1. Who is the data controller?

A data controller is the individual or legal person who controls and is responsible to keep and use personal data. Amana Takaful PLC and Amana Takaful Life PLC are the data controller as defined in the Act.

Amana Takaful PLC (PQ 23) No. 660-1/1, Galle Road, Colombo 03. Tel. 011750 1000

Amana Takaful Life PLC (PB 5202 PQ) No. 660-1/1, Galle Road, Colombo 03. Tel. 011750 1000

2. What personal data will be collected?

We will collect and process various types of personal data about you as follows:

• Full name, address, date of birth, gender, National Identity Card or passport details, telephone number, email address, banking information
• Your personal preferences, educational and professional experience and affiliations, financial and banking account information, and business activities
• Particulars of any third-party life assured or beneficiary, and any information which may identify you, any life assured, trustee or beneficiary
• Travel and expenses information
• Identification checks and background vetting
• Information relating to family, lifestyle, social circumstances, etc.
• Other information connected to the insured's risk evaluation and processing of insurance claims

We will also collect and process sensitive personal data about you such as, for example data resulting from medical reports or from death certificates, your claims history, your genetic or biometric data, any personal data consisting of information as to physical or mental health or condition, religious beliefs or other beliefs of a similar nature, and the commission or alleged commission of any offence.

3. The purposes for which your personal data may be processed

• To underwrite risks, assess claims and provide the most desired insurance solution or services as may be applicable, or for any future underwriting purposes, or to carry out any activity or duty as an insurer, including any regulatory, operational or internal management
• For any claim or investigation or analysis of such claim, including to ascertain your claims history in order to improve claims processing and prevent fraudulent claims, including any future claims assessment
• To manage and service Amana Takaful's relationship with you and to provide you with improved customer service
• For direct marketing and general marketing of insurance products and services of Amana Takaful and of third-party products, that may be of interest to you
• To research and audit including but not limited to historical and statistical purposes
• To prevent, investigate, or report any actual or suspected criminal or unlawful activities
• For reinsurance and coinsurance
• For litigation or potential litigation or to protect and defend the rights or property of Amana Takaful
• To comply with any law enforcement or court orders or legal process, or for the performance of a task imposed by or under any written law including the compliance of any notice, circular, direction or code or order issued by the government or regulatory or government authority
• In compliance with notices and or directions and or circulars and or orders issued by the Credit Information Bureau of Sri Lanka

We will process your personal data to enter into a contract with you, or to perform our obligations under an existing contract with you, or where it is needed to comply with a legal obligation.

Consent

By interacting with the Company, submitting information to the Company, enrolling or signing up for any products or services offered by the Company, you consent, and where required, explicitly consent, to such use of your personal information including sensitive personal data, in the manner set out in this notice.

Such consent and authorization herein shall extend to any information obtained from any of the insurance policy or policies presently provided to you, any new application to the Company for insurance, and claim processing, such historical financial or credit records, data or information whether or not provided personally.

You are at liberty to withdraw your consent above mentioned anytime by communicating the same in writing to the Data Protection Officer mentioned hereunder.

Data Protection Officer Amana Takaful No. 660-1/1, Galle Road, Colombo 03. Tele: 011 750 1000

4. Who will have access to your personal data?

We will ensure that your personal data is processed in a manner that is compatible with the purposes indicated above.

For the stated purposes, your personal data may be disclosed to the following parties who operate as third party data controllers:

Public or government authorities, other insurers, co-insurers, re-insurers, insurance intermediaries or brokers, banks, Credit Information Bureau of Sri Lanka.

For the stated purposes, we may also share your personal data with the following parties who operate as data processors under our instruction:

Other Amana Takaful Group companies, technical consultants, experts, lawyers, loss adjustors, repairers, medical doctors, and service companies to discharge operations such as claims, IT, postal, document management; and advertisers and advertising networks to send you marketing communications, as permitted under local law and in accordance with your communication preferences.

We do not share your personal data with non-affiliated third parties for their own marketing use without your permission.

Finally, we may share your personal data in the following instances:

• In the event of any contemplated or actual reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock, including in any insolvency or similar proceedings
• To meet any legal obligation, including to the relevant ombudsman if you make a complaint about the product or service we have provided to you

5. What are your rights in respect of your personal data?

Where permitted by applicable law or regulation, you have the right to:

• Access your personal data held about you and to learn the origin of the data, the purposes and ends of the processing, the details of the data controller or controllers, the data processor or processors and the parties to whom the data may be disclosed
• Withdraw your consent at any time where your personal data is processed with your consent
• Update or correct your personal data so that it is always accurate
• Delete your personal data from our records if it is no longer needed for the purposes indicated above
• Restrict the processing of your personal data in certain circumstances, for example where you have contested the accuracy of your personal data, for the period enabling us to verify its accuracy
• Obtain your personal data in an electronic format for you or for your new insurer
• File a complaint with us and or the relevant data protection authority

6. How can you object to the processing of your personal data?

Where permitted by applicable law or regulation, you have the right to object to us processing your personal data or, tell us to stop processing it, including for purposes of direct marketing. Once you have informed us of this request, we shall no longer process your personal data unless permitted by applicable laws and regulations.

You may exercise this right in the same manner as for your other rights indicated above.

7. How long do we keep your personal data?

We are committed to keep your personal data only so long as necessary to fulfil the purposes for which the data was collected for or to fulfil legal obligations. We will not retain your personal data for longer than necessary and we will hold it only for the purposes for which it was obtained.

8. Additional Information

Should you have any questions on any part of this privacy notice or would like additional information regarding Amana Takaful's data privacy practices please do not hesitate to contact us by the contact details above.