance settlement | Export invoice numbers, buyer remitter reference, settlement amounts in USD/LKR | Sri Lanka (Bandarawela & Colombo) | Licensed Commercial Bank regulated by Central Bank of Sri Lanka (CBSL) |
3. Statutory Gem Clearance, Marine Insurance & Armored Couriers
Every international parcel fulfilled through Ishq Gems is legally inspected and wax-sealed by the Sri Lanka National Gem and Jewellery Authority (NGJA), insured under our marine export policy with SLIC General, and transported via secure, signed-for couriers.
| Provider | Purpose | Data Processed | Location | Security Standard |
|---|---|---|---|---|
| National Gem and Jewellery Authority (NGJA) | Statutory gemstone testing, valuation, export sealing, and customs certification | Gemstone specifications, weight, origin, lab certificates, export invoice details | Colombo, Western Province, Sri Lanka | Statutory Authority under National Gem and Jewellery Authority Act No. 50 of 1993 |
| Sri Lanka Insurance Corporation General Ltd (SLIC) | Marine cargo export insurance coverage for verified gemstone shipments | Export invoice number, consignment sum insured, insured party details | Colombo, Sri Lanka | Insurance Regulatory Commission of Sri Lanka (IRCSL) Registered Underwriter |
| FedEx Express / Malca-Amit / DHL Express | Secure international armored logistics and trackable courier delivery | Recipient shipping name, delivery address, phone, customs consignment manifest | Worldwide Destination Countries | Authorized Economic Operator (AEO), C-TPAT, Global Secure Courier Standards |
4. Media CDN, Communications, Error Diagnostics & OCR
Specialized service providers used for delivering high-resolution gem imagery, automated certificate OCR verification, transactional customer emails, and diagnostic bug tracking.
| Provider | Purpose | Data Processed | Location | Security Standard |
|---|---|---|---|---|
| Cloudinary Ltd. | High-definition gemstone macro photography and 360-degree video delivery | Product media assets, lab certificate scans, watermarked intake photos | United States & EU Edge CDN | ISO 27001, SOC 2 Type II, GDPR Compliant |
| Resend, Inc. / Nodemailer SMTP | Transactional email delivery (order confirmations, KYC alerts, shipping updates) | User email addresses, notification subjects, transactional email content | United States & European Union | SOC 2 Type II, GDPR Compliant |
| Sentry (Functional Software, Inc.) | Application error monitoring, performance diagnostics, and crash analysis | Technical stack traces, browser user-agent, sanitized error diagnostics (no PII) | United States | SOC 2 Type II, ISO 27001, Privacy Shield / DPA |
| AWS Textract / Ishq OCR Service | Automated optical character recognition for gemological lab certificates (GIA, GRS, NGJA) | Scanned certificate images to extract report numbers and carat measurements | EU (Frankfurt) / Contabo Private Cloud | ISO 27001, SOC 2 Type II (No model training on customer data) |
Role-Based Marketplace Privacy Shield
In adherence to our strict privacy architecture, sellers on Ishq Gems never receive access to a buyer's personal email address, phone number, full legal name, or billing details. Conversely, buyers interact solely with verified store names and trade license credentials. All cross-party communications, logistics coordination, and dispute mediations are securely facilitated through the Ishq Gems platform.
None of our technology or AI OCR subprocessors are permitted to train generalized models on customer documentation, identification records, or gemstone lab certificates.
Subprocessor Updates & Notifications
As our marketplace evolves, we may update this list to reflect new service providers or retire existing ones. In the event of any material change that impacts the processing of personal data, registered account holders will be notified with at least thirty (30) calendar days prior notice via email or a prominent notification within their dashboard.
For inquiries regarding data processing agreements or cross-border data transfer safeguards, contact our Data Protection Officer at privacy@ishqgems.com.