Prime Group (referred to herein as “we,” “us,” “our,” or the “Group”) is committed to safeguarding the privacy and
personal data of all individuals with whom we interact. For the purposes of this Privacy Notice (the “Policy”), the
terms “you” and “your” refer to any reader of this document, data subject, or individual whose personal data is
processed by the Group.
In compliance with the Sri Lanka Personal Data Protection Act, No. 9 of 2022 (PDPA), this Policy applies
transparently to all processing activities concerning data subjects. This includes, but is not limited to, the
following categories of individuals:
- Clients and Consumers: Existing clients, customers, investors, and prospective buyers or renters
utilizing our real estate services, physical facilities, or digital portals.
- Corporate Representatives: Directors, authorized corporate principals, and designated representatives of
corporate clients, institutional partners, or B2B associates.
- Business Partners and Vendors: Registered vendors, suppliers, individual contractors, and external
service providers.
- Workforce and Personnel: Permanent employees, temporary staff, executive officers, job candidates, and
employment applicants seeking position allocations.
- Associated Third Parties: Referees, emergency contacts, guarantors, spouses, and dependents whose
information is provided to us in connection with employment, financial, or contractual obligations.
- Shareholders: Individual stakeholders, institutional stock investors, and beneficial owners of corporate
Group entities.
This document sets forth the comprehensive policies governing data collection, usage, disclosures, data security
protocols, chatbot interactions, and international transfers executed through our Web Site and Mobile Application
channels, as well as physical on-site forms. This Notice governs all data processing activities executed by Prime
Lands (Pvt) Ltd. and all its operational corporate subsidiaries, affiliates, and legal entities—including but not
limited to Prime Lands Residencies PLC, Prime Realty (Pvt) Ltd., Prime Housing, and associated brand segments.
Accordingly, this framework comprehensively covers personal data gathered through our official websites (including
www.primelands.lk and www.primerealty.lk), any technical system subdomains or URLs to which our main domains
redirect, our official mobile applications (such as Prime Edge), paper-based physical forms, and physical
Closed-Circuit Television (CCTV) camera monitoring networks deployed across our corporate offices and development
construction sites.
1. Definitions
- “Personal Data” (or “Personal Information”): Means any information relating to an identified or
identifiable natural person ('Data Subject') who can be identified, directly or indirectly, in particular by
reference to an identifier such as a name, an identification number, location data, an online identifier or to
one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social
identity of that person.
- “Sensitive Personal Data”: Means personal data revealing racial or ethnic origin, political opinions,
religious or philosophical beliefs, membership of a trade union, genetic data, biometric data for the purpose of
uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or
sexual orientation, or personal data relating to offenses, criminal proceedings and convictions.
- “Processing”: Means any operation or set of operations performed on personal data or on sets of personal
data, whether or not by automated means, such as collection, recording, organization, structuring, storage,
adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise
making available, alignment or combination, restriction, erasure or destruction.
- “Data Controller” / “The Company”: Refers to Prime Lands (Pvt) Ltd. (No. 75, D.S. Senanayake Mawatha,
Colombo 08, Sri Lanka) and its legal corporate entities within the Prime Group structure that determine the
purposes and means of the processing of personal data.
- “Data Processor” / “Service Provider”: Means any natural or legal person, public authority, agency, or
other body which processes personal data on behalf of the Data Controller, including third-party companies or
individuals employed by the Company to facilitate, provide, or analyze the Service.
- “Data Subject” (also referred to as “You” or “Your”): Means any identified or identifiable natural person
whose personal data is collected, stored, handled, or otherwise processed by Prime Group. An identifiable person
is an individual who can be recognized, directly or indirectly, by an identifier such as a name, an
identification number (e.g., NIC or passport number), location data, or an online identifier. The terms “You”
and “Your” throughout this Policy apply directly to any such individual or reader of this document.
- "Data Protection Officer (DPO)": refers to the designated individual or team within our organization
responsible for overseeing data protection strategies, ensuring compliance with applicable privacy laws, and
serving as the primary point of contact for data subjects and regulatory authorities regarding personal data
processing activities.
- “Web Site / Mobile Application”: Collectively refers to the digital platforms owned, operated, or
maintained by Prime Group, including the primary website domain (www.primelands.lk), integrated systems,
official mobile applications (including Prime Edge), and embedded digital interfaces such as our Live Chatbot
and automated AI Chatbot channels.
- “Account”: Means a unique account created for You to access our Service or parts of our Service.
- “Affiliate”: Means an entity that controls, is controlled by, or is under common control with a party,
where 'control' means ownership of 50% or more of the shares, equity interest, or other securities entitled to
vote for election of directors or other managing authority.
- “Device”: Means any device that can access the Service such as a computer, a cell phone, or a digital
tablet.
Your Duty to Provide Accurate Information and Inform Us of Changes
It is vital that the Personal Data we hold about you is accurate, current, and true. Outdated data dramatically
impacts real estate title preparation, legal registration, human resources administration, vendor management, and
financial planning functions. Please keep us informed if your Personal Data changes (e.g., change of primary
residential or business address, legal name change, updated identity documentation, or corporate registration
details) during your employment, vendor relationship, or ongoing engagement with us.
Your Duty to Ensure the Security of Your Own Personal Devices
While Prime Group implements stringent enterprise-grade security structures, it is critically important that you
ensure the absolute security of the personal devices used to access our Web Site / Mobile Application or transfer
Personal Data to us. No data transmissions over the Internet or cellular networks can be guaranteed to be 100%
secure. Therefore, it shall be your sole responsibility to safeguard your devices against cybersecurity risks,
unauthorized device access, malware infections, and root vulnerabilities.
Security Notice: We will never ask for your passwords, or transactional account information by any
unsolicited means of communication (such as cold calls, unsolicited SMS, or unauthenticated emails). You are
responsible for keeping your account credentials secure and not sharing them with any third party.
2. Third Party Engagements
Third-Party Consent Requirements
In the event you provide us with any personal information or data on behalf of another individual—including family
members, joint investors, co-applicants, or corporate principles—for the purposes of securing real estate products,
processing financial services, submitting inquiries, or executing related contracts, you explicitly confirm that
such information has been obtained by you and provided to us with the prior specific consent of such person.
You must ensure that the individual has been fully apprised of the full terms and conditions of this Privacy Policy.
Any third-party Personal Data provided by you must be strictly accurate, valid, up to date, and must not include any
false representations or misstatements of facts.
Third-Party Links
This Web Site / Mobile Application may integrate links to third-party web entities, interactive plug-ins, payment
gateway environments, and external mobile applications that are not maintained or controlled by Prime Group.
Clicking on those links or enabling those configurations may allow third-party systems to collect, mine, or share
data about you based entirely on their distinct terms of use and privacy frameworks. We do not control these
third-party environments and are not responsible for their respective privacy policies, operational security setups,
or processing activities. When you exit our Web Site / Mobile Application, we strongly encourage you to review the
Privacy Notice of every external service environment you visit.
3. Data We Collect
We may collect, use, store, organize, and transfer different types of Personal Data about you which we have grouped
together as follows:
- Identity Data: Includes first name, last name, maiden name, username or unique identifier, account registration
parameters, marital status, title, date of birth, gender, National Identity Card (NIC) number, passport details,
and photographs/scanned document copies.
- Contact Data: Includes billing address, permanent residential address, property delivery mailing address,
email address, mobile phone numbers, and landline telephone numbers.
Financial Data: Includes bank account statements, source of funds documentation, income verification
details, credit history records (essential for Prime Max programs and long-term corporate financing
structures), tax identifiers, and tax clearance certifications.
- Transaction Data: Includes specific details about payments to and from you, comprehensive records of real
estate properties purchased, site visit history records, reservation dates, deed reference records, and
preference parameters.
- Technical Data: Includes internet protocol (IP) address, your login data, browser type and version, time
zone setting, location parameters, unique device identifiers, browser plug-ins, operating system, platform
architectures, and other diagnostic technology identifiers embedded in the devices you use to access this Web
Site / Mobile Application.
- Usage Data: Includes detailed metrics concerning how you navigate and interact with our Web Site / Mobile
Application, property viewing durations, page visit durations, and selected search terms.
- Chat, Communication, and Interaction Data: Includes written text, user queries, files, uploaded
documents, contact data, and comprehensive context transcripts of conversations generated when you interact with
the Live Chatbot or the automated AI Chatbot on our main website.
- Marketing and Communications Data: Includes your precise communication preferences in receiving corporate
marketing material from us and our integrated third parties, and your preferred channel choices.
- CCTV Video Surveillance: For the protection of our physical property, corporate assets, employees, and
visitors, continuous video surveillance through closed-circuit television (CCTV) cameras is conducted at our
corporate Head Office and across all active construction/development site perimeters. Video footage containing
your physical image and movements is automatically captured and securely recorded whenever you visit these
physical locations.
Aggregated Data
We also collect, compile, and utilize 'Aggregated Data' such as statistical or demographic profiles for any purpose.
Aggregated Data may be derived from your Personal Data but is legally not considered personal data under the PDPA as
this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to
compute the exact percentage of users accessing a specific real estate project page via our Web Site / Mobile
Application. However, if we combine or connect Aggregated Data with your Personal Data so that it can directly or
indirectly identify you, we treat the combined data as Personal Data which will be processed strictly in accordance
with this Privacy Notice.
4. Tracking Technologies and Cookies
We use Cookies and similar tracking technologies (such as web beacons, tags, and scripts) to track activity on our
Service and store certain information to improve and analyze our Service. The technologies we use include:
- Necessary / Essential Cookies (Session Cookies): Administered by us. These Cookies are essential to
provide You with services available through the Website and to enable You to use some of its features.
- Cookies Policy / Notice Acceptance Cookies (Persistent Cookies): Administered by us. These Cookies
identify if users have accepted the use of cookies on the Website.
- Functionality Cookies (Persistent Cookies): Administered by us. These Cookies allow us to remember
choices You make when You use the Website (such as remembering your login details or language preference).
- Web Beacons: Small electronic files (also referred to as clear gifs, pixel tags, and single-pixel gifs)
that permit the Company, for example, to count users who have visited those pages or opened an email and for
other related website statistics (for example, recording the popularity of a certain section and verifying
system and server integrity).
Cookies can be 'Persistent' or 'Session' Cookies. Persistent Cookies remain on your personal computer or mobile
device when You go offline, while Session Cookies are deleted as soon as You close Your web browser. Where required
by law, we use non-essential cookies (such as analytics, advertising, and remarketing cookies) only with Your
consent. You can withdraw or change Your consent at any time using Our cookie preferences tool (if available) or
through Your browser/device settings. If you deactivate or block cookies, please note that certain components of
this Web Site / Mobile Application may become inaccessible or fail to function properly.
5. How We Use Your Personal Data
We process your Personal Data strictly under valid legal frameworks authorized by the Sri Lanka PDPA. Most commonly,
we will use your data under the following circumstances:
- Consent of the Data Subject: Applied where you have given clear, unambiguous, and explicit consent for
specific processing operations. This basis is primarily leveraged for digital marketing subscriptions, consumer
preference profiling, and the processing of Special Categories of Personal Data (such as biometric data for
secure facility access, medical records for employee health insurance, or sensitive background checks). You
retain the right to withdraw this consent at any time through a written request.
- Performance of a Contract: Applied to all property purchases, investor agreements, construction
handovers, and vendor/supplier registration workflows to manage corporate vendor onboarding, verify individual
identity parameters, and fulfill contractual deliverables.
- Compliance with Legal Obligations: Applied when verifying the source of funds under anti-money laundering
regulations, tracking corporate tax outputs for the Inland Revenue Department, checking credit status via
statutory institutions (e.g., CRIB), and filing mandatory reports to state and regulatory authorities.
- Legitimate Business Interests: Applied when administering website infrastructure, coordinating client
property tours, running internal data diagnostics, maintaining corporate security via physical CCTV perimeters,
and deploying automated customer chatbots to respond to incoming service queries.
- Processing Job Applicant Data (Pre-Contractual Steps): The processing of CVs, employment portfolios, and
interview scores is executed strictly as a necessary pre-contractual requirement to evaluate candidate
eligibility prior to entering into a formal employment agreement.
- Legal Claims & Dispute Defenses: Processing personal records, historical deeds, and transaction
milestones to defend property title transfers, respond to legal notices, or litigate land ownership and property
boundary claims is executed under the legitimate interest of protecting corporate property rights and managing
judicial disputes.
Purposes for Processing Your Data
- Platform & Service Operations: To provide, maintain, optimize, and monitor the performance and security
of our websites, mobile applications, and real estate portals.
- Account & Profile Management: To administer user registrations, logins, customer dashboards, and account
credentials on our digital channels.
- Transaction Execution: To manage property purchases, listings, rentals, structural site viewings,
construction milestones, and financial installment timelines.
- Legal Documentation & Verification: To facilitate land title verifications, background checks, KYC
evaluations (including verifying PEP status and spouse/relative details), and the execution of legal deeds.
- B2B & Supply Chain Onboarding: To register, evaluate, and manage contracts and relationships with
external vendors, suppliers, contractors, and corporate client representatives.
- Communications & Support: To contact individuals via email, phone calls, SMS, or WhatsApp regarding
critical platform alerts, financial statements, construction progress, or account confirmations.
- Inquiry Handling & Chatbots: To process inputs into our website AI Chatbots and customer care tickets to
resolve queries and route complex requests to the appropriate internal teams.
- Recruitment & Talent Evaluation: To screen CVs, educational portfolios, and reference details strictly as
a pre-contractual assessment step for employment applications.
- Corporate Governance: To maintain legal share ledgers, coordinate Central Depository System (CDS)
accounts, process dividend distributions, and handle proxy voting records.
- Physical Security Monitoring: To conduct continuous video surveillance via Closed-Circuit Television
(CCTV) cameras at our corporate Head Office and active construction sites to ensure asset protection and
physical safety.
- System Diagnostics & Security: To run internal corporate server diagnostics, manage database space
allocations, perform backups, and troubleshoot software architectures.
- Marketing & Engagement (Optional): To deliver tailored property portfolios, localized newsletters, and
custom pricing invitations based on explicit user interests (subject to an absolute right to opt out).
Change of Purpose
We will only use your Personal Data for the explicit purposes for which we gathered it, unless we reasonably
determine that we need to use it for another supplementary reason and that reason is compatible with the original
processing purpose. If we must use your Personal Data for an unrelated purpose, we will notify you and explain the
specific legal foundation or request explicit consent.
6. Marketing
We strive to provide you with meaningful choices regarding specific Personal Data processing practices, particularly
around targeted marketing, customized property advertisements, and cross-channel communications. We will request
your express, uncoerced consent before we share your Personal Data with any corporate entity outside Prime Group for
corporate marketing or promotional purposes. You can withdraw this consent at any time. If you wish to opt
out of our marketing communications or promotional activities, you can do so by using the opt-out or unsubscribe
options provided within our messages, or by contacting us directly. We will update your preferences and stop
processing your data for these purposes immediately upon request.
7. Disclosure and Transfer of Your Personal Data
International Transfers
Prime Group operations may necessitate transferring your Personal Data across international borders to
cross-border cloud database environments, foreign branch structures, or global subsidiary entities. Your
information, including Personal Data, is processed at the Company's operating offices and in any other
places where the parties involved in the processing are located. It means that this information may be
transferred to—and maintained on—computers located outside of Your state, province, country, or other
governmental jurisdiction where the data protection laws may differ from those from Your jurisdiction.
Whenever we execute cross-border data transmissions outside Sri Lanka, we ensure an equivalent level of
protection is maintained by entering into comprehensive standard contractual clauses and binding data
processing frameworks that guarantee the recipient enforces robust technical and physical controls over your
data in alignment with the Sri Lanka PDPA.
Categories of Disclosures
We may share your Personal Data with internal and external categories of third parties under strict
confidentiality frameworks:
- Statutory National Authorities: We share transactional data and identity logs with the Financial
Intelligence Unit (FIU) of Sri Lanka (for anti-money laundering compliance), the Inland Revenue
Department (IRD) (for real estate tax reporting), and the Credit Information Bureau (CRIB) of Sri Lanka
(for long-term financing credit checks).
- Corporate Subsidiaries: Personal records are shared across specified legal corporate entities
under the Prime Group architecture (such as Prime Lands Residencies PLC and Prime Realty Pvt Ltd.)
strictly for unified customer management and internal audit reporting.
- Cloud Infrastructure & Software Providers: Data is securely hosted within specialized global
cloud server environments, Customer Relationship Management (CRM) databases, and secure sub-processor
software architectures.
- Professional Advisors: Disclosures are made to certified title lawyers, notary publics, external
legal counsel, and corporate auditors to execute property deed registrations, verify land titles, and
compile statutory financial statements.
8. Data Retention
We will only retain your Personal Data for as long as necessary to fulfill the explicit purposes we collected
it for, including for the purposes of satisfying any legal, accounting, land registration, or statutory
reporting requirements. We apply strict, differentiated retention periods to different categories of
Personal Data:
- Account Information: Retained for the duration of your active account relationship plus up to 24
months after closure.
- Data Subject Support Data: Up to 24 months from the precise date of ticket or query closure.
- Usage & Technical Data: Website analytics data, application usage statistics, and server logs are
retained for up to 24 months.
- Legal & Transactional Records: Retained permanently or long-term as required under governing
statutory laws of Sri Lanka (for land registries, title verification, deeds, and financial auditing
compliance).
- Job Applications & CVs: Retained for a period not exceeding 12 months from the date of final
recruitment decision, unless otherwise required by law or with renewed consent.
In some specific circumstances, you have the legal right to ask us to delete your data. Alternatively, we may
choose to completely anonymize your Personal Data (so that it can no longer be associated with you or
identify you) for historical research or statistical analysis, in which case we may use this
non-identifiable information indefinitely without further notice to you.
9. Children's Privacy
Our Service does not address anyone under the age of 16. We do not knowingly collect personally identifiable
information from anyone under the age of 16. If You are a parent or guardian and You are aware that Your
child has provided Us with Personal Data, please contact us. If We become aware that We have collected
Personal Data from anyone under the age of 16 without verification of parental consent, We take steps to
remove that information from Our servers.
10. Data Security
We have implemented rigorous, enterprise-grade physical, technical, and administrative security measures to
prevent your Personal Data from being accidentally lost, altered, disclosed, destroyed, or accessed in an
unauthorized manner. We secure all digital channels via industry-standard Transport Layer Security (TLS/SSL)
encryption, firewalls, role-based access management profiles, and multi-factor authentication protocols.
Furthermore, we limit access to your Personal Data to those employees, contractors, agents, and operational
third parties who have an absolute corporate 'need-to-know' business requirement.
11. Your Legal Rights
Under the Sri Lanka Personal Data Protection Act, No. 9 of 2022 (PDPA), you possess specific enforceable
statutory rights over your Personal Data, including the following:
- Right of Access / Disclosure: You have the right to request access or copies of the personal data
we safely store regarding your identity.
- Right to Rectification: Request modification, updates, or immediate rectification of any
inaccurate, incomplete, or outdated data.
- Right to Erasure / Deletion: You have the right to delete or request that We assist in deleting
the Personal Data that We have collected about You. You may update, amend, or delete Your information at
any time by signing in to Your Account or contacting Us.
- Right to Object or Restrict Processing: Object to specific algorithmic workflows, restrict data
usage, or object entirely to corporate promotional campaigns.
- Right to Withdraw Consent: Where processing relies on specific consent structures, you hold the
statutory right to withdraw your consent freely at any point without penalty. Please note that
withdrawing your consent will not affect the lawfulness of any processing carried out based on that
consent before its withdrawal.
- Rights Related to Automated Processing & Chatbots: Where our automated AI Chatbot or digital
systems process your data to evaluate property preferences automatically, you have the right to request
human intervention, express your distinct point of view, or contest any automated outcomes that
significantly impact your engagement or property transaction.
- Right to Appeal: If you believe the Company has failed to address your data rights appropriately,
you hold a statutory right to lodge an appeal directly with the Data Protection Officer or escalate the
matter to the national Data Authority.
You will not have to pay a fee to access your Personal Data or to exercise any of your statutory rights. We
strive to respond to all legitimate Data Subject requests within a period of twenty-one (21) working days
(this period may be extended by up to three (3) months with prior notice to the requestor (provided for
within the amendments to the Act.), or as prescribed under the statutory regulations of the PDPA. If you
wish to exercise any of your rights, please contact the Data Protection Officer via [email protected].
12. Changes to this Privacy Policy
Prime Group may amend, modify, or update this Privacy Policy from time to time in accordance with updated
applicable national laws, regulations, technological updates, best data practices, and internal corporate
governance frameworks. We will notify You of any changes by posting the new Privacy Policy on this page and
updating the 'Last updated' date at the top. Historic archived versions can be requested by contacting our
privacy desk.
13. Clarifications or Complaints
If you have any detailed clarifications, unresolved questions, or wish to register a formal complaint
regarding how Prime Group processes your data, you are encouraged to contact us directly at
[email protected], or via our physical corporate headquarters at No. 75, D.S. Senanayake Mawatha,
Colombo 08, Sri Lanka. You also have the legal right to escalate your complaint or report systemic
regulatory violations to the designated Data Protection Authority of Sri Lanka.
Contact Details
- Full Name of Legal Entity: Prime Lands (Pvt) Ltd.
- Designated Inquiries Desk: Data Protection Officer
- Email Address: [email protected]
- Postal Mailing Address: No. 75, D.S. Senanayake Mawatha, Colombo 08, Sri Lanka.
- Telephone Hotline: +94 112 699 822
