Privacy and Cookie Policy

This Privacy Policy outlines how Alliance Finance Company PLC (“we”, “us”, “our”). collects, uses, stores, discloses, and protects your personal data in compliance with the Personal Data Protection Act, No. 9 of 2022 (PDPA), the Personal Data Protection (Amendment) Act, No. 22 of 2025, and other applicable laws of Sri Lanka.

This Policy applies to every Data Subject (any natural person) whose personal data is collected, stored, or processed by us. This encompasses all individuals interacting with us—including, but not limited to, our employees, website visitors, customers, minor’s prospective clients, mobile app users, suppliers, third-party vendors, cloud service providers, and service providers within Sri Lanka or where our services are offered to individuals in Sri Lanka.

We process your personal data only when we have a lawful ground to do so:

Consent: Where you have given clear, explicit, and informed consent for specific processing activities.
Performance of a Contract: Where processing is necessary to fulfill a contract with you or take pre-contractual steps at your request.
Legal & Regulatory Obligations: Where processing is required under Sri Lankan statutory laws, regulations, or directives from competent authorities.
Legitimate Interests: Where processing is necessary for legitimate business interests pursued by us, provided these are not overridden by your privacy rights.
Vital & Public Interests: To protect life, safety, or perform tasks carried out in the public interest.

Depending on your relationship with us, we may collect:

Identification Data: Full name, National Identity Card (NIC) number, passport details, driver’s license number, date of birth, photo/video recordings, CCTV footage.
Contact Data: Postal address, residential address, email address, telephone/mobile numbers.
Employment & Professional Data: Occupation, employer details, job title, employment history, work address, income source, professional qualifications, professional references, employee ID, and business contact details.
Financial & Transactional Data: Bank account details, payment card information, transaction histories, billing address.
Technical & Usage Data: IP addresses, browser types, device IDs, operating systems, log data, location details, interaction with our website/app, and cookies.
Special Categories of Personal Data: Biometrics (e.g., facial or fingerprint matching for identity verification/e-KYC), health-related data, or criminal record information—processed only with explicit statutory authorization or your explicit consent.

We collect personal data through:

Direct Interaction: Forms filled, account registrations, customer inquiries, service subscriptions, job applications, or branch visits.
Automated Technologies: Web beacons, and analytical software when using our digital platforms. We use cookies and similar tracking technologies to automatically collect technical information from your device. You can disable cookies by adjusting your device or browser settings; however, note that disabling cookies may restrict your access to certain features and limit your ability to use some of our digital financial services.
Third Parties & Public Sources: Credit information bureaus, government databases, background check providers, or public directories (where permitted by law).
From Other Sources: We may also gather information from people you know, businesses, and publicly available resources (online registers, publications, and social media).

We collect and process your personal data strictly for specified, explicit, and legitimate purposes:

• Providing, managing, and maintaining our products and services.
• Verifying identity, conducting Know Your Customer (KYC) and due diligence checks.
• Managing customer relations, processing queries, payments, and refunds.
• Preventing, detecting, and investigating fraud, cybersecurity threats, or criminal activity.
• Complying with regulatory reporting, tax requirements, and legal claims.
• Sending direct marketing communications, updates, or promotional materials (subject to your right to withdraw consent/opt out).

Where we use automated processing technologies (e.g., credit scoring, automated risk assessments, e-KYC matching) that result in legal or significant decisions concerning you:

• You will be informed of the automated logic where required by law.
• You have the statutory right to request human intervention, express your point of view, or contest the decision as provided under Section 18 of the PDPA.