Privacy Notice | Singer Finance (Lanka) PLC

Singer Finance (Lanka) PLC is committed to protecting the personal data of its customers, prospective customers, savings account holders, fixed deposit holders, leasing customers, gold loan customers, borrowers, guarantors, nominees, beneficiaries, directors, shareholders, partners, authorised signatories, beneficial owners, business customers, business partners, suppliers, visitors, applicants, candidates, digital channel users and other individuals whose personal data is processed by Singer Finance.

This Privacy Notice explains how Singer Finance collects, uses, stores, verifies, shares, protects and otherwise processes personal data when providing our products and services, including through our branches, website, Online Banking Portal, Online Payment Gateway, social media channels, mobile applications and other digital or physical channels. This notice also explains how we comply with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka.

How we collect information

Generally, we collect personal information directly from you. Information is collected from you when you request/apply for a product or a service from us. We may also collect information using the following methods also. Advertising/Marketing campaigns, by conducting online and offline surveys, through direct emails received from you, by the response received to our campaigns, through information gathered from our websites and mobile apps, direct interactions in person with our staff/agents when you visit Singer Finance branches.

We also may collect information using third party services such as:

• Referees and guarantors, you have listed in the application when applying for services,

• Credit Information Bureau (CRIB)

• Website usage

• Mobile app usage

If you provide us with personal data relating to another individual, such as a guarantor, nominee, director, shareholder, partner, authorised signatory, beneficial owner, referee, family member or representative, you confirm that such individual has been informed of this Privacy Notice and that you have obtained the required consent, authority or other lawful basis, where applicable, to provide such personal data to us.

Our site uses forms that allow customers to sign up, log in, apply for products, and request information. We collect contact information such as name, employee details, job title, telephone numbers, national identification numbers, address/location, and email addresses. The contact information collected through these forms is used to get in touch with the customer when necessary.

What we collect

The types of personal data we collect or obtain may vary according to our relationship with a data subject and may include the following:

A. For Customers and Prospective Customers

• contact information, such as name, address, email address, telephone number, mobile number and preferred communication channel.

• identification information, such as national identity card number, passport number, tax registration number, driving licence number, date of birth, nationality, gender and marital status.

• customer and product information, such as customer number, account details, fixed deposit details, savings account details, lease facility details, gold loan details, application details, facility details, repayment details and transaction history.

• banking and financial information, such as account information, borrowing information, banking transactions, bank statements, income details, employment or business details, source of funds, source of wealth, assets, liabilities and tax-related information.

• credit and risk information, such as creditworthiness, repayment capacity, CRIB records, credit history, guarantor details, collateral or security details, valuation details and insurance details.

• customer due diligence and compliance information, such as KYC information, AML/CFT information, sanctions screening results, Politically Exposed Person (PEP) information, source of funds, source of wealth and related regulatory information.

• digital and technical information, such as website usage, online banking usage, mobile application usage, IP address, device information, login records, transaction logs, authentication records, security logs and fraud prevention information.

• communication information, such as call recordings, SMS records, email correspondence, WhatsApp or other messaging records, complaint records, service request records and customer interaction history.

• consent and preference information, such as privacy notice acknowledgement, marketing consent, communication preferences, opt-out requests and consent withdrawal records.

• sensitive personal information, where applicable, such as health information, criminal conviction information, biometric or facial recognition data where such technology is used and permitted by law, and personal data relating to a child where required with appropriate safeguards.

B. For Business Partners and Suppliers

• contact information (such as name, address, email address and telephone number)

• identification information (such as national identification number, passport identification number, tax registration number, driving license number, date of birth)

• business information (such as name of organization, job title, department, business address, organization structure, shareholding, directorship)

• any recordings captured through our communication platform(s) (such as telephone recordings, Microsoft Teams, Zoom, etc.)

• details contained in business registration documents, third-party due diligence documents, trade references and credit checks.

• financial details including banking account details and bank account statements.

C. For Visitors to Any of Our Premises or Events

• contact information (such as name, address, email address and telephone number)

• identification information (such as national identification number, passport identification number, etc.)

• business information (such as name of organization, etc.)

• reason for visit

• date and time of visit

• biometric or facial recognition data, where such technology is used and where permitted by law.

• security notes (special instructions and access restrictions)

• any photographic and/or video footage captured or recorded by our surveillance camera (CCTV) system or any other recording system.

• It is obligatory for you to supply such personal data if you enter any of our premises or attend any of our events.

D. For Job Applicants, Candidates, Beneficiaries and Programme Participants

• contact information (such as name, address, email address and telephone number)

• identification information (such as national identification number, passport identification number, date of birth and any other identification information)

• demographic information (such as age range, marital status, gender, etc.)

• financial information (such as parents’ incomes, beneficiaries’ incomes, bank account name and number, etc.)

• education information (such as field of studies, university, country of study, academic scores and achievements, professional certifications, etc.)

• employment information (such as employer name, address, email address, telephone number, position employed, employment tenure, etc.)

• any photograph(s) or video footage(s) submitted to us (such as profile pictures, contest submissions, etc.)

• customer compliance information (such as Politically Exposed Persons (PEPs), which may reveal political opinions, including job titles and political parties or organizations).

• sensitive personal information (such as criminal convictions; and personal data relating to a child).

Children’s Personal Data

We do not knowingly collect personal data of individuals under the age of 18 without the verified consent of a parent or legal guardian. Where such data is required, additional safeguards are in place to ensure lawful and responsible handling in accordance with the Personal Data Protection Act.

Additional sensitive personal data that we may collect:

• Health information

Additional sensitive personal data that we collect.

We may, during times of crisis such as war, terrorism, riots, natural disaster, or health crisis/disease outbreak, collect:

• health and physical condition

• health condition of individuals in your household

• result of your health test(s) if any

• whether you are or were in self-isolation when you are or were unwell

• body temperature

It is obligatory for you to supply such additional sensitive personal data if you enter any of our premises or attend any of our events during such times of crisis.

Why we collect personal information

• To communicate with you and respond to your queries, requests, feedback and complaints.

• To assess, process, approve, decline, manage and administer applications, accounts, deposits, facilities, leases, gold loans and other products or services.

• To verify identity and conduct customer due diligence, KYC, AML/CFT, sanctions screening, PEP screening and other regulatory checks.

• To assess creditworthiness, repayment capacity, financial standing, source of funds, source of wealth, collateral, guarantees and related risks.

• To obtain, submit, update, disclose and verify information with the Credit Information Bureau of Sri Lanka, banks, financial institutions, regulators and other lawful verification sources.

• To manage facility servicing, repayment monitoring, collections, recoveries, restructuring, legal action, collateral/security administration and enforcement.

• To prevent, detect, investigate and respond to fraud, financial crime, cyber threats, unauthorised access, misuse of services and other security incidents.

• To comply with legal, regulatory, tax, audit, reporting, record-keeping and statutory obligations, including requirements of CBSL, FIU, CRIB, courts, law enforcement and other competent authorities.

• To manage customer relationships, service quality, staff training, dispute resolution, call recording, internal reporting and operational administration.

• To improve our products, services, digital channels, customer experience, analytics and research, where permitted by law.

• To send marketing, promotional, campaign-related or cross-selling communications where we have a lawful basis to do so, including consent where required.

Lawful Basis for Processing

We process personal data only where we have a lawful basis to do so. Depending on the purpose, we may process personal data where it is necessary to enter into or perform a contract with you, comply with legal or regulatory obligations, assess and manage credit, operational, fraud and security risks, protect our rights and interests, establish, exercise or defend legal claims, perform tasks carried out in the public interest where applicable, or where we have obtained your consent for specific purposes.

Consent is generally used for optional processing activities such as marketing, promotional communications, certain cross-selling activities, optional surveys and other activities where consent is required. Withdrawal of consent will not affect processing that is necessary for facility administration, legal or regulatory compliance, recovery, fraud prevention, security, audit, reporting or other lawful purposes.

Security of information collected

Singer Finance will use personal data only for the purposes set out in this Privacy Notice or for purposes that are compatible with those purposes, unless otherwise permitted or required by law. We may share personal data with authorised third parties where necessary, including CRIB, banks, financial institutions, regulators, law enforcement authorities, courts, auditors, insurers, valuers, legal and recovery agents, payment service providers, technology service providers, cloud/SaaS providers, document storage providers, professional advisers and other service providers acting on our behalf. We require third-party processors to process personal data in accordance with applicable law, confidentiality obligations, security requirements and our instructions.

We may collect and store your personal data in electronic and/or physical form, depending on the requirement. Information may be stored at our and third-party premises within IT Systems (e.g., external cloud storages, internal or third-party management systems, e-mails, databases, hard drives), document warehouses, etc.

We endeavor, where practicable, to process your personal data in a safe environment by preventing any unauthorized or unlawful processing of personal data or accidental loss or destruction of, or damage to, such information. We have implemented various physical, technical, and administrative security measures to protect your personal data and our network from unauthorized access. Some of these measures include:

• encryption of data in transit or at rest

• strict adherence to privacy and security practices

• periodic security assessment and reviews to upgrade our practices.

• restriction of access to personnel who have a need to know such data.

• conduct Data Protection Impact Assessments (DPIAs) on processing activities that are likely to result in a high risk to your rights and freedoms

While we take reasonable measures to protect your personal data, we encourage you to also take appropriate steps to safeguard your information; such as protecting your login credentials, securing your devices, and informing us promptly of any suspected unauthorized activity. These precautions help us maintain a secure environment for your data.

Where we engage third-party service providers to process personal data on our behalf (e.g., software vendors, infrastructure providers), we ensure that such processors are contractually bound to comply with our data protection standards.

Cross-Border Processing and Overseas Transfers

Personal data may be processed, stored or accessed outside Sri Lanka where we use cloud services, technology platforms, support services, group systems, service providers or other third-party processors located overseas. Where personal data is transferred or accessed outside Sri Lanka, we take reasonable steps to ensure that appropriate contractual, technical and organisational safeguards are in place in accordance with applicable data protection requirements.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and report the incident to the Data Protection Authority as required under applicable laws. We will also provide you with relevant information about the breach and any steps you can take to mitigate potential harm.

Retention of information collected

We retain your personal data only for as long as it is necessary to fulfill the purposes for which it was collected. Retention periods may vary based on legal, regulatory, and operational requirements. In some cases, we may retain data for a longer period if required by law or regulation, and it will be securely deleted once it is no longer needed for those purposes. Subject to applicable laws, we may also retain data for a shorter period if you object to its processing and there is no overriding legal basis to continue.

Retention periods may differ depending on the category of data, including customer records, facility records, CRIB/credit assessment records, transaction records, CCTV records, call recordings, visitor records, consent records, complaint records, digital access logs and regulatory records.

Marketing and Communication Preferences

We may use your contact details to send marketing, promotional, campaign-related, cross-selling or product information through SMS, telephone calls, email, WhatsApp, social media, push notifications or other communication channels where we have a lawful basis to do so, including your consent where required.

You may opt out of marketing communications or update your communication preferences at any time through the channels made available by Singer Finance. Service-related, security, legal, regulatory, recovery, account, facility and transaction-related communications may continue where required or permitted by law.

Your rights on information collected

We respect your rights and privacy by taking steps to ensure that your personal data is accurate, complete, not misleading, and up to date. In compliance with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka, we assure you that:

• you have the right to know what personal data we have about you.

• you have the right to request a copy of your personal data.

• you have the right to correct your personal data to ensure it is accurate, complete, not misleading, and up to date.

• where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent will not affect processing carried out before withdrawal or processing that continues under another lawful basis, such as contract, legal/regulatory obligation, recovery, fraud prevention, security, audit, reporting or legal claims.

• you can also ask us to restrict how we use your personal data where it is likely to cause damage or distress.

• you have a right to prevent processing of your personal data for purposes of direct marketing.

• you also have the right to lodge a complaint with the Data Protection Authority of Sri Lanka, if you believe that your personal data has been handled in a manner that violates the provisions of the Personal Data Protection Act, No. 9 of 2022.

How to Exercise Your Rights

You may submit a request relating to your personal data, including requests to access, correct or update your personal data, withdraw consent where processing is based on consent, object to direct marketing, or raise a privacy-related concern, by contacting the Data Privacy Officer using the contact details provided in this Privacy Notice.

To protect your personal data, we may verify your identify and request additional information before processing your request. We will review and respond to such requests within the period required under applicable law, subject to any legal, regulatory, contractual, recovery, fraud prevention, security, audit or record-keeping requirements that may apply.

Where we are unable to fulfil a request fully or partially, we will inform you of the reason, where required or permitted by law.

Automated Decision Making and Profiling

In certain cases, we may use automated systems to make decisions about you, including credit scoring and risk assessment, particularly in the context of evaluating financial product eligibility. Where such decisions are made:

• You have the right to request that any decision made solely by automated means be reviewed by a human.

• You may contest the decision and express your point of view.

We ensure that such profiling and decision-making processes are fair, transparent, and subject to regular review.

Trademarks

Singer Finance Lanka PLC referenced in this site are registered trademarks of Singer (Sri Lanka) PLC.

Copyrights

All materials, that are part of this site are copyrights & / or other intellectual property owned, controlled, or licensed by Singer (Sri Lanka) PLC or its suppliers & protected by copyright laws.

Contact Information for inquiries

If you have any questions or enquiries about this notice, our privacy and information handling practices, or would like to exercise your rights as data subjects, kindly reach out to:

Data Privacy Officer:

E-mail:  dposfl@singersl.com

Updates to the Privacy Notice

We reserve the right to amend, modify, vary, or update this Privacy Notice, at our sole discretion from time to time, as and when the need arises. The most recently published Privacy Notice shall prevail over any of its previous versions. You are encouraged to check this Privacy Notice from time to time to stay informed of any changes. You agree to adhere to the terms of the Privacy Notice including any variations.

Cookie Policy | Singer Finance (Lanka) PLC

This Cookie Policy explains how Singer Finance (Lanka) PLC ("we", "our", or "us") uses cookies and similar tracking technologies on our websites and applications (collectively, the "Site"). This policy is provided in compliance with the Sri Lanka Personal Data Protection Act, No. 9 of 2022 ("PDPA").

We are committed to transparency and your privacy. This policy explains:

• What cookies are,

• What types of cookies we use and why,

• How you can manage or disable cookies.

What Are Cookies?

Cookies are small text files that are placed on your device (computer, smartphone, tablet) when you visit a website. They help us improve your browsing experience by remembering your preferences, enabling certain functionality, and analyzing how you interact with the Site.

Cookies can be:

First-party cookies – set by our own website.

Third-party cookies – set by external services we use (e.g., analytics providers).

Types of Cookies We Use

We do not set marketing cookies without your prior consent.

Legal Basis for Using Cookies

We rely on:

• Legitimate interest to use strictly necessary cookies,

• Your consent for all other cookie types (e.g., analytics, marketing), as required under PDPA Section 8.

How to Manage Cookies

You can:

• Disable cookies through your browser settings. Refer to your browser's help section for instructions.

Note: Disabling cookies may affect site functionality.

Profiling and Automated Decision Making

Some cookies may be used to create user profiles or deliver personalized content. We ensure any such profiling is fair, transparent, and subject to your consent. You have the right to object to profiling under the PDPA.

Your Rights

Under the Sri Lankan PDPA, you have the right to:

• Be informed about how your data is collected and used,

• Access your personal data,

• Withdraw your consent,

• Object to data processing, including for direct marketing or profiling.

You may exercise these rights at any time by contacting us at dposfl@singersl.com.

You also have the right to lodge a complaint with the Data Protection Authority of Sri Lanka if you believe your data has been misused.

Changes to This Cookie Policy

We may update this Cookie Policy from time to time. We encourage you to review this page regularly to stay informed about how we use cookies.

Contact Us

If you have any questions or concerns about our use of cookies, or wish to exercise your rights, please contact our Data Privacy Officer:

Email:  dposfl@singersl.com

Last Updated: 04th September 2026