CDB Privacy Notice

Effective Date: 24th March 2026

Citizens Development Finance Business PLC (“CDB”, "we," "our," and "us") is committed to protecting and respecting your privacy. This Privacy Policy outlines how we collect, use, process, store, disclose and protect your personal data in accordance with the Personal Data Protection Act No.9 of 2022 (PDPA) of Sri Lanka and other applicable laws and regulations. By using our website, services, and products, you consent to the collection and use of your personal data as described in this policy.

1. Who We Are

CDB is one of Sri Lanka's leading non-banking financial institutions, committed to empowering aspirations. CDB delivers a broad suite of financial services - from leasing and loans to savings, gold financing, and green finance solutions. We leverage technology to reach underserved communities, while aligning our strategy with global standards for sustainable development.

2. Data We Collect

We may collect personal data that you provide to us, as well as data that we automatically collect from your use of our website, services, and products.

a. Personal Data You Provide

• Identity Data: Name, gender, date of birth, National Identity Card (NIC), driving license, passport.

• Contact Data: Email address, phone number, and residential address.

• Financial and Transaction Data: Income details, bank account information, facility details, repayment history, collateral information, payment details, balances, transfer instructions.

• Credit and Regulatory Data: CRIB reports, AML screening results, sanctions and PEP checks.

b. Information We Collect Automatically

• Technical Data: IP address, browser type, operating system, device information, and location data.

• Usage Data: Cookies and information about how you use our website, services and products (including website interaction data).

3. Legal Bases and Purposes of Data Collection

We collect and process your personal data only where there is a legal basis to do so under the Sri Lankan PDPA:

• Contractual necessity: To provide essential financial and digital services and to perform our contractual obligations.

• Legitimate interests: To improve our services, prevent fraud, manage risk, conduct data analytics and personalize our services, while ensuring these interests do not override your rights.

• Consent: For optional processing activities such as sending communications related to service updates, promotions, or the use of non-essential cookies (e.g., by selecting preferences in your account settings or through a cookie banner). You may withdraw your consent at any time (e.g., by changing your communication settings, or adjusting your cookie choices), without affecting processing carried out before withdrawal. We would like to note that failure to provide essential data may affect your ability to access certain financial services.

• Compliance with legal obligations: To fulfil statutory and regulatory obligations (e.g., anti-money laundering checks, responding to inquiries or legal processes).

4. Sharing Your Personal Data

We do not sell, rent, or lease your personal data. However, we may share your personal data in the following circumstances:

• To authorized third-party service providers: We may share data with approved third-party service providers and vendors who assist us in operating our website and services (e.g., cloud hosting platforms, payroll processors, hosting providers, payment processors). They are governed by strict confidentiality agreements to ensure the authorized use of personal data for designated purposes only.

• To government authorities, regulators, auditors or legal advisors for legal compliance: We may disclose personal data if required by law, legal proceedings (jurisdictional) or to protect our rights, safety, or property, or that of others.

5. Cross-Border Transfers

CDB primarily serves individuals located in Sri Lanka but certain services - such as international remittances and the use of cloud-based platforms - may require us to transfer your personal data outside Sri Lanka. This will only occur when legal safeguards are in place for cross-border transfers, namely:

• Only to jurisdictions that have an adequate level of data protection; or

• With adequate safeguards (such as data transfer agreements) in place to protect your data; or

• With binding contracts or your explicit consent, where required.

6. Data Retention

We will retain your personal data for as long as necessary to fulfill the purposes outlined in this policy including the provision of our financial services, for our legal and regulatory compliance, and to resolve any disputes.

Once it is no longer required, we securely delete or anonymise it such that it is no longer recoverable or associated with you anymore. Some data that may be collected for marketing purposes will be retained until you withdraw your consent or update your choices.

Beyond the Sri Lankan PDPA, our data retention schedules for your data are in line with applicable financial regulations including the Financial Transactions Reporting Act and the Financial Consumer Protection Regulation.

7. Data Security

We are committed to protecting your personal and financial information. We use advanced encryption, secure access controls, and regular security audits to safeguard your data. Our systems are designed to prevent unauthorized access and ensure the integrity of your information.

While we take every measure to protect your data, we also encourage you to use strong, unique passwords and avoid accessing your accounts on public networks.

If you have any security concerns, please contact us immediately.

8. Your Rights under the PDPA

Under the PDPA, you have the following rights regarding your personal data:

• Access: You can request a copy of the personal data we hold about you.

• Correction: You can request that we correct any inaccurate or incomplete data.

• Erasure: You can request that we delete your personal data in certain circumstances.

• Restriction: You can request the restriction of processing of your personal data.

• Objection: You can object to the processing of your personal data under legitimate interests.

• Consent withdrawal: You can withdraw your consent at any time, where consent was the legal basis for data processing.

• File complaints: You can file complaints with the Sri Lankan Data Protection Authority (DPA).

However, please note that we may refuse to fulfill certain requests if:

• It is against the law: We may not be able to comply with your request if doing so would violate legal requirements, obligations, or any applicable laws.

• Necessary for Service Provision: We may refuse your request if the data is required to fulfill contractual obligations or to provide the services you have requested. For example, if the data is essential for processing payments or delivering services, we may not be able to delete or restrict its use.

You may contact our DPO at dpo@cdb.lk to exercise your rights. Requests will be handled within one calendar month, with an extension of 2 months made possible on a case-by-case basis.

If we refuse your request, we will inform you of the reasons for such refusal and your options under the PDPA.

In accordance with the laws of the Democratic Socialist Republic of Sri Lanka, the CDB reserves the right to charge a reasonable fee for processing any data access request. Additionally, nothing in this statement shall limit the rights of customers as provided by the applicable laws of Sri Lanka.

9. Data Breach Notification

In the unlikely event of a personal data breach, we will notify the Sri Lankan Data Protection Authority within 72 hours of becoming aware of the issue.

Where required, we will also inform you promptly through your registered contact details (such as SMS, email or in-app/online banking dashboard alerts). We are committed to being proactive and transparent in the event of a breach.

10. Cookies and Tracking Technologies

CDB website uses cookies to ensure functionality when using our financial service, analytics to improve our services, and performance. This ultimately helps us enhance your user experience with online banking.

• Non-essential cookies: Such as advertising cookies, will only be set with your consent (you can manage this via our cookie banner).

• Cookie preferences: You can manage cookie preferences at any time via your browser settings or our consent tool.

• Sensitive personal data: We do not collect sensitive personal data through cookies without your explicit consent.

If you choose to disable cookies, this could limit certain features and affect your overall experience. For more information, please refer to our Cookie Policy.

11. Automated Processing & Profiling

We do not conduct automatic decision-making or profiling with legal or similarly significant effects on website users.

If CDB adopts automated decision-making that may have significant effects on your person, you will be informed and provided with a right to object or seek human review.

12. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices or for other operational, legal or regulatory requirements. When we do, we will revise the "Effective Date" at the top of the notice on the website.

We encourage you to review this notice periodically to stay informed about how we are protecting your personal data.

13. Contact Us

If you have any questions or concerns about this Policy, or if you would like to exercise your rights, please contact our DPO:

Data Protection Officer
Citizens Development Finance Business PLC
Email: dpo@cdb.lk
Phone: +94 117 388 388
Address: No. 123, Orabipasha Mawatha, Colombo 10