Privacy Policy

1. About Pearl Isle Capital

Pearl Isle Capital (Pvt) Ltd. is a financial services company incorporated and operating in Sri Lanka, providing gold-backed financing and vehicle/consumer financing solutions.

For the purposes of the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka ("PDPA") and other applicable data protection laws, PIC acts as a data controller in relation to personal information collected through its Website and other digital channels.

2. Data Protection Officer

In accordance with the PDPA, PIC has designated a Data Protection Officer ("DPO") responsible for overseeing compliance with this Privacy Policy and applicable data protection law, and for handling enquiries and requests concerning the processing of personal information.

The DPO can be contacted using the details set out in Section 20 (Contact Us) of this Privacy Policy.

3. Information We May Collect

Depending on how you interact with our Website, we may collect information including:

• Name and other identification information;
• Email address;
• Telephone or mobile number;
• Postal or residential address;
• Information provided through enquiry, contact, application or other online forms;
• Information relating to products or services you request or enquire about, including gold-backed financing and vehicle/consumer financing enquiries;
• Employment or business information where voluntarily provided;
• Information contained in communications submitted to us, including via WhatsApp;
• IP address and other technical information;
• Browser type, device information and operating system;
• Website usage information, including pages visited and approximate time spent on the Website; and
• Information collected through cookies and similar technologies.

We will seek to collect only information that is reasonably necessary for the relevant purpose.

4. Special Categories of Personal Data

Where you apply for or enquire about a financing product, we may collect more sensitive categories of personal information, which may include your National Identity Card (NIC) number, income or financial information, and other information necessary to assess and process a financing application in accordance with applicable law.

We will only collect and process such information with your consent, where required for the performance of a contract with you, or where otherwise permitted or required by applicable law, and will apply additional safeguards appropriate to its sensitivity.

5. How We Collect Information

We may collect personal information:

• Directly from you when you complete forms or submit information through the Website;
• When you contact us by email, telephone, WhatsApp or other communication channels;
• When you submit an enquiry or request information about our products or services;
• When you apply for or express an interest in our products or services;
• Automatically through your use of the Website, including through cookies and similar technologies; and
• From third parties where such collection is permitted by applicable law, including credit reference agencies as described in Section 9.

6. Purposes for Which We Use Personal Information

We may use personal information for legitimate business and operational purposes, including to:

• Respond to enquiries and requests;
• Provide information about our products and services;
• Process and assess applications and requests, including financing applications;
• Communicate with customers, prospective customers and other Website users;
• Provide, administer and improve our services;
• Verify information where necessary, including for identity verification and credit assessment purposes;
• Maintain records and support our internal administration;
• Protect the security and integrity of our Website, systems and information;
• Detect, prevent and investigate fraud, misuse, unauthorized access and other unlawful activities;
• Comply with applicable legal, regulatory and contractual obligations, including reporting to the Credit Information Bureau of Sri Lanka and other regulatory bodies;
• Meet audit, accounting, reporting and record-keeping requirements; and
• Carry out other purposes that are permitted or required by applicable law.

We will not use personal information for purposes that are incompatible with the purpose for which it was collected, unless permitted or required by applicable law.

7. Legal Basis for Processing

Where applicable, PIC will process personal information on an appropriate lawful basis under the PDPA, which may include:

• Your consent;
• The performance or preparation of a contract;
• Compliance with a legal or regulatory obligation;
• Protection of legitimate interests, where permitted by applicable law; or
• Other lawful grounds permitted under applicable Sri Lankan law.

Where consent is relied upon, you may withdraw your consent at any time, subject to applicable legal or contractual limitations.

8. Sharing and Disclosure of Personal Information

PIC does not sell personal information to third parties. We may disclose or provide access to personal information where reasonably necessary to:

• Service providers and technology providers supporting our business operations;
• Hosting, cloud, software and IT service providers;
• WhatsApp and other communication platforms, where you choose to contact us or apply for a product through those channels, subject to that platform's own privacy policy;
• Professional advisers, auditors and consultants;
• Financial, regulatory, governmental or law-enforcement authorities where required or permitted by law, including the Central Bank of Sri Lanka and the Credit Information Bureau of Sri Lanka;
• Business partners or service providers involved in delivering requested services; or
• Other parties where you have provided appropriate consent or where disclosure is otherwise permitted or required by law.

Where third parties process personal information on behalf of PIC, we will take reasonable steps to ensure that appropriate safeguards are applied.

9. Credit Information Bureau Reporting

Where you apply for a financing product, PIC may obtain, use, and report information relating to your application and repayment conduct to the Credit Information Bureau of Sri Lanka (CRIB) or any other credit reference agency recognised under applicable law, for the purposes of credit assessment, risk management and regulatory compliance.

Information held by such agencies may also be accessed by other financial institutions for similar purposes, in accordance with applicable law.

10. International or Cross-Border Data Transfers

Certain service providers or technology platforms used by PIC, including communication platforms such as WhatsApp, may process or store information outside Sri Lanka.

Where personal information is transferred outside Sri Lanka, PIC will take reasonable steps to ensure that such processing and transfer are carried out in accordance with the cross-border transfer requirements of the PDPA and other applicable data protection requirements.

11. Cookies and Similar Technologies

The Website may use cookies and similar technologies to improve functionality, security and user experience and to understand how visitors use the Website.

Cookies may collect information such as browser type, device information, pages visited and Website usage patterns. You may manage or disable cookies through your browser settings. However, disabling certain cookies may affect the functionality of some Website features.

12. Website Security

PIC implements reasonable technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, loss, misuse or destruction.

However, no electronic transmission, website or storage system can be guaranteed to be completely secure. Accordingly, while we take appropriate precautions, we cannot guarantee absolute security of information transmitted through the Internet.

13. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and interests of affected individuals, PIC will notify the Data Protection Authority of Sri Lanka in accordance with the requirements of the PDPA.

Where required by applicable law, PIC will also notify affected individuals of a personal data breach without undue delay.

14. Data Retention

PIC will retain personal information only for as long as reasonably necessary for the purposes for which it was collected, or for the period required or permitted by applicable legal, regulatory, accounting or business requirements.

Retention periods may vary depending on the nature of the information and the purpose for which it is processed. When personal information is no longer required, PIC will take reasonable steps to securely delete, destroy or anonymize it, subject to applicable legal and regulatory requirements.

15. Your Rights

Subject to applicable law and any relevant limitations, you may have rights under the PDPA in relation to your personal information, including rights to:

• Request information regarding the processing of your personal information;
• Request access to personal information held about you;
• Request correction or updating of inaccurate or incomplete information;
• Request deletion or cessation of processing where permitted by law;
• Withdraw consent where processing is based on consent;
• Object to or restrict certain processing where applicable;
• Request review of a decision based solely on automated processing that significantly affects you, subject to conditions specified under applicable law; and
• Exercise other rights available under applicable data protection legislation.

Requests may be subject to applicable legal requirements, verification procedures and limitations.

16. Accuracy of Information

We expect personal information provided to us to be accurate and up to date. If you become aware that information held by PIC is inaccurate or incomplete, you may contact us and request that the information be corrected or updated.

17. Third-Party Websites and Platforms

The Website may contain links to third-party websites or services, and certain contact and application journeys on the Website direct you to third-party platforms such as WhatsApp.

PIC is not responsible for the privacy practices, content, security or policies of third-party websites or platforms. Users are encouraged to review the privacy policies of such third parties, including WhatsApp's own privacy policy, before providing personal information through those channels.

18. Children's Privacy

Our Website is not intended to knowingly collect personal information from children except where permitted by applicable law and where appropriate safeguards are in place. If we become aware that personal information relating to a child has been collected in circumstances where it should not have been, we will take reasonable steps to address the matter.

19. Changes to This Privacy Policy

PIC may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements or business practices. The updated version will be published on this Website with the revised "Last Updated" date.