PRIVACY NOTICE

Orient Insurance Limited

Your Privacy Matters

Orient Insurance Limited (“OIL”, “we”, “us” or “our”) is committed to protecting your personal data. This Privacy Notice explains what personal data we collect, why we process it, with whom it may be shared, how long we retain it and your rights under the Personal Data Protection Act No. 09 of 2022, as amended (“PDPA”).

This Notice applies to personal data collected in connection with your insurance proposal, policy, claims and related services.

1. Who is responsible for your personal data?

Orient Insurance Limited is the data controller responsible for the processing of your personal data.

Orient Insurance Limited
10^th Floor, JFI Tower 3,

No.75, Piyadasa Sirisena Mawatha,

Colombo 10.

Our Data Protection Officer may be contacted at:

Data Protection Officer,
10^th Floor, JFI Tower 3,

No.75, Piyadasa Sirisena Mawatha,

Colombo 10.

2. What personal data do we collect?

Depending on the insurance product or service, we may collect and process:

• identification and contact information, including name, address, NIC/passport details, date of birth, telephone number and email address;
• insurance, policy and risk information, including information relating to the insured property, vehicle, business or other insured subject matter;
• financial and payment information;
• claims, accident, loss and previous insurance/claims information;
• health or medical information where relevant to underwriting or claims;
• information relating to other persons connected with the insurance, such as insured persons, beneficiaries, drivers or other relevant individuals;
• information required for identification, verification, fraud prevention, sanctions screening and other legal or regulatory requirements; and
• information obtained from agents, brokers, reinsurers, service providers, public authorities and other relevant third parties.

Where applicable, we may process special categories of personal data, including health or medical information, where permitted and required under the PDPA and other applicable laws.

3. Why do we process your personal data?

We may process your personal data for purposes including:

• assessing insurance proposals and underwriting risks;
• determining eligibility, premiums, terms and conditions and issuing insurance policies;
• administering, renewing, amending and servicing insurance policies;
• receiving, investigating and settling claims and preventing or detecting fraudulent or unlawful claims;
• arranging and administering reinsurance and co-insurance;
• communicating with you and providing customer services;
• conducting audits, actuarial, statistical, analytical, risk management and business activities;
• obtaining professional, technical, medical, legal and other services;
• complying with applicable laws, regulations, regulatory requirements, court orders and lawful requests from authorities;
• establishing, exercising or defending OIL’s legal rights and interests; and
• where permitted by law, communicating information about OIL’s products and services for direct marketing purposes.
  
  

4. What is the legal basis for processing?

OIL will process your personal data only where permitted under the PDPA. Depending on the circumstances, processing may be based on:

• taking steps at your request before entering into an insurance contract;
• performing or administering an insurance contract;
• compliance with a legal or regulatory obligation;
• another lawful basis recognised under the PDPA; or
• your consent, where consent is required.

Where we process personal data based on your consent, you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal and will not prevent OIL from continuing processing where another lawful basis applies.

5. Who may receive your personal data?

Your personal data may be disclosed, where necessary and permitted by law, to:

Third-party controllers: regulatory and government authorities, courts and law enforcement authorities, co-insurers, reinsurers, insurance intermediaries and other parties where disclosure is required or permitted by law.

Credit Information Bureau of Sri Lanka (CRIB): Where applicable, we may obtain, disclose or process your personal data and credit information through the Credit Information Bureau of Sri Lanka for purposes permitted by applicable law, including assessing applications, managing risks, preventing fraud and complying with legal and regulatory requirements

Processors/service providers: surveyors, loss adjusters, investigators, medical practitioners, repairers, lawyers, consultants, actuaries, IT and cloud service providers, payment providers, document management and communication service providers and other persons providing services to OIL.

We require appropriate safeguards and contractual obligations to protect personal data processed by service providers on our behalf.

6. International transfers

Where necessary, your personal data may be accessed or processed outside Sri Lanka, including by relevant group companies, reinsurers or service providers.

OIL will undertake such transfers in accordance with the applicable requirements of the PDPA and will implement appropriate safeguards where required. The PDPA contains specific requirements governing processing of personal data in third countries.

7. How long do we retain your personal data?

We retain personal data only for as long as necessary for the purposes for which it was collected or processed, including for the duration of the insurance relationship and thereafter for periods required or permitted by applicable law, regulatory requirements, dispute resolution, fraud prevention, audit and legitimate business purposes.

8. What are your rights?

Subject to the conditions and limitations under the PDPA, you may have the right to:

• access your personal data;
• request correction of inaccurate or incomplete personal data;
• request erasure of personal data where permitted by law;
• request restriction of processing in applicable circumstances;
• object to certain processing, including direct marketing;
• obtain your personal data in a portable format where applicable;
• withdraw consent where processing is based on consent; and
• lodge a complaint concerning the processing of your personal data with OIL and, where applicable, the Data Protection Authority of Sri Lanka.
  
  

9. How can you exercise your rights?

Requests, questions or complaints concerning your personal data may be submitted to our Data Protection Officer using the contact details provided above.

OIL may take reasonable steps to verify your identity before responding to a request.

10. If you do not provide your personal data

Certain personal data is necessary for OIL to assess your proposal, determine the applicable insurance terms and premium, issue or administer a policy, process a claim and comply with legal and regulatory obligations.

If you do not provide information that is necessary for these purposes, OIL may be unable to provide or continue to provide the relevant insurance product or service.

11. Updates to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our business, services, legal or regulatory requirements or data protection practices. The latest version will be made available through appropriate channels.

Version – 2

Privacy Policy updated as of 10^th August 2026.