Privacy

Who we are

CeylonFunds publishes a comparison of unit trusts licensed by the Securities and Exchange Commission of Sri Lanka. We are an independent publisher and a registered introducer for participating fund managers. We are not a licensed investment adviser, we do not manage money, and we do not act as an agent for any fund manager. Where you ask to be introduced to one, we may receive a referral fee from them.

We are the controller of the personal data described on this page. For anything relating to it, see Contact or call 071 579 3991.

If you only read the site

You do not need an account, and we do not ask for anything. Two things still happen in your browser, and you can switch both off.

Our own usage measurement

We record which pages and funds get looked at, so we know what to improve. This does not use your name, your IP address, or any fingerprint of your device. It uses a random identifier generated in your browser and stored there under cf:anon. Clearing your browser storage makes you a genuinely new visitor to us, because that random value is all we had.

The data goes only to our own servers. It is never sold, and it is not shared with any advertising network or data broker. Raw records are deleted automatically 400 days after they are written.

We honour your browser’s “Do Not Track” setting. If it is on, we record nothing.

Google Analytics

We also use Google Analytics (property G-57G6DVGT93) to understand how people find the site. It sets cookies in your browser named _ga and _ga_…, and it sends Google the page you are on, the page you came from, and an approximate location derived from your IP address. Google processes this as our processor and under its own privacy policy.

Google Analytics does not run on our administration pages, so nothing about a lead is ever sent to Google. You can block it with any tracker-blocking extension or by refusing cookies for this site; the site works normally either way.

Other things stored in your browser

A few small flags remember what you have already chosen or already seen: light or dark, whether the introduction has been shown, whether the chart has finished its opening animation. They are stored by your browser, they never leave your device, and they are not sent to us. If you sign in, we set a signed session cookie so that you stay signed in; it cannot be read by scripts on the page and it expires on its own.

If you ask to be introduced to a fund manager

This is the only place we collect personal details, and it only happens if you submit the form and tick the consent box. We record:

• your name, email address, and optionally your phone number and city
• the fund categories you said you were interested in
• a broad band for the amount you had in mind, and roughly how long for
• how you would prefer to be contacted
• which fund or page you were on when you asked
• the exact consent wording you agreed to, the time you agreed, and the IP address and browser you agreed from

That last item exists to protect you as much as us. If it is ever disputed whether you agreed to be contacted, we can show precisely what you were shown and when.

What we deliberately never ask for

We do not collect your NIC number, your address, your bank or card details, your income or net worth, a signature, or any uploaded document. There is nowhere on this site to give us those, and we will never ask for them by phone or on WhatsApp either. We also never take payment. The amount you tell us is a broad band, never an exact figure, and prefer not to say is always an option.

A fund manager will need some of that information to open an account for you. They collect it themselves, directly from you, under their own regulated process. If anybody contacts you claiming to collect it on our behalf, they are not us.

Who your details are shared with

The fund manager you selected, and only that one. We pass them your name, contact details and stated preferences under our introducer code so they can contact you about their products. We do this only after you have consented, and we log the handover.

We do not sell your details, we do not share them with other fund managers, and we do not pass them to advertisers or data brokers. The only other parties who touch your data are the suppliers who run the service for us: our hosting provider, our email provider for messages we send you, and Google Analytics as described above. They act on our instructions and for no other purpose.

If you also ticked the separate optional box for fund updates and educational email, that is a second, distinct permission. Declining it does not affect your introduction, and you can unsubscribe from any such email.

How long we keep it

Anonymous usage records are deleted automatically 400 days after they are written.

Enquiry records are kept while we are acting on them and afterwards as the record of a referral and its commission, which we may need for accounting and to answer a question from a fund manager or a regulator. If you withdraw consent we mark the record withdrawn, stop using it, and exclude it from everything we send to fund managers. If you ask us to delete it outright, we do.

Your rights

Under Sri Lanka’s Personal Data Protection Act you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, and withdraw a consent you previously gave. Withdrawing consent does not undo anything already done with it, but it stops anything further.

Ask by any of the routes on our contact page. We will not ask you to prove your identity with a document; if we need to check it is you, we will do it from the details already on the record. We aim to answer within 30 days.

If a fund manager has already received your details, they hold their own copy under their own privacy policy. We will tell you who and when, so you can ask them directly.

Security, and changes to this page

The site is served over HTTPS, enquiry records are restricted to the small number of people who action them, and access to them is logged. The strongest protection is that we hold so little: there is no document store, no payment data and no identity document to lose.

If we change what we collect or who it goes to, we will change this page and the consent wording with it. The wording in force is version consent_v1, and every enquiry record stores the version and a fingerprint of the exact text that person agreed to, so an older consent is never quietly reinterpreted under newer wording.