Singer (Sri Lanka) PLC is committed to protecting the personal data of its customers, prospective customers, suppliers, visitors, applicants, candidates, guarantors, beneficiaries, directors, shareholders, partners, authorized signatories, digital channel users and other individuals whose personal data is controlled & processed by Singer (Sri Lanka) PLC.
This Privacy Notice explains how Singer (Sri Lanka) PLC collects, uses, stores, verifies, shares, protects and otherwise processes personal data when providing our products and services, including through our branches, website, Online Payment Gateway, social media channels, mobile applications and other digital or physical channels. This notice also explains how we comply with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka.
How we collect information
Generally, we collect personal information directly from you. Information is collected from you when you request/apply for a product or a service from us. We may also collect information using the following methods,
Advertising/Marketing campaigns.
By conducting online and offline surveys.
Through direct emails received from you.
By the response received to our campaigns.
Through information gathered from our websites and mobile apps.
Direct interactions in person with our staff/agents when you visit Singer (Sri Lanka) PLC branches.
We also may collect information using third party services such as:
Referees and guarantors, you have listed in the application when requesting for products or services.
Credit Information Bureau (CRIB).
Website usage.
Mobile app usage.
If you provide us with personal data relating to another individual, such as a guarantor, nominee, director, shareholder, partner, authorized signatory, beneficial owner, referee, family member or representative, you confirm that such individual has been informed of this Privacy Notice and that you have obtained the required consent, authority or other lawful basis, where applicable, to provide such personal data to us.
Our site uses forms that allow customers to sign up, log in, buy products, and request information. We collect contact information such as name, employee details, job title, telephone numbers, national identification numbers, address/location, and email addresses. The contact information collected through these forms is used to get in touch with the customer when necessary.
What we collect
The types of personal data we collect or obtain may vary according to our relationship with a data subject and may include the following:
For Customers and Prospective Customers
Contact information, such as name, address, email address, telephone number, mobile number and preferred communication channel.
Identification information, such as national identity card number/passport number/driving license number, date of birth, nationality, gender.
Customer and product information, such as bank card details, hire purchase facility details, repayment details and transaction history.
Banking and financial information, such as income details, employment or business details, sources of funds.
Credit and risk information, such as repayment capacity, guarantor details, collateral or security details.
Digital and technical information, such as website usage, online banking usage, mobile application usage, IP address, device information, login records, transaction logs, authentication records, security logs and fraud prevention information.
Communication information, such as call recordings, SMS records, email correspondence, WhatsApp or other messaging records, complaint records, service request records and customer interaction history.
Consent and preference information, such as privacy notice acknowledgement, marketing consent, communication preferences, opt-out requests and consent withdrawal records.
Sensitive personal information, where applicable, such as biometric data for security measures and personal data relating to a child where required with appropriate safeguards.
Any photographic and/or video footage captured or recorded by our surveillance camera (CCTV) system or any other recording system.
For Business Partners and Suppliers
Contact information (such as name, address, email address and telephone number).
Identification information (such as national identification number, passport identification number, tax registration number, driving license number, date of birth).
Business information (such as name of organization, job title, department, business address, organization structure, shareholding, directorship).
Any recordings captured through our communication platform(s) (such as telephone recordings, Microsoft Teams, Zoom, etc.).
Details contained in business registration documents, third-party due diligence documents, trade references and credit checks.
Financial details including banking account details and bank account statements.
Any photographic and/or video footage captured or recorded by our surveillance camera (CCTV) system or any other recording system.
For Visitors to Any of Our Premises or Events
Contact information (such as name, address, email address and telephone number).
Identification information (such as national identification number, passport identification number, etc.).
Business information (such as name of organization, etc.).
Reason for visit.
Date and time of visit.
Security notes (special instructions and access restrictions).
Any photographic and/or video footage captured or recorded by our surveillance camera (CCTV) system or any other recording system.
It is obligatory for you to supply such personal data if you enter any of our premises or attend any of our events.
For Job Applicants, Candidates, Beneficiaries and Program Participants
Contact information (such as name, address, email address and telephone number).
Identification information (such as national identification number, passport identification number, date of birth and any other identification information).
Demographic information (such as age range, marital status, gender, etc.).
Financial information (such as bank account name and number, etc.).
Education information (such as field of studies, university, country of study, academic scores and achievements, professional certifications, etc.).
Employment information (such as employer name, address, email address, telephone number, position employed, employment tenure, etc.).
Any photograph(s) or video footage(s) submitted to us (such as profile pictures, contest submissions, etc.).
Sensitive personal information, where applicable, such as biometric data, criminal convictions and personal data relating to a child where required with appropriate safeguards.
Children’s Personal Data
We do not knowingly collect personal data of individuals under the age of 18 without the verified consent of a parent or legal guardian. Where such data is required, additional safeguards are in place to ensure lawful and responsible handling in accordance with the Personal Data Protection Act.
Additional sensitive personal data that we may collect:
Health information.
Additional sensitive personal data that we collect.
We may, during times of crisis such as war, terrorism, riots, natural disaster, or health crisis/disease outbreak, collect:
Health and physical condition.
Health condition of individuals in your household.
Result of your health test(s) if any.
Whether you are or were in self-isolation when you are or were unwell.
Body temperature.
It is obligatory for you to supply such additional sensitive personal data if you enter any of our premises or attend any of our events during such times of crisis.
Why we collect personal information
To communicate with you and respond to your queries, requests, feedback and complaints.
To assess, process, approve, decline, manage applications and other products or services.
To assess repayment capacity, collateral, guarantees and related risks.
To obtain, submit, update, disclose and verify information with regulators and other lawful sources.
To manage facility servicing, repayment monitoring, collections, recoveries, legal action, collateral/security administration and enforcement.
To prevent, detect, investigate and respond to fraud, crime, cyber threats, unauthorized access, misuse of services and other security incidents.
To comply with legal, regulatory, tax, audit, reporting, record-keeping and statutory obligations, including IRD, courts, law enforcement and other competent authorities.
To manage customer relationships, service quality, staff training, dispute resolution, call recording, internal reporting and operational administration.
To improve our products, services, digital channels, customer experience, analytics and research, where permitted by law.
To send marketing, promotional, campaign-related or cross-selling communications where we have a lawful basis to do so, including consent where required.
Lawful Basis for Processing
We process personal data only where we have a lawful basis to do so. Depending on the purpose, we may process personal data where it is necessary to enter into or perform a contract with you, comply with legal or regulatory obligations, fraud and security risks, protect our rights and interests, establish, exercise or defend legal claims, perform tasks carried out in the public interest where applicable, or where we have obtained your consent for specific purposes.
Consent is generally used for optional processing activities such as marketing, promotional communications, certain cross-selling activities, optional surveys and other activities where consent is required. Withdrawal of consent will not affect processing that is necessary for facility administration, legal or regulatory compliance, recovery, security, audit, reporting or other lawful purposes.
Security of information collected
Singer (Sri Lanka) PLC will use personal data only for the purposes set out in this Privacy Notice or for purposes that are compatible with those purposes, unless otherwise permitted or required by law. We may share personal data with authorized third parties where necessary, including IRD, regulators, law enforcement authorities, courts, auditors, insurers, legal and recovery agents, payment service providers, technology service providers, cloud/SaaS providers, document storage providers, professional advisers and other service providers acting on our behalf. We require third-party processors to process personal data in accordance with applicable law, confidentiality obligations, security requirements and our instructions.
We may collect and store your personal data in electronic and/or physical form, depending on the requirement. Information may be stored at our and third-party premises within IT Systems (e.g., external cloud storages, internal or third-party management systems, e-mails, databases, hard drives), document warehouses, etc.
We endeavor, where practicable, to process your personal data in a safe environment by preventing any unauthorized or unlawful processing of personal data or accidental loss or destruction of, or damage to, such information. We have implemented various physical, technical, and administrative security measures to protect your personal data and our network from unauthorized access. Some of these measures include:
Encryption of data in transit or at rest.
Adherence to privacy and security practices.
Periodic security assessment and reviews to upgrade our practices.
Restriction of access to personnel who have a need to know such data.
Conduct Data Protection Impact Assessments (DPIAs) on processing activities that are likely to result in a high risk to your rights and freedoms.
While we take reasonable measures to protect your personal data, we encourage you to also take appropriate steps to safeguard your information; such as protecting your login credentials, securing your devices, and informing us promptly of any suspected unauthorized activity. These precautions help us maintain a secure environment for your data.
Where we engage third-party service providers to process personal data on our behalf (e.g., software vendors, infrastructure providers), we ensure that such processors are contractually bound to comply with our data protection standards.
Cross-Border Processing and Overseas Transfers
Personal data may be processed, stored or accessed outside Sri Lanka where we use cloud services, technology platforms, support services, group systems, service providers or other third-party processors located overseas. Where personal data is transferred or accessed outside Sri Lanka, we take reasonable steps to ensure that appropriate contractual, technical and organizational safeguards are in place in accordance with applicable data protection requirements.
Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will, without undue delay, report the incident to the Data Protection Authority as required under applicable laws. We will also provide the relevant information about the breach and any steps to mitigate potential harm.
Retention of information collected
We retain your personal data only for as long as it is necessary to fulfill the purposes for which it was collected. Retention periods may vary based on legal, regulatory, and operational requirements. In some cases, we may retain data for a longer period if required by law or regulation, and it will be securely deleted once it is no longer needed for those purposes. Subject to applicable laws, we may also retain data for a shorter period if you object to its processing and there is no overriding legal basis to continue.
Retention periods may differ depending on the category of data, including customer records, facility records, CRIB/credit assessment records, transaction records, CCTV records, call recordings, visitor records, consent records, complaint records, digital access logs and regulatory records.
Marketing and Communication Preferences
We may use your contact details to send marketing, promotional, campaign-related, cross-selling or product information through SMS, telephone calls, email, WhatsApp, social media, push notifications or other communication channels where we have a lawful basis to do so, including your consent where required.
You may opt out of marketing communications or update your communication preferences at any time through the channels made available by Singer (Sri Lanka) PLC. Service-related, security, legal, regulatory, recovery, account, facility and transaction-related communications may continue where required or permitted by law.
Your rights on information collected
We respect your rights and privacy by taking steps to ensure that your personal data is accurate, complete, not misleading, and up to date. In compliance with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka, we assure you that:
You have the right to know what personal data we have about you.
You have the right to request a copy of your personal data.
You have the right to correct your personal data to ensure it is accurate, complete, not misleading, and up to date.
You have the right to request the erasure of your personal data. However, the Company may refuse such a request where retention of the personal data is required or permitted by law, regulation, contractual obligations, legal claims, or other lawful purposes.
where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent will not affect processing carried out before withdrawal or processing that continues under another lawful basis, such as contract, legal/regulatory obligation, recovery, fraud prevention, security, audit, reporting or legal claims.
You can also ask us to restrict how we use your personal data where it is likely to cause damage or distress.
You have a right to prevent processing of your personal data for purposes of direct marketing.
you also have the right to lodge a complaint with the Data Protection Authority of Sri Lanka, if you believe that your personal data has been handled in a manner that violates the provisions of the Personal Data Protection Act, No. 9 of 2022.
How to Exercise Your Rights
You may submit a request relating to your personal data, including requests to access, correct or update your personal data, withdraw consent where processing is based on consent, object to direct marketing, or raise a privacy-related concern, by contacting the Data Privacy Officer using the contact details provided in this Privacy Notice.
To protect your personal data, we may verify your identity and request additional information before processing your request. We will review and respond to such requests within the period required under applicable law, subject to any legal, regulatory, contractual, recovery, fraud prevention, security, audit or record-keeping requirements that may apply.
Where we are unable to fulfil a request fully or partially, we will inform you of the reason, where required or permitted by law.
Automated Decision Making and Profiling
In certain cases, we may use automated systems to make decisions about you, including candidate screening, particularly in the context of evaluating suitability of the candidate with the job description:
You have the right to request that any decision made solely by automated means be reviewed by a human.
You may contest the decision and express your point of view.
We ensure that such profiling and decision-making processes are fair, transparent, and subject to regular review.
Trademarks
Singer (Sri Lanka) PLC referenced in this site are registered trademarks of Singer (Sri Lanka) PLC. Other products and company names mentioned herein are wherein Singer has acquired distributorship.
Copyrights
All materials, that are part of this site are copyrights & / or other intellectual property owned, controlled, or licensed by Singer (Sri Lanka) PLC or its suppliers & protected by copyright laws.
Contact Information for inquiries
If you have any questions or enquiries about this notice, our privacy and information handling practices, or would like to exercise your rights as data subjects, kindly reach out to:
This privacy notice was posted on singersl.com on October 15th, 2026. We reserve the right to amend, modify, vary, or update this Privacy Notice, at our sole discretion from time to time, as and when the need arises. The most recently published Privacy Notice shall prevail over any of its previous versions. You are encouraged to check this Privacy Notice from time to time to stay informed of any changes. You agree to adhere to the terms of the Privacy Notice including any variations.
Cookie Policy | Singer (Sri Lanka) PLC
This Cookie Policy explains how Singer (Sri Lanka) PLC ("we", "our", or "us") uses cookies and similar tracking technologies on our websites and applications (collectively, the "Site"). This policy is provided in compliance with the Sri Lanka Personal Data Protection Act, No. 9 of 2022 ("PDPA"). We are committed to transparency and your privacy. This policy explains:
What cookies are,
What types of cookies we use and why,
How you can manage or disable cookies.
What Are Cookies?
Cookies are small text files that are placed on your device (computer, smartphone, tablet) when you visit a website. They help us improve your browsing experience by remembering your preferences, enabling certain functionality, and analyzing how you interact with the Site.
Cookies can be:
First-party cookies – set by our own website.
Third-party cookies – set by external services we use (e.g., analytics providers).
Types of Cookies We Use
Cookie Type
Purpose
Examples
Retention
Strictly Necessary
Essential for basic website functionality.
Session login, CSRF tokens
Session-only
Performance / Analytics
Understand user interactions on the site.
Google Analytics
13 months
Marketing / Targeting
Track activity for ads or offers.
Facebook Pixel, Google Ads
Up to 24 months
We do not set marketing cookies without your prior consent.
Legal Basis for Using Cookies
We rely on:
Legitimate interest to use strictly necessary cookies,
Your consent for all other cookie types (e.g., analytics, marketing), as required under PDPA Section 8.
How to Manage Cookies
You can:
Disable cookies through your browser settings. Refer to your browser's help section for instructions.
Note: Disabling cookies may affect site functionality.
Profiling and Automated Decision Making
Some cookies may be used to create user profiles or deliver personalized content. We ensure any such profiling is fair, transparent, and subject to your consent. You have the right to object to profiling under the PDPA.
Your Rights
Under the Sri Lankan PDPA, you have the right to:
Be informed about how your data is collected and used,
Access your personal data,
Withdraw your consent,
Object to data processing, including for direct marketing or profiling.
You may exercise these rights at any time by contacting us at dpo@singersl.com.
You also have the right to lodge a complaint with the Data Protection Authority of Sri Lanka if you believe your data has been misused.
Changes to This Cookie Policy
We may update this Cookie Policy from time to time. We encourage you to review this page regularly to stay informed about how we use cookies.
Contact Us
If you have any questions or concerns about our use of cookies, or wish to exercise your rights, please contact our Data Privacy Officer:
