Hayleys limits data collection to the information necessary for specific business operations. We collect various types of Personal Data depending on your interaction with us, including (but not limited to):

• Information you give us: Examples include your name, date of birth, ID or passport number, email, phone number and financial details for transactions.
• Information collected automatically: Examples include IP address, browser type, device identifiers and website usage data (such as pages visited and time spent).

We ensure that all Personal Data collected is relevant, limited and used only for its intended purpose.

• Directly when you fill out a form, apply for a job, or contact us.
• Automatically through cookies and tracking tools that remember your preferences.
• From others, occasionally from trusted partners or public sources (for example, if you interact with us through social media).

We process your Personal Data based on consent, contractual necessity, legal obligation, or legitimate interests, as permitted under the PDPA.
Primary purposes include:

• Service Delivery: Creating accounts, processing payments and delivering products.
• Communication: Sending updates, responding to inquiries, or recruitment updates.
• Improvement: Enhancing our websites and customer experiences through analytics.
• Compliance and Safety: Preventing fraud, ensuring security or meeting legal or regulatory obligations.
• Legal obligation or Legitimate Interests: Processing may also occur where we are obligated under law or in the interests of subjects such as responding to emergencies affecting life, health, or safety.

We only collect Personal Data which falls under the special categories of Personal Data as defined in the PDPA if it is essential, for example to support employment or safety. Such Personal Data may include biometric, genetic, criminal offence-related, health, and other categories set out in the PDPA. This is done with your explicit consent at all times.

Our websites and services are not intended for children under 16. If we become aware that we have collected such data without parental consent, we will delete it immediately. Parents or guardians can contact our Data Protection Officer to request its deletion.

We do not sell or rent your Personal Data. We only share your Personal Data when necessary for the purposes outlined in this notice, such as fulfilling a contract with you or meeting legal or legitimate requirements.

• Within the Hayleys Group to provide seamless service and unified support.
• With trusted third-party service providers and partners (such as cloud or payment providers) under written agreements that enforce strict confidentiality and security obligations.
• For legal or legitimate reasons – if required by law, court order, or regulatory authorities or to protect interests.

All our service providers process Personal Data only on our written instructions and are contractually required to maintain confidentiality, implement security measures, and delete or return of Personal Data after completion of services.

You are always in control of your Personal Data. Under the PDPA, you have the right to the following:

These rights may also be exercised by authorised representatives, or by heirs within ten years of an individual’s passing, in accordance with the Act.
To exercise your rights, email us at DPO@hayleys.com. We will respond to you within a maximum of 21 working days. If we are unable to grant your request due to legal or security reasons, we will provide you with a written explanation for our decision.
If you are not satisfied with our response, you have the right to raise a complaint with the Data Protection Authority of Sri Lanka.

Hayleys maintains a robust security framework. Technical safeguards, such as encryption and firewalls are supplemented by strict internal access controls to ensure Personal Data is only accessible to personnel with a verified business requirement.

We also maintain incident response procedures to identify, investigate, and respond to Personal Data breaches in accordance with applicable legal requirements.

We also conduct assessments to identify and mitigate potential risks to your privacy.
All third-party service providers process Personal Data under written agreements with appropriate confidentiality and security obligations.

Hayleys maintains a Data Protection Management Programme to ensure ongoing compliance with applicable data protection laws, including governance oversight, risk assessments, breach management, and continuous improvement.

Retention periods are determined based on legal requirements, contractual obligations, regulatory standards and operational necessity. A detailed retention schedule is maintained internally to ensure we do not keep your Personal Data longer than is required for its intended purpose.

For cross-border data processing, Hayleys implements adequacy safeguards and binding contracts to maintain a level of protection consistent with Sri Lankan law and international requirements.

We use cookies to make your experience smoother by remembering your preferences. You can manage or disable cookies in your browser settings. However, please note that some parts of our site may not function fully without them.

This notice is subject to periodic review to ensure ongoing alignment with regulatory changes and the Hayleys Group’s operational standards. The latest version is made available on our website.