Privacy Policy

This Privacy Policy applies to all individuals whose personal data is collected or processed by the Company, in the course of its business operations, including but not limited to:
• Visitors to our websites and digital platforms
• Existing and prospective customers
• Vendors, service providers, contractors, and business partners
• Applicants and candidates engaged through recruitment processes
• Any other individual whose personal data is processed by the Company

This Privacy Policy governs personal data collected through various channels, including:
• Online interactions, such as our websites, digital platforms, advertising channels, email communications, and telephone-based services.
• Offline interactions, including branch visits, physical documentation, paper-based applications, and in-person engagements.
• Third-party sources, including publicly available databases, business partners, and social media platforms, where such collection is permitted under applicable law
This Policy further extends to personal data processed in connection with recruitment activities, customer complaints, inquiries, and feedback mechanisms.

The following definitions are provided to facilitate a clear understanding of this Privacy Policy and the data protection activities carried out by the Company:
• “Personal Data” – any information relating to an identified or identifiable natural person, whether living or deceased, who can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to such individual.
• “Processing” – any operation or set of operations performed on personal data, whether by automated means or otherwise, including but not limited to collection, recording, organization, structuring, storage, preservation, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, restriction, erasure, or destruction.
• “Special Categories of Personal Data” – personal data that is of a sensitive nature and requires a higher level of protection, including but not limited to data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, genetic data, biometric data used for the purpose of uniquely identifying an individual, health-related data, data concerning a person’s sex life or sexual orientation, data relating to criminal offences or convictions, and personal data relating to a child, as defined under the applicable provisions of the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka (“PDPA”).
• “Data Subject” – an identified or identifiable natural person to whom the personal data relates.
• “Data Controller” – the natural or legal person, public authority, agency, or other body which,alone or jointly with others, determines the purposes and means of the processing of personal data.

The Company may collect and process the following categories of personal data in connection with its business operations, in compliance with the Act.
a) Recruitment-Related Data In the course of recruitment and talent acquisition processes, we may collect and process:
• Identification and contact details
• Educational and professional qualifications
• Employment history and references
• Interview records, evaluations, and assessment outcomes
• Special Categories of Personal Data strictly where necessary (e.g., health-related data for statutory compliance or workplace accommodations) Such data shall be processed solely for the purposes of candidate assessment, recruitment decisionmaking, onboarding, and compliance with applicable employment laws and regulations.

b) Marketing and Business Development Data For the purposes of marketing, business development, and customer engagement activities, we may collect and process:
• Identification and contact details
• Communication preferences (including preferred communication channels, frequency, content types, opt-in/opt-out choices, and language or format preferences)
• Records of interactions relating to promotions, events, after-sales services, and market research activities
All marketing communications shall be conducted in accordance with applicable legal and regulatory requirements, and consent shall be obtained where required under law.

c) Customer Complaints and Customer Care Data In connection with the handling of customer complaints and customer care services, we may collect and process:

• Identification and contact details
• Complaint-related information and supporting details
• Transaction-related data
• Records of communications (including emails, telephone calls, and written correspondence)
• Special Categories of Personal Data, where relevant and strictly necessary for the investigation and resolution of the complaint
Such data shall be processed solely for the purposes of receiving, investigating, responding to, and resolving customer complaints, and improving service quality and customer experience.

The Company shall process personal data strictly in accordance with the provisions of the Act, and only where such processing is lawful, fair, and necessary for specified and legitimate purposes.

• Consent: Where the data subject has provided clear, informed, and explicit consent for the processing of their personal data for one or more specified purposes.
• Contractual Necessity: Where processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into such a contract.
• Legal Obligation: Where processing is necessary for compliance with a legal or regulatory obligation to which the Company is subject under applicable laws.
• Legitimate Interests: Where processing is necessary for the purposes of the legitimate interests pursued by the Company or a third party, provided that such interests are not overridden by the fundamental rights and freedoms of the data subject.
• Employment and Regulatory Requirements: Where processing is necessary for the purposes of employment-related obligations, public interest functions, or regulatory compliance, as permitted under the PDPA and other applicable laws.
• Special Categories of Personal Data: Special categories of personal data shall be processed only where explicitly permitted under the Act or other applicable laws, and subject to the implementation of appropriate safeguards and enhanced protection measures.
The Company shall ensure that all processing activities are carried out in a manner that is adequate,
relevant, and limited to what is necessary in relation to the purposes for which the personal data is
processed.

In the course of the data subject’s interaction with the Company’s websites and digital platforms, the Company may collect and process certain categories of personal data to ensure the effective operation, security, and continuous improvement of its online services.
Such data may include:
• Information voluntarily provided by the data subject, including personal data submitted through website forms, enquiries, registrations, or other online communications
• Technical and usage-related information, including Internet Protocol (IP) address, browser type and version, device characteristics, operating system, and details of interaction with the website (such as pages visited, navigation patterns, and usage behaviour)
• Cookies and similar technologies, including cookies, web beacons, and other tracking mechanisms used to enhance user experience, analyze website performance, and support functionality

All personal data collected through website and online interactions shall be processed in accordance with applicable laws, including the Personal Data Protection Act, and in a manner that ensures appropriate security, confidentiality, and integrity. Where required under applicable law, the Company shall obtain the data subject’s consent prior to the use of cookies or similar tracking technologies.

The website uses cookies and similar tracking technologies to enhance user experience, analyze website traffic, and improve the functionality and performance of its services.
Cookies are small text files placed on a user’s device. While cookies do not typically identify individuals directly, they may collect certain technical and usage-related information, including:
• Device and Technical Information – such as IP address, browser type, operating system, and device identifiers
• Website Usage Information – including pages visited, time spent on pages, and navigation paths
• Session and Functional Data – such as language preferences, regional settings, and other userselected configurations Such information is collected and processed for purposes including website administration,
performance monitoring, analytics, and the enhancement of user experience, in accordance with applicable laws, including the Personal Data Protection Act.
The Data Subject may control or disable cookies through their browser settings at any time.

However, restricting or disabling cookies may affect the availability or functionality of certain features of the website.

Where required by applicable law, consent will be obtained prior to the use of non-essential
cookies.

The Company operates Closed-Circuit Television (CCTV) systems within its premises for purposes of ensuring security, safeguarding property and assets, and maintaining the safety of employees, visitors, and other individuals.

The processing of personal data through CCTV surveillance is carried out on the basis of the Company’s legitimate interests, in accordance with applicable laws, including the Personal Data Protection Act.

CCTV footage may capture images and related information of individuals within monitored areas and shall be used solely for security, safety, and incident investigation purposes. Access to such footage is strictly limited to authorized personnel on a need-to-know basis.

All CCTV recordings are retained only for a limited period, in accordance with the Company’s data retention policies, after which they are securely deleted or overwritten, unless required for the
establishment, exercise, or defense of legal claims or for compliance with legal obligations.

The Company will take reasonable steps to ensure that Personal Data processed is accurate,complete, and kept up to date for the purposes for which it is processed. Data Subjects are responsible for promptly notifying the Company of any changes or updates to their Personal Data.

The Company may disclose or share personal data strictly on a need-to-know basis, with the following categories of recipients:

• Internal departments of the Company, including but not limited to Finance, Sales, Operations, Information Technology, Compliance, and Legal.
• Other companies within the Company’s group, subsidiaries, or affiliated entities, where necessary for business operations or administrative purposes.
• Third-party service providers and data processors engaged by the Company, including but not limited to information technology service providers, logistics and distribution partners, payment processors, external consultants, professional advisers, auditors, and legal advisers.
• Banks, financial institutions, payment service providers, and insurance providers, where required for financial transactions and risk management.
• Customers, clients, or business partners, where necessary for the performance of contractual obligations and service delivery.
• Regulatory authorities, statutory bodies, governmental authorities, or other competent legal authorities, where such disclosure is required or permitted under applicable laws.

The Company shall ensure that any disclosure of personal data is subject to appropriate contractual, technical, and organizational safeguards to protect personal data against unauthorized access,
disclosure, alteration, or destruction.

The Company does not sell, lease, rent, or otherwise commercially disclose personal data to third parties for marketing or promotional purposes.
The Company may update the categories of recipients with whom personal data is shared from time to time and will communicate such updates where required.

Where Personal Data is transferred outside Sri Lanka, the Company shall ensure that such transfers are carried out in compliance with the requirements of the Act. The Company shall implement appropriate safeguards and transfer mechanisms to ensure that the recipient affords a level of protection to the Personal Data that is not less than that required under the Act.

Personal Data shall be retained by the Company only for as long as is necessary to fulfil the purposes set out in this Privacy Notice and to comply with applicable legal, regulatory, and contractual obligations.

In determining the appropriate retention period, the Company shall consider, inter alia:

• applicable statutory and regulatory retention requirements, including but not limited to tax, accounting, and other commercial laws;
• the duration of the business relationship;
• the Company’s legitimate interests in maintaining records;
• the necessity of retaining personal data for the establishment, exercise, or defense of legal claims; and
• the enforcement of contractual rights and the resolution of disputes.
Upon the expiry of the applicable retention period, Personal Data shall be securely deleted or destroyed, or irreversibly in accordance with the Company’s records management and data retention policies and in compliance with applicable data protection laws.

The Company shall implement and maintain appropriate technical and organizational measures to ensure the security and integrity of personal data, having regard to the nature of the data and the risks associated with its processing.
Such measures shall include, inter alia, access controls, secure information systems, confidentiality
obligations imposed on authorized personnel, and periodic monitoring and review mechanisms, in order to prevent unauthorized or unlawful access, disclosure, alteration, loss, or destruction of personal data, in accordance with applicable data protection laws.

Subject to the provisions and limitations set out in the Act, data subjects shall have the following rights in relation to their personal data:

• The right to request access to personal data held by the Company.
• The right to request the correction or rectification of inaccurate or incomplete personal data.
• The right to request the erasure of personal data, where such erasure is legally permissible.
• The right to object to, or request the restriction of processing, in certain circumstances as provided under the Act.
• The right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out prior to such withdrawal; and
• The right to lodge a complaint with the Data Protection Authority of Sri Lanka.
• Be informed about data processing activities
• Request safeguards against automated decision-making and profiling

Any request by a data subject to exercise the rights set out above shall be submitted in writing to the Company’s Data Protection Officer using the contact details provided in this Notice. The Company shall acknowledge and respond to such requests in accordance with the requirements, procedures, and timeframes prescribed under the Act.

Where a data subject believes that his or her rights under the Personal Data Protection Act, No. 9 of 2022 have been infringed or violated, the data subject shall first notify the Company’s Data Protection Officer in writing to enable the Company to review, investigate, and take appropriate remedial action.

If the matter remains unresolved or the data subject is not satisfied with the response provided by the Company, the data subject may lodge a complaint with the Data Protection Authority of Sri Lanka in accordance with the provisions of the Act.

For any inquiries, requests, or complaints relating to the processing of personal data, data subjects may contact the Company’s designated Data Protection Officer:

Mr. Sugath Rathnasiri
E B Creasy & Co. PLC, No. 98, Sangaraja Mawatha, Colombo 10.
e-mail: [email protected] | Mobile: 077 766 0357 | Phone: +94 112421311 | Extension 207