Insurance Career Interest Rates Calculator Customer Charter Special Notices Promotions CSR Press Releases
Central Finance Company PLCsince 1957
Legal & Privacy

Privacy Policy Central Finance Company PLC

Last updated: 31 December 2025

Central Finance Company PLC ("we", "us", "our") is committed to safeguarding the privacy and security of the personal information you provide to us. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our services.

By accessing or using our website, mobile application, or any of our services, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy, and you consent to the collection, use, and disclosure of your personal data as described herein.

If you do not agree with any part of this Privacy Policy, you should refrain from using our services and not provide any personal information. If you have already provided personal data and wish to withdraw your consent, you may do so at any time by contacting us. Upon receiving your withdrawal request, we will take reasonable steps to delete your information, subject to any legal or contractual obligations

In accordance with the Personal Data Protection Act No 9 of 2022 Sri Lanka, you have the right to lodge a complaint or appeal to the Data Protection Authority if you believe your personal data has been mishandled or your data protection rights have been violated

The information on this website does not constitute professional advice. Users should seek appropriate professional advice when required.

01 Scope of This Privacy Policy

This Privacy Policy applies to all personal data collected through:

  • CENTRAL Finance’s official website (https://cf.lk)
  • Online platforms ( https://careka.lk, https://careka.lk/tukeka)
  • Mobile applications, including the CF Click App , Centrix Payment App
  • Online services (advertising, telephone)
  • Offline services (in-branch, paper applications, etc.)
  • Third-party sources, such as public databases or social media, as permitted by law

It also applies to any personal information obtained through the recruitment process, customer complaints, or feedback systems.

02 Data Protection Principles

We adhere to the following principles to ensure the safety and integrity of your personal data:

Information We Collect

We collect personal data necessary for business operations and regulatory compliance, including but not limited to:

Identification DataName, National Identification Number (NIC), passport number,driver’s license number
Contact Information Address, email, phone number
Financial DataBank account details, credit/debit card details, transaction history
Employment DataJob title, employment history (where relevant)
Digital InformationIP address, browser type, device information, cookies, website usage data
Sensitive Personal DataHealth information (where relevant for product applications), biometric data (for identification and security)

How We Collect Personal Data

We collect personal data through various methods, including:

  • Directly from you when you apply for services, fill out forms (electronically or physically), use our website, or communicate with us
  • Automatically when you interact with our website or mobile apps (via cookies, usage data, etc.)
  • From third parties, such as public databases, credit reference agencies, and social media (in compliance with legal regulations)

Cookies and Tracking Technologies:

We use cookies to enhance user experience, analyze website traffic, and ensure the website’s functionality. You can manage your cookie preferences through your browser settings. For more details, refer to our Cookie Policy.

03 Purposes of Data Collection

We process your personal data for the following purposes:

Service ProvisionTo process your application for products or services, manage accounts, and facilitate transactions.
Marketing and PromotionsTo inform you of promotional offers, new products, and services (with your consent).
ComplianceTo comply with legal obligations, including anti-money laundering (AML), counter-terrorism financing (CTF), and fraud prevention.
Research & DevelopmentFor improving our products, services, and user experience via data analytics.
Customer SupportTo manage customer inquiries, complaints, or feedback.
Security and Risk ManagementTo secure our systems and protect against fraud, cybersecurity risks, and unauthorized access.

04 Legal Basis for Processing Personal Data

We rely on the following legal bases for processing personal data:

Consent

Where we obtain your explicit consent, particularly for marketing purposes.

Contractual Necessity

Where data processing is required to fulfill contractual obligations (e.g., account management, service provision).

Legal Obligation

To comply with statutory and regulatory requirements (e.g., reporting to government authorities).

Legitimate Interest

For purposes such as fraud detection, system security, and customer service improvement.

05 Data Subject Rights

Under the PDPA Sri Lanka, you have the following rights concerning your personal data:

Right to Access

Request access to your personal data held by us.

Right to Rectification

Request corrections to inaccurate or incomplete data.

Right to Erasure

Request deletion of your data where it is no longer necessary for the intended purposes.

Right to Restriction

Restrict the processing of your data in certain situations.

Right to Data Portability

Receive your personal data in a machine-readable format for transfer to another data controller.

Right to Object

Object to the processing of your personal data for certain purposes, such as direct marketing.

Right to Withdraw Consent

You may withdraw your consent for processing personal data at any time, without affecting the lawfulness of processing carried out before withdrawal.

Right to Complain / Appeal

You have the right to lodge a complaint with the Data Protection Authority of Sri Lanka if you believe your rights under the PDPA have been violated.

Right to Be Informed (Transparency)

You have the right to be informed about the collection, use, storage, disclosure, and retention of your personal data, at the time of collection and whenever processing purposes change.

Right Against Automated Decision-Making & Profiling

If automated decision-making, including profiling, significantly affects you, you have the right to request human intervention and to contest such decisions.

06 Data Retention

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy or to comply with statutory retention periods (e.g., tax, financial regulations). Once personal data is no longer needed, we securely destroy or anonymize it.

07 Disclosure of Personal Data

We may disclose your personal data to the following categories of recipients, strictly in accordance with applicable laws and for legitimate business purposes:

Third-Party Service Providers and Group Companies :

We may engage trusted third party service providers to support various functions necessary for our operations and service delivery. These may include, but are not limited to:

Administrative and back-office servicesInformation technology and system supportCustomer service and communications Marketing and analytics Payment processing and financial services Insurance-related services facilitated by a subsidiary of the corporate groupLegal, compliance, and audit support

All such third parties are contractually obligated to maintain the confidentiality, integrity, and security of personal data and to process such data only in accordance with our instructions and applicable data protection laws.

Governmental, Regulatory, and Law-Enforcement Authorities :

We may disclose personal data when required by law, regulation, or legal process to government, regulatory, or law enforcement bodies. These may include, but are not limited to:

Central Bank of Sri Lanka (CBSL)Financial Intelligence Unit (FIU)Inland Revenue Department (IRD)Commission to Investigate Allegations of Bribery or CorruptionCredit Information Bureau of Sri Lanka (CRIB) Personal Data Protection Authority of Sri LankaLaw enforcement agencies, courts, and other competent authorities

are legally mandated to request such informations.

Business Transfers :

In the event of mergers, acquisitions, or restructuring, personal data may be transferred subject to confidentiality safeguards.

We will not disclose your personal data to external parties without your consent unless required by law or permitted under applicable regulations

08 Cross-Border Data Transfers

When personal data is transferred outside of Sri Lanka, we ensure that the destination country has adequate data protection measures in place, or we implement appropriate contractual safeguards, in compliance with applicable data protection laws and relevant regulatory frameworks

09 Data Security

We implement technical and organizational measures to ensure the security of personal data in compliance with applicable regulatory frameworks. These measures include

EncryptionEnsuring data at rest and in transit is encrypted using industry-standard encryption methods.
Data Loss Prevention (DLP)Implementing systems to detect and prevent unauthorized data access or leakage.
Access Controls Limiting access to personal data to authorized personnel only, based on the principle of least privilege.
Monitoring and Audits Continuous monitoring of systems and periodic security audits to identify and mitigate risks.
Incident ManagementA formal incident response plan to handle security breaches and data incidents, including prompt notification to affected individuals and the Data Protection Authority.

10 Data Breach Notification

In the event of a data breach, we will notify affected individuals and the Data Protection Authority of Sri Lanka within the required timeframe if the breach poses a risk to your rights and freedoms, as stipulated by the PDPA.

11 Credit Information and Service Eligibility

As part of our service eligibility assessment, we may obtain credit information from the Credit Information Bureau of Sri Lanka (CRIB) in accordance with applicable laws and regulations.

13 CCTV Surveillance

We operate CCTV systems within our premises to enhance safety, security, and asset protection. Surveillance is conducted based on our legitimate interest under the PDPA Sri Lanka.

Footage may capture identifiable individuals and is processed solely for security-related purposes. Recordings are retained for a limited period and automatically overwritten unless required for investigations. Data subjects may request access or object to processing, subject to legal and technical limitations.

14 Updates to This Privacy Policy

We may update this policy periodically to reflect changes in legal, regulatory, or operational requirements. We will notify you of any significant changes by posting the updated policy on our website. Please review this policy regularly.

15 Contact Us

If you have any questions or concerns about this privacy policy, or if you wish to exercise your data protection rights, please contact us

Data Protection Officer (DPO)

Email:dpo@cf.lk
Phone:+94 11 230 0555
Mailing Address:
Central Finance Company PLC, 270, Vauxhall Street, Colombo 2, Sri Lanka