Privacy Notice

Sanasa National Development Bank ("SNDB", "we," "our," or "us") is committed to safeguarding your personal data and ensuring your privacy.

This Privacy Notice explains what information we collect about you, how we will use that information, who we will share it with, the circumstances under which we will share it and what steps we will take to make sure it stays private and secure.

1. Information We Collect

We may collect the following types of personal data (hereafter referred to as 'Personal Data') to serve you better:

(A) For customers:

• Identification Information: Name, gender, date of birth, nationality, photographs, signature, EPF/ETF, Pension number, etc.
• Official Identification Information: National identification number, passport number, tax identification number, driving license number.
• Contact Information: Residential address, email address, phone number (mobile or landline), etc.
• Financial Information: Account details, credit card details, transaction history, credit score, etc.
• Communications Information: Telephone conversations, messaging, email and other communications.
• Geo-location data: Internet protocol (IP) address or time zone settings, etc.
• Personal Relationship Data: Information about associations (e.g., politically exposed persons, public officials).
• Cookies and Tracking Data: Used for internal analysis, troubleshooting, and personalizing content. Refer to our SNDB Cookie Policy for more.

2. Why We Collect Your Information

We generally process your Personal Data in line with one or more of the following lawful bases:

• Contract: When performing contractual obligations.
• Legal Obligation: When required by applicable law.
• Legitimate Interest: In relation to serving you as our customer.
• Defense of legal claims
• Statistical purposes

3. How We Use Your Information

(A) For customers:

• Providing Financial Services: Managing accounts and processing transactions.
• Compliance with Legal Obligations: Anti-money laundering and fraud prevention.
• Marketing and Communications: Sending information about products and promotions.
• Improving Our Services: Enhancing website and customer experiences.
• Automated decision-making: Profiling and behavioral analysis.
• Keeping you safe: CCTV surveillance recordings at premises and ATMs.

4. Data Sharing

We may share your Personal Data within the SNDB Group, advisors, consultants, and third-party service providers. This may include cross-border transfers in compliance with applicable data protection laws.

• SNDB and its Group
• Our advisors and consultants
• Service partners/suppliers
• Government and law enforcement authorities
• CRIB and other related institutions

5. Data Storing

We collect and store your Personal Data in electronic or physical form. This may include cloud storage and cross-border transfers outside of Sri Lanka but only in compliance with Personal Data Protection Act No. 09 of 2022.

6. Data Retention

We retain data for only as long as necessary. Retention periods vary:

• Transaction management data: For the duration of the relationship plus statutory minimums.
• Marketing information: Until consent is withdrawn.

7. Data Security

We implement adequate technical, physical and organizational security measures to protect your Personal Data against unauthorized access, disclosure, or destruction.

8. Third-party Websites

This Notice does not apply to third-party websites where our advertisements are displayed or linked sites not operated by us. We recommend reading their specific privacy notices.

9. Your Rights

• Right to access: To obtain information about how we process your data.
• Right to rectification: To request correction of inaccurate information.
• Right to erasure: In certain circumstances, to request deletion.
• Right to withdraw consent: You may object to continued processing.
• Right to appeal: File a complaint with the Data Protection Authority (DPA).