Privacy policy
How Collecta and the lenders that use it handle personal data of borrowers, guarantors, website visitors and staff.
1. Who is responsible
Each lending firm is responsible for the personal data it collects about its customers. Collecta processes that data for the firm, and is itself responsible for customer portal accounts, the public directory and platform security. [Controller/processor roles to be confirmed by counsel.]
2. What we hold
Identity: name, NIC number, date of birth and gender (from the NIC), phone, email, address and NIC images.
Lending: applications, loans, schedules, payments, receipts, collateral, collection visits (including the GPS position where a payment was collected) and notes a lender records.
Consents: when a customer agreed to or withdrew credit-history sharing, and the evidence (a one-time code sent by SMS or email, or a signed form).
Accounts and security: sign-in history, devices registered for notifications, and an audit log of changes.
3. Why we use it
To run the loans a customer has with a lender, to send receipts and reminders, to let lenders see a cross-lender credit summary only when the customer has consented, to keep the platform secure, and to meet legal and regulatory obligations.
4. How it is protected
Data is held in data centres [location and provider to be confirmed] and travels only over encrypted connections. NIC images, KYC documents and signed consent forms are encrypted at rest with keys held separately from the data. Each lender sees only its own customers' records; another lender's details are never shown.
5. How long it is kept
Loan, payment, consent and audit records are kept for at least seven years after the relationship ends, as lending records must be. Short-lived data (sign-in codes, unfinished signups, delivered message text, temporary export files) is deleted on a schedule the platform administrator sets.
6. Your rights
You may ask for a copy of your data (customers can download it from their portal account under “Download my data”), ask for corrections, withdraw credit-history consent at any time, and complain to the Data Protection Authority of Sri Lanka. Contact: privacy@collecta.lk [to be set up].
See also: Lender terms · Privacy policy · Credit-history consent