Who Do We Share Your Information With?

The types of parties are listed below:

• our Agents, Contractors and Contracted service providers (i.e. technology service providers and cloud storage providers)

• authorized representatives who sell or arrange products and services on our behalf

• Insurers, Mortgage Insurers, Re-Insurers and Health-Care Assurance providers

• Payment Systems Operators (for example, merchants receiving card payments)

• other Business Partners, who jointly with us, provide products or services to you

• Debt Collectors

• Professional Advisors such as our Financial Advisors, Legal Advisors and Auditors

• your authorized representatives

• fraud bureaus or other organizations to identify, investigate or prevent fraud or other misconduct

• external dispute resolution schemes

• regulatory bodies, government agencies and law enforcement bodies in any jurisdiction

• credit reporting bodies

We may also disclose your personal information to others outside the Bank where we are permitted to disclose the information under applicable Privacy Laws in the country.

How Do We Secure Your Information?

We completely understand the importance of protecting your data and have implemented adequate controls inline with Sri Lankan regulatory requirements to keep your information safe and secure.

We ensure that your personal data is processed for specified, explicit and legitimate purposes as mentioned above. As well, this personal information is not further processed for another purpose except purposes such as public interest, scientific research, historical research or statistical purposes adhering to laws and regulations.

We use a range of physical and electronic security measures to protect the confidentiality and integrity of the personal information we hold about you.

We aim to only keep your information for as long as we need it. When we no longer need information, we take reasonable steps to destroy or de-identify it. Further, your information will be kept up to date, and we will take every reasonable step to erase or rectify any inaccurate or outdated personal data, without undue delay.

How You Can Request, Update, Delete Your Data?

We understand your rights to access, update, delete, restrict processing or make any complaints about the personal information that we have collected from you. You may exercise these requests by submitting a “Personal Data Request Management Form”. In your request, please make clear what information you would like to have changed. For your protection, we may need to verify your identity before implementing your request. We will try to implement your request as soon as reasonably practicable. We reserve the right to refuse to act on a request that is manifestly unfounded or excessive (for example because it is repetitive) and/or to charge a fee that takes into account the administrative costs for providing the information or taking the action requested