Last update on 14 December 2022

This Privacy Policy (“Policy”) describes how Ceylontech Lanka (Pvt) Ltd (the “Service Provider”) collects and uses the personal data you (the “data subject”) provide to the Service Provider through the website accessible at ceyloan.lk or by using our mobile application, or by any other means (the “Platform”). It also describes the choices available to you regarding our use of your personal data and how you can access and update this information. By accessing or using the Platform, you signify that you have read this Policy, and you expressly consent to our collection, use, disclosure, storage and protection of your personal data as described in this Policy.

1. Information you provide when applying for loans

When you apply for a micro loan through the Platform, we may ask you to provide us with certain personally identifiable information and / or we collect basic information about you through the registration process to uniquely identify you, contact you and any references provided by you, perform credit verification, and to confirm with statutory requirements. Specifically, while using the Platform, in order to provide features of the Platform, we may collect personally identifiable information which may include, but is not limited to:

• First name and last name
• Email address
• Phone number
• Address, City, Province, and Postal code
• Usage Data
• Bank Account Number
• Credit Score
• Approx Location
• Precise Location
• Device data and accesses (device id and model, list of installed applications, information about network connection).
• Biometric data (fingerprint, facial image, and voice recording, etc.).

We use this information to provide features of the Platform, to improve and customize the Platform and our services as described in paragraph 5 of this Policy. The information may be uploaded to the Service Provider's servers and/or a third-party services provider's server or it may be simply stored on your device. We also collect location data to provide our loan services and verify your address even when the app is closed or not in use. You can enable or disable access to the information at any time through your device settings and, if the access is enabled, you hereby provide your consent to our use of this information. However, certain features of the Platform may no longer work if access is disabled.

Except as noted in paragraph 8 of this Policy below, the Service Provider will not disclose your personally identifiable loan transaction information to any third party without your consent.

2. Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as your device's internet protocol address (e.g. IP address), browser type, browser version, the pages of our Platform that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When you access the Platform by or through a mobile device, we may collect certain information automatically, including, but not limited to, the type of mobile device you use, your mobile device unique ID, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browser you use, unique device identifiers and other diagnostic data.

We may also collect information that your browser sends whenever you visit our Platform or when you access the Platform by or through a mobile device.

3. Authorisation to Process Personal Data

By accessing or using the Platform, you hereby expressly authorize without any reservations the processing of your personal data by the Service Provider or its employees, agents, affiliates, third-party services providers, etc., for the purposes listed in paragraph 5 of this Policy in Sri Lanka or elsewhere subject to the terms of this Policy and applicable privacy laws.

4. Authorization for Usage of Third Party Data

Notwithstanding anything to the contrary in this Policy or the Terms and Conditions of website, you acknowledge, consent and agree that:

• Where you use this Platform or services for and on behalf on any other person, whether being a member of your family, your friend or employee, you have their full and informed consent and authorization for such use; and
• Where you provide any information in respect of any other person, such as your family, friends or employees, you have their full and informed consent and you are authorized by such person to provide such personal data when using the Platform or services.

We assume with your permission that you have obtained proper authorization from the owner/s of such personal data and have informed the said person/s of the terms and conditions of this Policy or the Terms of Use. You hereby represent and warrant that such person, whether being a member of your family, your friend or employee, has also read and understands this Policy or the Terms and Conditions of website.

You further acknowledge, confirm, represent, and warrant that such person (1) on whose behalf you are using this Platform or services or (2) whose personal data you have provided to us have agreed to the use, processing, storage and/or disclosure of their personal data in accordance with this Policy or the Terms and Conditions of the website, and all applicable laws.

You acknowledge, consent and agree that Service Provider, its employees, or agents shall not be held liable for the collection, use, storage, processing, and disclosure of all such personal data provided by you under this paragraph.

5. Use of Your Personal Data

The Service Provider may use personal data for the following purposes:

• To provide and maintain our services, including monitoring the usage of our services.
• To manage your account: to manage your registration as a user of the service. The personal data you provide can give you access to different functionalities of the Platform that are available to you as a registered user.
• For the performance of a contract: the compliance and undertaking of the loan agreement for the loan products you have applied for through the Platform.
• To contact You: To contact you by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as a mobile application's push notifications regarding updates or informative communications related to the functionalities, loan products or contracted services, including repayments / the security updates, when necessary or reasonable for their implementation.
• To manage your requests: To attend and manage your requests to us.
• For business transfers: We may use your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal data held by us about our service users is among the assets transferred.
• To assess User’s credit risk and prevent fraud: we may use personally identifiable information and device data for internal risk assessment as well as for evaluating the User's credit standing through external report providers and bureaus;
• For other purposes: We may use Your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our services, products, services, marketing and your experience.

In addition to the uses (including display and disclosure) of your information that we have described above in this Policy, Service Provider uses your information that we have collected as described above in this Policy in order to facilitate activities and transactions for the operation of the Platform and the website, provision of our services, and improve user experiences on the Platform.

6. Information from cookies and web beacons

Cookies are small text files created by a website that store information on your computer, such as your preferences when visiting that website. Similar to many websites, if you have enabled cookies in your browser, Service Provider, independently and through enabled third party tools and programs, collects certain technical information using cookies, such as the path of users to the Platform, pages visited, originating IP address, browser type, browser language and the date and time of the user’s visit. This information helps Service Provider track trends and improve areas of the Platform, and are common analytics used by most websites. If you have disabled cookies, the Platform may not work as it is intended because Service Provider uses cookies when you sign in to keep track of your personal session.

Web beacons are tiny graphics with a unique identifier that are similar in function to cookies but, instead of being stored on your computer, are embedded invisibly on web pages and are about the size of the period at the end of this sentence. Web beacons are used to track the online movements of internet users. Service Provider uses them to better understand User interaction and engagement with the Platform (including without limitation, in electronic Communications), such as by learning whether certain users have accessed the Platform via links from other websites. Service Provider can use this information to tailor its audience for advertisements promoting Service Provider. You may set your browser preferences to opt out of the collection and use of this tracking information for ad targeting purposes.

Service Provider also uses cookies for remarketing, by placing a cookie in your browser to signal that you’ve visited the Platform. This gives us the option to show you ads for Service Provider when you visit other websites that host advertisements. Service Provider supports the Do Not Track preference available on most internet browsers. The use of cookies by third parties on the Platform is for the purpose of making the Platform easier to use and to enable certain features of the Platform and is not covered by this Policy. We do not have control over these cookies.

7. Electronic communications

From time to time you will receive disclosures, notices, documents and information based on your current loan status (“Communications”) from Service Provider (for example, confirmations of loans obtained by you, confirmation of email address or password changes, or customer service inquiries regarding the status of or activity).

By creating an account with Service Provider on the Platform, you agree that all Communications from Service Provider relating to your use of the Platform and participation in the Program may be provided or made available to you electronically by mobile SMS, by e-mail or at the Platform.

By registering on the Platform, you acknowledge that you can access the electronic Communications, and you consent to having all Communications provided or made available to you in electronic form and to obtain loan utilizing the online service provided by Service Provider. We may also provide you with Communications through physical mail.

8. Disclosure to affiliates, service providers, agents and representatives

For the purposes of providing full range of the services by the Service Provider, the latter may disclose your personal data to third parties only in the ways that are described in this Policy. The Service Provider’s affiliates and external service providers (including, but not limited to the Credit Information Bureau of Sri Lanka for the purposes of obtaining your credit history), agents and representatives of the Service Provider and its affiliates may be provided with access to your personally identifiable information as part of, or incident to, their provision of services to the Service Provider. All such accesses shall be under appropriate confidentiality agreements and limited to use to provide services to the Service Provider.

In addition to the above, we may share your personal data in the following situations: • With Third Party Service Providers: We may share your personal data with third party service providers to monitor and analyze the use of the Platform and our services, or to contact you. Inter alia, we may share information on the applications installed on your device with such third-party providers as Juicy Score to detect fraud activity or for other similar lawful purposes and you hereby provide your affirmative consent to us doing so.

• For business transfers: We may share or transfer your personal data in connection with, or during negotiations of, any merger, sale of our assets, financing, or acquisition of all or a portion of our business to another company.
• With Affiliates: We may share your information with our affiliates, in which case we will require those affiliates to honour this Policy. Affiliates include our parent company and any other subsidiaries, joint venture partners or other companies that we control or that are under common control with us.
• With business partners: We may share your information with our business partners to offer you certain products, services or promotions.
• With Your consent: We may disclose your personal data for any other purpose with your consent.
• I specifically and explicitly authorize you to disclose my personal data to any telecommunications service provider the CeylonTech Lanka deems fit to carry out analytics and obtain further personal data relating to me that the said telecommunications service provider may have in its possession

Subject to the above, Service Provider will not rent or sell your personal data to any third parties.

9. Legal disclosures

Notwithstanding anything to the contrary in this Policy or the Terms and Conditions of website, you acknowledge, consent and agree that Service Provider may disclose information in order to:

• comply with applicable law, regulation, legal process, or governmental request;
• protect the rights, property and safety of Service Provider, Users and others, including intellectual property rights; and
• enforce or apply our agreements and policies.

10. Links to other websites

If you follow any links which remove you from the Platform (for example, the independently operated PayPal, Facebook, Twitter, Blogger, Wordpress, Salesforce and any other websites), this Policy no longer applies – i.e., the privacy policies and practices of other websites and other parties are governed by their respective terms of use and privacy policies.

11. Security

Service Provider takes reasonable steps to maintain appropriate physical, technical such as encrypting transmission of information using SSL and administrative security to help prevent loss, misuse and unauthorized access, disclosure and modification of personal data. While we take these reasonable efforts to safeguard your personal data, no system or transmission of data over the internet or any other public network can be guaranteed to be 100% secure.

12. Retention period

Service Provider reserves the right to retain your personal data for a period of 3 years or more to satisfy legal requirements such as recordkeeping and tax and credit reporting requirements, as well as for purposes of fraud prevention, audit and data integrity. In addition, Service Provider reserves the right to retain, as well as to use and disclose as permitted pursuant to this Policy, your personal data for such period of time as reasonably needed by Service Provider to facilitate activities and transactions for the operation of the Platform, provision of services, improve user experiences on the Platform. Service Provider reserves the right to retain information that does not directly identify you, for example, aggregated or anonymized data.

13. Modifications; Interpretation

Service Provider may update or modify this Policy from time to time. If any changes are made, Service Provider will reflect the date on which any such changes are made and posted by updating the “last updated” date at the top of the page. If we make any material changes, we will notify you by email (sent to the e-mail address specified in your account) or by means of a notice on this Platform prior to the change becoming effective. Please be sure to check this page periodically for changes.

14. Information about Controller

Service Provider is considered to be the controller of personal data, which means that it determines the purposes of processing of personal data (i.e. "why" personal data are processed) and the means of processing (i.e. "how" personal data are processed).

• Our telephone number: 0768 525 727
• Our email address: [email protected]

15. Dispute Resolution and Submission of Claims

Service Provider hopes to resolve any dispute in a friendly manner and expects the data subject to initially address the Service Provider if he/she considers that the processing does not comply with the applicable privacy laws. However, the data subject is entitled to submit a complaint to the Data Protection Authority of Sri Lanka if he/she considers that the processing carried out by the Service Provider is in contradiction with the privacy laws.

If you believe that any of your personal data may have been misused or abused or otherwise compromised, or if you wish to withdraw your consent for processing of your personal data, you may lodge your inquiries and complaints to the Service Provider in accordance with the contact details as outlined below and discuss such matter, together with your contact details for reference. All such complaints will be resolved within 30 (Thirty) calendar days.

Filing such complaints shall not affect the lawfulness of any processing carried out before you withdraw your consent.

For Complaints please contact us – [email protected]