Privacy Policy

winfinityholdings.com

Effective Date: 27 June 2026  |  Version 1.0

1. About This Policy

Winfinity Holdings (Pvt) Ltd ("Winfinity Holdings", "we", "us", or "our") is a company incorporated and operating in Sri Lanka, engaged in leisure sector asset management, investment management, strategic consultancy, hospitality project development, and property management through its group ventures.

This Privacy Policy explains how we collect, use, store, disclose, and protect personal data when you visit our website at https://winfinityholdings.com/ (the "Website"), engage with our services, or otherwise interact with us.

This Policy is issued in compliance with the Personal Data Protection Act No. 9 of 2022 of Sri Lanka ("PDPA") and, where applicable, other international data protection frameworks including the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR.

By using our Website, you acknowledge that you have read and understood this Policy. If you do not agree with its terms, please discontinue your use of the Website.

2. Data Controller

The data controller responsible for your personal data is:

Winfinity Holdings (Pvt) Ltd Colombo, Sri Lanka Website: https://winfinityholdings.com/ Contact: Via the Contact form at https://winfinityholdings.com/contact-us

3. What Personal Data We Collect

3.1 Data You Provide Directly

We may collect the following categories of personal data that you voluntarily provide to us:

• Name and professional title

• Email address and telephone number

• Company name and professional role

• Nature of your enquiry or message

• Any other information you choose to include in correspondence with us

This data is collected primarily when you submit an enquiry through our contact page, correspond with us by email, or engage with us as a prospective or current business partner, client, or candidate.

3.2 Data Collected Automatically

When you visit our Website, we and our service providers may automatically collect the following technical and usage data:

• IP address and approximate geographic location derived from it

• Browser type, version, and operating system

• Device type and screen resolution

• Pages visited, time spent on pages, and navigation paths

• Referring URL (the page you visited before arriving at our Website)

• Date and time of visits

• Cookie identifiers and similar tracking data (see Section 7 below)

This data is collected through standard web analytics technologies and does not, in isolation, identify you as an individual.

3.3 Data from Third Parties

We may receive personal data about you from third parties in the following circumstances:

• From our group ventures (The Leisure Company and The Island Resorts Group) in connection with services we provide across the group

• From publicly available sources such as professional networking platforms (e.g. LinkedIn) in the context of recruitment or business development activities

• From referrals made by existing clients, partners, or associates

4. How We Use Your Personal Data

We process your personal data only where we have a lawful basis to do so. The purposes for which we process your data and the corresponding lawful bases are set out below.

Responding to enquiries: To respond to messages submitted via our contact form or received by email. Lawful basis: legitimate interests (responding to business enquiries); or, where applicable, performance of a contract.

Service delivery: To provide asset management, consultancy, project management, and related services to our clients and partners. Lawful basis: performance of a contract.

Recruitment: To evaluate candidates for roles within Winfinity Holdings or its group ventures. Lawful basis: legitimate interests; or consent where separately obtained.

Website analytics and improvement: To analyse how visitors use our Website so that we can improve its content and functionality. Lawful basis: legitimate interests (operating and improving our digital presence); subject to your cookie preferences.

Legal and compliance obligations: To comply with applicable laws, regulations, court orders, or regulatory requirements. Lawful basis: legal obligation.

Protecting legitimate interests: To protect the rights, property, and safety of Winfinity Holdings, our clients, partners, and the public. Lawful basis: legitimate interests.

We will not use your personal data for purposes that are incompatible with those stated above without first providing you with appropriate notice and, where required, obtaining your consent.

5. Disclosure of Your Personal Data

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share your personal data in the following circumstances:

5.1 Within the Winfinity Holdings Group

We may share your personal data with our group ventures, namely The Leisure Company (Pvt) Ltd and The Island Resorts Group, where this is necessary for the delivery of our services or the administration of our group operations. All intra-group transfers are governed by appropriate data sharing arrangements.

5.2 Service Providers

We engage third-party service providers who process personal data on our behalf, including:

• Website hosting and infrastructure providers (including GoDaddy)

• Web analytics providers

• Email and communication services

• Professional advisers (legal, accounting, and financial)

All service providers are required to process personal data only on our documented instructions and are contractually obligated to maintain appropriate security and confidentiality standards.

5.3 Legal and Regulatory Requirements

We may disclose your personal data where required or permitted by law, including in response to lawful requests by public authorities, regulatory bodies, or courts of competent jurisdiction in Sri Lanka or other applicable jurisdictions.

5.4 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of all or part of our assets or business, personal data held by us may be transferred to the relevant successor entity, subject to that entity assuming equivalent data protection obligations.

6. International Data Transfers

Winfinity Holdings operates primarily in Sri Lanka. Some of our service providers and group operations may involve the transfer of personal data to countries outside Sri Lanka. Where such transfers occur, we take appropriate steps to ensure that your personal data receives adequate protection, including:

• Relying on adequacy determinations where applicable

• Implementing standard contractual clauses or equivalent transfer mechanisms

• Ensuring that recipients are bound by appropriate contractual data protection obligations

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with specific cross-border transfer requirements, please contact us for further information regarding the safeguards applicable to your data.

7. Cookies and Tracking Technologies

7.1 What Are Cookies?

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites function efficiently and to provide analytical information to site owners.

7.2 Cookies We Use

Our Website uses the following categories of cookies:

Strictly necessary cookies: These are essential for the Website to function and cannot be disabled. They do not store any personally identifiable information.

Analytics cookies: We use website analytics tools to understand how visitors interact with our Website. This data is aggregated and used solely to improve site performance and content. We use GoDaddy Website Builder's built-in analytics for this purpose.

7.3 Your Cookie Choices

When you first visit our Website, you will be presented with a cookie notice. By clicking "Accept", you consent to the use of analytics cookies. You may withdraw this consent at any time by adjusting your browser settings to block or delete cookies. Please note that disabling cookies may affect the functionality of certain parts of the Website.

Most web browsers allow you to manage cookie preferences through their settings. Instructions for doing so can be found in your browser's help documentation.

8. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general retention periods are as follows:

• Enquiry and contact form data: up to 2 years from the date of last contact, unless a business relationship is established

• Client and partner data: for the duration of the engagement and up to 7 years thereafter, in accordance with applicable legal and regulatory requirements

• Recruitment data: up to 12 months from the conclusion of the relevant recruitment process, unless you are engaged by us

• Website analytics data: as determined by the relevant analytics provider, typically up to 26 months

• Legal, compliance, and financial records: as required by Sri Lankan law, typically up to 7 years

At the end of the applicable retention period, personal data will be securely deleted or anonymised.

9. Your Rights Under the Personal Data Protection Act

As a data subject under the Personal Data Protection Act No. 9 of 2022 of Sri Lanka, you have the following rights in relation to your personal data:

Right of access: You have the right to request confirmation of whether we process your personal data and, if so, to receive a copy of that data.

Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.

Right to erasure: You have the right to request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and there is no other lawful basis for processing.

Right to restriction: You have the right to request that we restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data.

Right to object: You have the right to object to processing based on legitimate interests where you believe your interests override ours.

Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Right to lodge a complaint: You have the right to lodge a complaint with the Data Protection Authority of Sri Lanka, once established under the PDPA, or with a competent supervisory authority in your jurisdiction.

To exercise any of these rights, please contact us using the details in Section 11 below. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures are reviewed periodically and updated as appropriate.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee its absolute security. In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant authorities and affected individuals in accordance with our obligations under the PDPA.

11. Third-Party Websites and Links

Our Website may contain links to websites operated by third parties, including our group ventures and partner organisations. This Privacy Policy applies only to our Website. We are not responsible for the privacy practices of third-party websites and encourage you to review the privacy policies of any sites you visit via links on our Website.

12. Children's Privacy

Our Website and services are directed at business professionals and are not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected information from a minor, please contact us immediately and we will take prompt steps to delete such data.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or operational requirements. Any material changes will be posted on this page with an updated effective date. We encourage you to review this Policy periodically.

Where changes are material and we hold your contact details, we will make reasonable efforts to notify you directly.

14. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or have concerns about how we handle your personal data, please contact us at:

Winfinity Holdings (Pvt) Ltd Colombo, Sri Lanka https://winfinityholdings.com/contact-us

We aim to respond to all data protection enquiries within 30 days of receipt. If your enquiry is complex or you have made multiple requests, we will notify you of any extension to this period within the initial 30 days.

Winfinity Holdings (Pvt) Ltd  |  Colombo, Sri Lanka  |  winfinityholdings.com

Personal Data Protection Act No. 9 of 2022 (Sri Lanka) Compliant