Privacy Notice
We understand that your personal data is important to you. Guided by our corporate values and our code of conduct, the Hayleys Way, we are committed to protecting your privacy and handling your information responsibly.
This Privacy Notice outlines the commitment of Hayleys PLC to the secure and transparent management of personal data. We operate in accordance with the Personal Data Protection Act No. 9 of 2022 of Sri Lanka, as amended (“PDPA”) and relevant international standards such as the European Union’s General Data Protection Regulation (GDPR), ensuring accountability across all our global touchpoints.
1. Who collects your Personal Data
We are a globally present, diversified conglomerate with operations in over 20 countries. We comply with the PDPA and uphold equivalent international standards for data protection.
2. What Personal Data we collect
Hayleys limits data collection to the information necessary for specific business operations. We collect various types of Personal Data depending on your interaction with us, including (but not limited to):
- Information you give us: Examples include your name, date of birth, ID or passport number, email, phone number and financial details for transactions.
- Information collected automatically: Examples include IP address, browser type, device identifiers and website usage data (such as pages visited and time spent).
We ensure that all Personal Data collected is relevant, limited and used only for its intended purpose.
3. How we collect it
- Directly when you fill out a form, apply for a job, or contact us.
- Automatically through cookies and tracking tools that remember your preferences.
- From others, occasionally from trusted partners or public sources (for example, if you interact with us through social media).
4. Why we use your Personal Data
We process your Personal Data based on consent, contractual necessity, legal obligation, or legitimate interests, as permitted under the PDPA.
Primary purposes include:
- Service Delivery: Creating accounts, processing payments and delivering products.
- Communication: Sending updates, responding to inquiries, or recruitment updates.
- Improvement: Enhancing our websites and customer experiences through analytics.
- Compliance and Safety: Preventing fraud, ensuring security or meeting legal or regulatory obligations.
- Legal obligation or Legitimate Interests: Processing may also occur where we are obligated under law or in the interests of subjects such as responding to emergencies affecting life, health, or safety.
5. Special Categories of Personal Data and Children
We only collect Personal Data which falls under the special categories of Personal Data as defined in the PDPA if it is essential, for example to support employment or safety. Such Personal Data may include biometric, genetic, criminal offence-related, health, and other categories set out in the PDPA. This is done with your explicit consent , where consent is the applicable lawful basis, or otherwise in accordance with another applicable condition under the PDPA.
Our websites and services may involve the processing of Personal Data of children as defined in PDPA. If we become aware that we have collected such data without the required lawful basis or, where consent is required, the consent of a parent or legal guardian, we will take appropriate steps, including deleting the data or ceasing its processing, where appropriate and legally required.. Parents or guardians can contact our Data Protection Officer to request its deletion.
6. Sharing your Personal Data
We do not sell or rent your Personal Data. We only share your Personal Data when necessary for the purposes outlined in this notice, such as fulfilling a contract with you or meeting legal or legitimate requirements.
- Within the Hayleys Group to provide seamless service and unified support.
- With trusted third-party service providers and partners (such as cloud or payment providers) under written agreements that enforce strict confidentiality and security obligations.
- For legal or legitimate reasons – if required by law, court order, or regulatory authorities or to protect interests.
All our service providers process Personal Data only on our written instructions and are contractually required to maintain confidentiality, implement security measures, and delete or return of Personal Data after completion of services.
7. Your rights
You are always in control of your Personal Data. Under the PDPA, you have the right to the following:
| Your Right | What It Means |
|---|---|
| Access & Correction | Ask for a copy of your data or correct any inaccuracies. |
| Erasure (“Be Forgotten”) | Request deletion of your data when it is no longer needed. |
| Restrict or Object | Limit how we use your data or object to certain processing. |
| Data Portability | Request your data in a format you can transfer elsewhere. |
| Withdraw Consent | Withdraw your consent for specific uses at any time. |
| Review of Automated Decisions | The right to request meaningful information about the logic involved and to ask for a human review of any automated decision that affects you. |
8. How we keep your Personal Data safe
We also maintain incident response procedures to identify, investigate, and respond to Personal Data breaches in accordance with applicable legal requirements.
We also conduct assessments to identify and mitigate potential risks to your privacy.
9. Data Protection Management Programme
10. How long we keep your Personal Data
11. How we protect cross-border transfers of Personal Data
12. Cookies and tracking
13. Updates to this notice
This notice is subject to periodic review to ensure ongoing alignment with regulatory changes and the Hayleys Group’s operational standards. The latest version is made available on our website.
Contact our Data Protection Officer
Data Protection Officer
Hayleys PLC
No. 400, Deans Road, Colombo 10, Sri Lanka
dpo@hayleys.com
