Effective Date: 24th March 2026
Citizens Development Business Finance PLC (“CDB”, "we," "our," and "us") is committed to protecting and respecting your privacy. This Privacy Notice outlines how we collect, use, process, store, disclose and protect your personal data in accordance with the Personal Data Protection Act No.9 of 2022 (PDPA) of Sri Lanka (as amended). By using our website, our services, and products, you hereby authorize us to process your personal data as described in this notice.
1. Who We Are
CDB is one of Sri Lanka’s leading non-banking financial institutions, committed to empowering aspirations. CDB delivers a broad suite of financial services - from leasing and loans to savings, gold financing, and green finance solutions. We leverage technology to reach underserved communities, while aligning our strategy with global standards for sustainable development.2. Data We CollectWe may collect personal data that you provide to us, as well as data that we automatically collect from your use of our website. This “Privacy Notice” describes our practices in connection with information that we collect through:Sites: Websites operated by us through which you are accessing this Privacy Notice.Apps: Software applications made available by us for use on or through computers and mobile devices.Social Media Pages: Our social media pages and apps that we control.Emails: HTML-formatted email messages that we send to you that link to this Privacy Notice or other communications with you.Offline interactions: Offline business interactions you have with us.Collectively, we refer to the Sites, Apps, Social Media Pages, emails, and offline business interactions as the “Services”.a. Personal Data You ProvideIdentity Data: Name, gender, date of birth, National Identity Card (NIC), driving license, passportUniversal IDs Data: SSN, National Identity Number, Passport Number, Taxpayer ID (TIN), Driver’s License, State ID, Military IDBiometric Data: Fingerprint Scan, Retina/Iris Patterns, DNA Profile, Facial Geometry, Voiceprint RecordingsContact Data: Email address, phone number, and residential addressFinancial and Transaction Data: Income details, bank account information, facility details, repayment history, collateral information, payment details, balances, transfer instructionsCredit and Regulatory Data: CRIB reports, AML screening results, sanctions and PEP checksFinancial & Legal Data: Full Credit Card Number (PAN), Bank Account Number, Medical Record Number (MRN), Health Insurance Policy, Digital Signature/Private KeyPrecise Identity: Precise GPS (Live), Full Name + DOB (Combined), Login Passwords/PassphrasesPersonal Profile: Home Address, Criminal Record, Personal Email, Personal Cell Phone, Mother’s Maiden Name, Citizenship/Immigration StatusIdentifiers: Place of Birth, VIN, License Plate Number, Static IP AddressProfessional: Employee ID, Student ID, Work Email, Salary/Income InfoSocial & Educational: Occupation, Employer Name, Degrees/Certificates, Social Media HandlesDemographics: Gender Identity, Race/Ethnicity, Religious Affiliation, ZIP/Postal Code, General Age Rangeb. Information We Collect AutomaticallyTechnical Data: IP address, browser type, operating system, device information, and location dataUsage Data: Cookies and information about how you use our website, services and products (including website interaction data)3. Legal Bases and Purposes of Processing Personal DataWe process your personal data based on any one or more of the lawful basis prescribed under the Sri Lankan PDPA, including:Contractual necessity, including to provide essential banking and digital services and to perform our contractual obligations, including to establish, manage and maintain relationships with customers, prospective customers, shareholders, officers, beneficial owners, vendors, suppliers, contractors, service providers and other business partners.To exercise our Legitimate interests: To evaluate accounts, credit facilities, loans, credit cards, vendor and other applications and to conduct credit, financial, fraud, operational, information-security, compliance, vendor-risk assessments and to improve our services, conduct data analytics and personalize our services, while ensuring these interests do not override your rights.Operating and protecting our premises, systems and services: To manage access to branches and other premises, use CCTV and other security measures, monitor systems and networks, maintain audit trails, manage incidents, and protect individuals, information, assets and services.Processing transactions and maintaining records: To process, authorise, reconcile and record transactions, payments, fund transfers and other instructions and to maintain appropriate customer, account, transaction, mandate and supporting records, including credit facilities, credit cards, payments, fund transfers, digital services and other products and services associated with us.Customer service and communications: To respond to enquiries, instructions, requests, complaints and feedback and to provide statements, confirmations, service updates, security alerts and other contractual, regulatory or operational notices.Managing suppliers and other business relationships: To conduct vendor due diligence, procurement, contracting, payment, performance monitoring, access management, risk assessment and administration of suppliers, service providers, contractors and other business partners.Consent: For optional processing activities such as sending communications related to services updates, promotions, or the use of non-essential cookies (e.g., by selecting preferences in your account settings or through a cookie banner). You have the right to withdraw your consent at any time (e.g., by changing your communication settings, or adjusting your cookie choices), without affecting processing carried out before withdrawal.Compliance with legal obligations: To fulfil statutory and regulatory obligations, including to verify your identity, conduct Know Your Customer (KYC) and customer due-diligence checks, identify beneficial owners, verify sources of funds or wealth, carry out sanctions list and watch-list screening, and comply with anti-money laundering, countering financing of terrorism requirements, reporting suspicious transactions and responding to inquiries or legal processes.Corporate transactions and restructuring: To evaluate, negotiate or complete a merger, acquisition, financing, reorganisation, transfer of business or assets or another corporate transaction and to meet associated due-diligence requirements.Automated processing and profiling: To carry out automated processing, profiling or behavioural analysis, where permitted by PDPA, including for purposes such as fraud detection, transaction monitoring, credit assessment, credit underwriting, vehicle evaluation, risk management, security and service improvement, subject to availability of your rights under the PDPA.4. Sharing Your Personal DataWe do not sell, rent, or lease your personal data. However, we may share your personal data in the following circumstances:To authorized third-party service providers (e.g., cloud hosting platforms, payroll processors): We may share data with approved third-party service providers and vendors who assist us in operating our website and services (e.g., hosting providers, payment processors). They are governed by strict confidentiality agreements to ensure the authorized use of personal data for designated purposes only.Debt recovery and enforcement of legal rights: To manage arrears and collections, recover outstanding amounts, enforce security and contractual rights, manage disputes, and establish, exercise or defend legal claims.To government authorities, regulators, auditors or legal advisors for legal compliance: We may disclose personal data if required by law, including taxation, banking, financial-crime prevention, employment, data-protection and other legal or regulatory requirements and to respond to lawful requests, directions or orders from the Central Bank of Sri Lanka, Financial Intelligence Unit, Inland Revenue Department, Registrar of Companies, Securities and Exchange Commission of Sri Lanka, Colombo Stock Exchange, law enforcement authorities, courts, tribunals and other competent authorities.5. Cross-Border TransfersCDB primarily serves individuals located in Sri Lanka but certain services - such as international remittances and the use of cloud-based platforms - may require us to transfer your personal data outside Sri Lanka. Such cross-border data transfers will be done in compliance with legal safeguards under the PDPA (as amended).6. Data RetentionWe will retain your personal data for as long as necessary to fulfill the purposes outlined in this policy, as well as the PDPA, including the provision of our banking services, for our legal and regulatory compliance, and to resolve any disputes. Once it is no longer required, we will securely delete or anonymise it such that it is no longer recoverable or associated with you anymore.In addition to compliance with Sri Lankan PDPA, our data retention schedules for your data are in line with applicable financial regulations including the Financial Transactions Reporting Act and the Financial Consumer Protection Regulation.7. Data SecurityWe are committed to protecting your personal and financial information. We use advanced encryption, secure access controls, and regular security audits to safeguard your data. Our systems are designed to prevent unauthorized access and ensure the integrity of your information.While we take every measure to protect your data, we also encourage you to use strong, unique passwords and avoid accessing your accounts on public networks.If you have any security concerns, please contact us immediately.8. Your Rights under the PDPAUnder the PDPA, you have the following rights regarding your personal data:Access: You can request a copy of the personal data we hold about you.Correction: You can request that we correct any inaccurate or incomplete data.Erasure: You can request that we delete your personal data in certain circumstances.Restriction: You can request the restriction of processing of your personal data.Objection: You can object to the processing of your personal data under legitimate interests.Consent withdrawal: You can withdraw your consent at any time, where consent was the legal basis for data processing.Right to Review an Automated decision by a Natural personFile complaints: To lodge an appeal to the Sri Lankan Data Protection Authority (DPA).We may refuse or limit a request where permitted under the PDPA, having regard to the following:National security or public order;An inquiry, investigation or procedure conducted under written law;The prevention, detection, investigation or prosecution of criminal offences;The rights and freedoms of other persons;The technical and operational feasibility of acting on the request;Our inability to establish or verify the identity or authority of the person making the request; orA requirement to process or retain the personal data under written law.Where we refuse your request, we will record the reasons for the refusal and, unless disclosure of the reasons is prohibited by written law, inform you of the refusal, the reasons for it and the availability of the right to appeal.You may contact our DPO at dpo@cdb.lk to exercise your rights. Requests will be handled within the time frames stipulated under the PDPA.9. Data Breach NotificationIn the unlikely event of a personal data breach, we will notify the Sri Lankan Data Protection Authority within 72 hours of becoming aware of the issue. Where required, we will also inform you promptly through your registered contact details (such as SMS, email or in-app/ online banking dashboard alerts). We are committed to being proactive and transparent in the event of a breach.10. Cookies and Tracking TechnologiesCDB website uses cookies to ensure functionality when using our banking service, analytics to improve our services, and performance. This ultimately helps us enhance your user experience with online banking experience.Non-essential cookies, such as advertising, will only be set with your consent (you can manage this via our cookie banner).You can manage cookie preferences at any time via your browser settings or our consent tool.We do not collect sensitive personal data through cookies without your explicit consent.If you choose to disable cookies, this could limit certain features and affect your overall experience. For more information, please refer to our Cookie Policy.11. Changes to This Privacy NoticeWe may update this Privacy Notice from time to time to reflect changes in our practices or for other operational, legal or regulatory requirements. When we do, we will revise the “Effective Date” at the top of the notice on the website.We encourage you to review this notice periodically to stay informed about how we are protecting your personal data.12. Contact UsIf you have any questions or concerns about this Policy, or if you would like to exercise your rights, please contact our DPO:Data Protection OfficerCitizens Development Business Finance PLCEmail: dpo@cdb.lkPhone: +94 117 388 388Address: No. 123, OrabiPasha Mawatha, Colombo 10
