Privacy Notice

1. Introduction

This Data Protection Notice (“Notice”) is intended to provide you with the information regarding:

what personal data is collected
purposes of collecting such personal data
with whom we will share personal data and
when the steps taken to secure personal data

This notice may be updated from time to time with or without notice to you.

2. Explanation of Terms

When we use “we”, “us” or “our” in this Notice, such terms refer to Seylan Bank PLC, who will be considered as a controller within the meaning of the PDPA.

Please refer to the section captioned “Contact Us” on the ways to get in touch with us. When we use “you” or “your” in this notice, this means:

Any potential, existing or past customer of any of our banking product(s) or service(s)
Any person authorized person on the account of an existing or past customer
Anyone who performs banking transactions on behalf of a potential, existing or past customer, such as persons with Power of Attorney, executors, etc.
Any visitor to our corporate website
Any visitor to our official social media pages

In this notice, we consider you to be a “data subject” within the meaning of the PDPA. This notice does not apply when we process data pertaining to legal persons such as corporates and companies and any other non-personal data such as anonymous data.

PDPA means the Personal Data Protection Act No.9 of 2022 (as amended) of Sri Lanka.

3. Sources Types of Personal Data

We collect personal data that we believe to be relevant and necessary to understand your financial needs, to conduct our business, and comply with relevant laws and regulations.
The specific categories of information we collect, and process will vary depending on the nature of the interaction or transaction. A general overview is set out below.

Information you may provide directly:

Identity data: full name, other names, date of birth, NIC, driver's licence, passport number, or other identification documents, gender, nationality, and signature
Contact data: postal address, home and mobile phone numbers, and email address(es)
Financial data: employment status, remuneration details (e.g., payslips), employment or business information, and details of accounts held at other banks
Market research data: information submitted in response to surveys or questionnaires

Information we may generate about you:

Financial data: products or services inquired about or used, account numbers, transaction records, payment history, and creditworthiness
Geographic data: location tracking via apps, or your preferred or account-holding branches and ATMs
Preference data: preferred products, services, and communication methods
Device data: IP address, operating system, and technical specifications
Behavioural data: your spending and repayment patterns, how you engage with our website and mobile applications, and interactions on other sites and social media
Risk ratings: credit risk ratings and behavioural or underwriting-based profiling derived from your transactions
Correspondence records: voice or video recordings, emails, chat or instant messages, social media interactions, and in-person discussions, and the content or metadata of relevant correspondences.
Compliance data: transaction details, identification of suspicious or unusual activity, and information about related or connected parties, due diligence, sanctions and anti-money laundering checks.

Information from third-party sources:

Employers or relatives named in your application
Other organisations you have named, such as banks or financial institutions where you hold accounts
The Credit Information Bureau of Sri Lanka
Sources used to help prevent or detect fraud or illegal activity
Social media platforms, including handles, communications, and related data including 3rd party cookies (if enabled).

4. Purposes of Processing and Legal Bases

Generally, we collect and use personal data for the following purposes against the corresponding legal basis which depends on the specific transaction/interaction with you:

Here's the revised table, with a defined basis added for automated decision-making and each row's legal basis tightened to match the specific activity rather than a bundled, generic list:

Purpose	Description	Legal Basis
Account applications and service delivery	To process your applications for account-based services, deliver our products and services, and provide access to online, phone, and mobile banking. This includes validating your identity and obtaining reports to assess your creditworthiness.	To take pre-contractual steps at your request, prior to entering into a contract with you.
Contract performance and transactions	To carry out our agreement with you, establish and manage your account or facility, and process the transactions you request including access to our online, digital, and mobile platforms.	To perform our contract with you.
Debt and payment recovery	To recover outstanding funds or payments. We may engage third-party debt recovery agents, who may contact you directly regarding recovery.	To enforce our contract with you.
Risk management	To assess, identify, and prevent financial, reputational, legal, compliance, or customer risk including credit risk, trading risk, operational risk, insurance risk (e.g., underwriting or claims management).	For our legitimate interest in managing institutional and customer risk.
Crime prevention and detection	To monitor and assess risk for preventing and detecting crimes such as fraud, money laundering, and terrorist financing including screening and investigating payments, instructions, or communications; verifying the identities of transaction parties; checking against sanctions lists; and reporting suspicious or unusual activity to relevant authorities.	To comply with our legal and regulatory obligations under applicable anti-money laundering, counter-terrorist financing, and financial crime laws.
Protection of our legal rights	To protect our legal rights, prevent fraud, and safeguard the physical and digital security of our people, data, and infrastructure (e.g., CCTV at branches/ATMs, identity verification by security personnel). This includes supporting litigation, managing disputes or complaints, defending intellectual property, disclosures to auditors, legal advisors, or security consultants, and facilitating any merger, acquisition, or restructuring.	For our legitimate interest in protecting legal rights, assets, and security of us and our customers.
Responding to legal obligations	To respond to information requests from law enforcement agencies, courts or tribunals, and regulatory bodies including without limitation the Central Bank of Sri Lanka, the Financial Intelligence Unit, the Right to Information Commission, the Inland Revenue Department, the Consumer Affairs Authority, and the Credit Information Bureau. Information is disclosed only where there is a valid legal basis under applicable law.	To comply with legal obligations imposed on us by law and regulation.
Product and service improvement	To identify improvements to our products and services so we can better meet customer needs. This may involve analysing combined data, such as spending patterns, payment history, or financial activity gathered from your use of our products and platforms. This analysis does not reveal user identities.	For our legitimate interest in improving our products and services, conducted on a de-identified basis.
Marketing, including cross-selling and up-selling	To provide information about our products and services, and those of our partners and relevant third parties, through channels such as post, email, phone, SMS, messaging apps, mobile applications, secure messages, and social media advertising.	With your consent, where required by the PDPA, otherwise for our legitimate interest in marketing our own products and services to existing customers.
Managing communications	We may retain records of your communications with us including phone calls, letters, emails, live chat, and video chat to respond to queries and complaints, verify instructions you've given us, train our staff, manage risks, and prevent and detect fraud or other crimes.	For our legitimate interest in service quality, staff training, and risk management, or with your consent where appropriate.
Processing of health data for banking services and insurance related services	To collect and process health-related information (e.g., medical history, disability status, or medical reports) where necessary to provide insurance-linked banking products (i.e. loan protection insurance, bancassurance), assess eligibility, underwrite risk, or process related claims. Where voluntarily disclosed to support a loan moratorium or hardship relief request, we may also use such information to assess and process that request.	With your explicit consent; or to comply with a legal obligation (e.g., insurance regulatory requirements), in each case with additional safeguards to protect your sensitive data.
Automated decision-making, including profiling	We may use automated systems to support certain decisions, such as assessing creditworthiness and risk for lending applications. Automated systems may also flag potential fraud, financial crime, or unauthorised use of your accounts or cards.	Necessary for entering into or performing our contract with you, or where appropriate based on your explicit consent, in each case subject to appropriate safeguards including the right to obtain human intervention.
Development and training of AI/machine learning models	To use data, where feasible on a de-identified or aggregated basis, to train, test, validate, and improve artificial intelligence and machine learning models (including large language models) used to deliver, personalise, or enhance our products and services.	For our legitimate interest in developing and improving our services, balanced against your interests; or with your consent, where required.
Data analytics	To analyse data for deeper insight into how our products are used, and to offer products and services aligned with customer preferences supporting a more efficient, personalised experience.	For our legitimate interest in service personalisation and customer experience improvement.

5. Data Security

We store personal information using a combination of secure computer systems, paper-based files, and other records. We have implemented several measures to protect the personal data we hold from misuse, loss, unauthorised access, modification, or disclosure, using industry-accepted technology and security protocols and legally required standards to help ensure the confidentiality, integrity, and availability of your data during transmission and storage.

6. Data Retention

We have adopted an internal data retention policy specifying how long we retain your data in identifiable form. Generally, records relating to banking transactions are retained throughout the time you remain our customer and for further six (6) years from the date you cease to be our customer.
We may apply a shorter retention period such as one (1) year or less for records of communications with you and for any personal data stored in internet cookies.
We may retain your data for longer than six (6) years from the time you cease to be our customer where necessary to respond to requests from regulators or law enforcement agencies, meet legal or regulatory requirements, support research or statistical purposes and to facilitate ongoing disputes or litigation.
When we no longer need your data, we will take reasonable steps to securely destroy it or permanently de-identify or anonymise it.

7. Recipients of Data

We may disclose your personal data to third parties in so far as necessary to perform the purposes given below subject to strict confidentiality and security obligations:

External service providers contracted to support our operations including application/order processing, marketing support, technology support, hardware and software supply and maintenance, data analytics, storage and hosting services, deliveries, market research, and debt collection. These providers may be located in or outside Sri Lanka.
Regulators and authorities, to comply with our legal and regulatory obligations.
Investigating and enforcement authorities, where we suspect unlawful activity and disclosure is necessary for investigation or reporting.
Your employer or a government agency, where you hold a payment instrument issued under your employer.
Our related companies, to provide products and services you request and to inform you about other offerings.
Credit reporting agencies, in connection with providing credit to you or recovering amounts owed under any contract with us in line with applicable legal framework.
Any other party you authorise us, from time to time, to disclose information to.

8. Cross-Border Transfer of Data

Your personal data may be transferred to and stored in locations outside Sri Lanka, including countries that may not offer the same level of data protection as in Sri Lanka. Where we transfer personal data outside Sri Lanka, we ensure the transfer complies with applicable legal requirements (i.e. PDPA) and that an adequate level of protection is maintained during data transit and at rest.

9. Your Rights

Under the PDPA, you have the following rights in relation to how we process your personal data. To exercise any of these rights, contact us using the details provided in Section 10 of this notice.

Right	Description
Access	Confirm whether we process your personal data and, if so, request access to it. You may also request further information on any matter covered in this notice.
Object	Object to our processing of your data for legitimate interest or public interest purposes, as set out in Section 4.
Withdraw Consent	Withdraw consent at any time where we rely on it for a particular purpose. Withdrawal does not affect the validity of processing carried out before that point.
Rectification	Request correction of inaccurate data or completion of incomplete data.
Erasure	Request erasure of your data if it is processed in contravention of the PDPA, or after you have withdrawn consent. You may request to erase your data pursuant to a court order under applicable law.
Automated Individual Decision-Making	Request a review of any decision made about you solely through automated means, without human involvement, where that decision has, or is likely to have, an irreversible and continuing impact on your rights and freedoms.
Exemptions	We may refuse a request the grounds permitted under the PDPA, including national security, public order, an ongoing inquiry, investigation, or legal proceeding, the prevention, detection, investigation, or prosecution of criminal offences, the rights and freedoms of others, technical or operational infeasibility, inability to verify your identity, or a legal requirement to process your data.
Appeal to the DPA	If you are dissatisfied with our response to any rights request, you may lodge an appeal with the Data Protection Authority of Sri Lanka. Contact details and guidance on lodging an appeal are available at www.dpa.gov.lk.

10. Contact Us

If you need any further information or wish to exercise your rights, you can get in touch with isn the following manner:

Telephone: 011-2456831 or

By contacting the Data Protection Officer: candrajitha@seylan.lk , infosec@seylan.lk