Privacy Notice
& Consent

Asha Securities Limited (“ASL”, “we”, “us” or “our”) is a member of the Colombo Stock Exchange, licensed by the Securities and Exchange Commission of Sri Lanka. ASL pays particular attention to the collection, use, processing, disclosure, storage and protection of personal data obtained in the course of providing stock broking and related services.

This Privacy Notice explains how ASL collects, uses, processes, stores, discloses and protects personal data relating to clients, prospective clients, event participants, employees, contractors and other individuals with whom ASL interacts. Processing is carried out in accordance with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka, as amended, together with other applicable laws, regulations and regulatory requirements.

This Notice applies to personal data processed by ASL in connection with its activities, whether such data is collected electronically, online, by telephone, in writing, in person or through other lawful means.

“Personal Data” means information relating to an identified or identifiable individual. The personal data ASL processes depends on the services provided, the nature of the relationship with ASL and the requirements of applicable law and regulation.

Depending on the circumstances, ASL may process the following categories of personal data:

• Name, residential or business address, email address and telephone/mobile number.
• Date of birth, gender and other personal details required for identification and account administration.
• National Identity Card, passport, driving licence and other identification details or copies of identification documents.
• CDS account, client identification, trader identification and other account-related details.
• Financial information, bank account/payment details, financial holdings, transaction history, trading and settlement data.
• Employment, employer, occupation, business, company office/director or shareholder information where required for client identification or regulatory purposes.
• Beneficiary, nominee, dependent or related person information where required for account or transaction purposes.
• Information obtained for customer due diligence, identification verification, sanctions/PEP screening, background checks and other regulatory checks.
• Information relating to complaints, enquiries, customer feedback, surveys and communications with ASL.
• Photographic, video or CCTV information where you visit or interact with ASL premises or events.
• Information generated through use of online services, which may include IP address, browser/device information, pages visited, dates and duration of visits and similar technical information.
• Information provided for participation in ASL events, webinars, seminars and other activities.

The purposes for which ASL may process personal data include, but are not limited to:

• Opening, establishing, administering and maintaining securities and related accounts.
• Providing stock broking services, including receiving and executing orders and providing access to trading facilities.
• Providing and managing online trading facilities, electronic statements, alerts and other client services.
• Facilitating securities transactions, settlement, custody-related processes and other activities connected with the client relationship.
• Communicating with clients and responding to service requests, enquiries, complaints and other correspondence.
• Verifying identity and conducting customer due diligence, enhanced due diligence and other client verification processes.
• Conducting sanctions, politically exposed person (PEP), adverse information, fraud and other risk-based screening and monitoring.
• Complying with applicable securities laws, regulations, directions, rules and requirements of the Securities and Exchange Commission of Sri Lanka, Colombo Stock Exchange, Central Depository Systems and other competent authorities.
• Making regulatory, statutory, supervisory and other legally required reports and disclosures, including where applicable to financial intelligence, tax enforcement, courts and other competent authorities.
• Preventing, detecting, investigating and responding to fraud, money laundering, terrorist financing, proliferation financing, market abuse, cyber threats, misconduct and other unlawful or unauthorized activities.
• Monitoring and managing trading, credit, margin, operational, compliance and other risks arising from ASL's business.
• Maintaining records and complying with applicable record-retention, audit and accounting requirements.
• Administering billing, payments, fees, commissions and other financial matters connected with the services provided by ASL.
• Providing service updates, operational notices, regulatory announcements, educational communications and event invitations.
• Sending direct marketing communications where permitted and, where required, based on your prior consent.
• Conducting analytics, internal reviews, audits, risk assessments, service improvement and operational planning.
• Protecting ASL's premises, systems, information assets, employees, clients and other stakeholders.
• Defending legal rights, responding to legal claims, supporting investigations and cooperating with regulators, law enforcement and authorised third parties.
• Responding to requests made by data subjects and fulfilling rights and obligations under applicable data protection law.
• Managing corporate, contractual, administrative and other legitimate business activities of ASL.

ASL may disclose or share personal data where necessary for the purposes described in this Privacy Notice, where required to provide the services requested by you, where required or permitted by law, or where necessary to protect ASL's legitimate interests and the rights and safety of clients and other stakeholders. Depending on the circumstances, recipients may include:

• The Colombo Stock Exchange and entities within or associated with the securities market infrastructure, including CDS, where relevant to the services provided.
• The Securities and Exchange Commission of Sri Lanka and other regulators, supervisory authorities and competent governmental bodies.
• Financial intelligence, law enforcement, judicial and other authorities where disclosure is required or permitted by law.
• Auditors, legal advisers, professional advisers and other persons appointed by ASL for legitimate business or regulatory purposes.
• Banks, payment service providers, technology providers, trading platform providers, communication providers, cloud or hosting providers and other service providers supporting ASL's operations.
• Third parties engaged for customer support, document processing, information security, screening, compliance, risk management or other legitimate operational functions.
• Other persons where you have provided consent or where disclosure is otherwise authorised by applicable law.

ASL will take appropriate steps to ensure that third parties processing personal data on its behalf are subject to appropriate confidentiality, security and data protection obligations. Access to personal data will be limited to those persons who have a legitimate need to access it.

ASL retains personal data for as long as necessary to fulfil the purposes for which it was collected and processed, to maintain accurate records of the client relationship and transactions, and to comply with legal, regulatory, accounting, audit, dispute resolution and other applicable requirements.

Where personal data is no longer required, ASL will take reasonable steps to securely delete, destroy or anonymise it, subject to any requirement to retain it for a longer period under applicable law or for the establishment, exercise or defence of legal claims.

ASL maintains appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, destruction or other unlawful or accidental processing. These measures may include access controls, confidentiality obligations, system and network security, physical security, monitoring, backups, staff awareness and other safeguards appropriate to the nature of the personal data and the risks involved.

Although ASL takes reasonable measures to protect personal data, no method of electronic transmission, storage or communication can be guaranteed to be completely secure. You should exercise appropriate care when communicating sensitive information through electronic channels.

Subject to applicable law and any lawful limitations or exemptions, you may have rights in relation to your personal data, including:

• The right to request access to your personal data and information about how it is processed.
• The right to request correction or completion of inaccurate or incomplete personal data.
• The right to request deletion or erasure of personal data in circumstances permitted by law.
• The right to request restriction of processing in circumstances permitted by law.
• The right to object to certain processing, including processing based on legitimate interests, where applicable.
• The right to withdraw consent where processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
• The right to object to or opt out of direct marketing.
• Rights relating to decisions based solely on automated processing or profiling, where applicable.
• The right to receive a copy of your personal data in circumstances provided for by applicable law.
• The right to make a complaint to the competent supervisory authority concerning the processing of your personal data.