Privacy Policy

01. Who We Are

SIMCOM (“SIMCOM,” “we,” “us,” or “our”) is the data controller responsible for personal data collected through this Website. Our contact details are set out in Section 15 below.

02. Scope of This Policy

This Policy applies to personal data we collect through the Website — for example, when you complete a contact or consultation form, or when you browse the Website itself. It does not apply to personal data we may process as part of a formal advisory engagement, which is instead governed by the confidentiality and data-handling terms of the relevant engagement agreement and, where SIMCOM processes personal data on a client's behalf, any data processing terms agreed with that client.

03. Information We Collect

We collect two broad categories of personal data through the Website:

• Information you provide directly — such as your name, work email address, phone number, institution name, institution type, service of interest, and the content of any message or enquiry you submit.
• Information collected automatically — such as your IP address, device and browser type, general geographic area inferred from your IP address, and information about how you navigate and interact with the Website. Further detail on this category is set out in our separate Cookie Policy.

04. How We Use Your Information

We use the personal data described above to:

• Respond to enquiries and consultation requests submitted through the Website;
• Evaluate prospective engagements, including conducting the independence and conflict-of-interest review described in our Terms & Conditions;
• Operate, secure, and improve the Website and its content;
• Comply with our own legal, regulatory, and professional obligations;
• Communicate with you about your enquiry or, where you have opted in, about SIMCOM's services and insights.

05. Legal Bases for Processing

Where the Personal Data Protection Act, No. 9 of 2022 (as amended) applies to our processing (see Section 12), we rely on the following legal bases:

• Consent — where you voluntarily submit a form or opt in to receive communications from us;
• Steps taken at your request prior to a contract — where processing is necessary to respond to your enquiry or prepare for a potential engagement;
• Legal and regulatory obligations — where processing is necessary for us to meet our own professional or statutory obligations, including conflict and independence checks;
• Legitimate interests — where processing is necessary to operate and secure our Website and practice, provided this does not override your own rights and interests.

06. How We Collect Information

We collect personal data directly from you when you complete a form or otherwise contact us, and automatically through cookies and similar technologies when you browse the Website, as described in our Cookie Policy.

07. Cookies and Similar Technologies

Our Website uses cookies to operate correctly, remember preferences, and understand how visitors use our content. Full detail on the categories of cookies we use, their purpose, and how you can manage them is set out in our separate Cookie Policy, which forms part of our approach to transparent data handling alongside this Privacy Policy.

08. How Information Is Shared

We do not sell, rent, or trade your personal data to third parties for marketing purposes. We may share personal data with trusted service providers who support our operation of the Website (for example, hosting and email infrastructure providers), each bound by appropriate confidentiality obligations. We may also disclose personal data where required by law, regulation, or a valid order of a court or regulator.

09. International Data Transfers

SIMCOM operates from Sri Lanka. Where personal data is transferred to or processed by service providers located outside Sri Lanka — for example, cloud hosting infrastructure — we take reasonable steps to ensure that data continues to be protected to a standard consistent with this Policy and with the cross-border transfer requirements of the Personal Data Protection Act, No. 9 of 2022, once those requirements take effect (see Section 12).

10. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy — including responding to your enquiry, maintaining records of our independence and conflict checks, and meeting our own legal and professional obligations. Where data is no longer required, we securely delete or anonymise it.

11. Data Security

We apply reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, or alteration. However, no method of transmission over the internet, and no method of electronic storage, is entirely secure, and information submitted through general Website forms should not be treated as a secure channel for sensitive or confidential material (see Section 13 of our Terms & Conditions).

12. Your Rights Under Sri Lankan Data Protection Law

Sri Lanka's Personal Data Protection Act, No. 9 of 2022, as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025 (together, the “PDPA”), is administered by the Data Protection Authority of Sri Lanka. As at the effective date of this Policy, the provisions establishing the Data Protection Authority are in force, while several of the Act's substantive provisions — including core data subject rights, controller and processor obligations, and penalties — are subject to a phased commencement by the responsible Minister and have not yet taken effect.

SIMCOM is committed to aligning its data handling practices with the PDPA's principles ahead of full commencement, and to updating this Policy as further provisions come into force. Once the relevant provisions are in effect, you will generally have the right to:

• Request access to the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion of your data, subject to applicable exceptions;
• Object to or request restriction of certain processing;
• Request that your data be provided to you in a portable format, where applicable.

You may already contact us at any time using the details in Section 15 to ask what personal data we hold about you or to request that we correct or delete it, and we will respond on a reasonable-efforts basis even ahead of the PDPA's full commencement. We will verify your identity before actioning any such request.

13. Marketing Communications

Where you have opted in to receive updates or insights from SIMCOM, you may withdraw your consent at any time by using the unsubscribe link included in our communications or by contacting us directly.

14. Children's Privacy

This Website and SIMCOM's services are directed at professionals acting on behalf of regulated institutions. We do not knowingly collect personal data from individuals under eighteen (18) years of age.

15. Contact Us

If you have questions about this Privacy Policy, or wish to exercise any of the rights described in Section 12, please contact us:

16. Changes to This Policy

We may update this Privacy Policy from time to time, including to reflect further commencement of the PDPA's provisions or changes to our own data practices. Any update will be published on this page with a revised Effective Date.