Privacy Policy

1. Who we are

Zarubima (zarubima.lk) is operated by AnnFar Global (Private) Limited, company registration number PV00367114, of 22/4, Peterson Tower, Havelock City, Havelock Road, Colombo 05, Sri Lanka ("AnnFar Global", "we", "us").

Zarubima is where Sri Lanka's licensed commercial banks and other financial institutions (each a Seller/Institution) publish property they are selling, and where agents verified by AnnFar Global bring buyers to it.

Privacy contact: info@annfarglobal.com (subject "Data protection") · +94 76 8686 234 · the address above.

2. Who is responsible for your data

• AnnFar Global decides how Zarubima works and is responsible for the data the platform itself collects: accounts, agent registrations, enquiries, the waitlist, messages to us, the platform's records, and its security logs.
• Each Seller/Institution also uses the data of the people it deals with on its own sales, for example a buyer's name and identification once an offer is made on its property, under its own legal duties as a licensed commercial bank or other financial institution. AnnFar Global and each Seller/Institution are separate controllers, each responsible for its own purposes.

3. What we collect, and from whom

Everyone who visits. We set one cookie, and only when you sign in (§9). We use no analytics, advertising or tracking tools. Our web servers and security systems see your IP address. We keep it where §6 says.

If you send an enquiry about a property. Your name, phone number, and (if you give them) your email address and message. We also record the IP address and browser details the enquiry came from, seen only by AnnFar Global, to stop abuse.

If you join the waitlist. Whether you are a private owner or a developer, your name, your email address or phone number, and (if you give it) a district.

If you write to AnnFar Global through the contact form. Who you are writing as, your name, your organisation (if you give it), your email address, your phone number (if you give it), and your message.

If you register as an agent. Your name, email address, password (we store only a one-way hash), phone number, company name, National Identity Card number, business registration number (if you have one), your bank account for paying your commission (branch, account name and account number), the districts you cover, and the documents you upload for verification (photograph, NIC, driving licence, passport, proof of bank account).

If you buy, or make an offer through an agent. Your name, phone number, email address, and an identification number: your NIC, passport, or (for a company) company registration number.

If you work for a Seller/Institution or for AnnFar Global. Your name, email address, phone number (if you add it), your role and branch, your password hash, and (if you turn it on) your two-step sign-in secret.

Records of what happens on a sale. Offers and counter-offers. Viewings and their arrangements. The Property Offer Acceptance Record, the Property Transaction MoU, and the Transaction Completion Record. Payment confirmations and proofs of payment. Each record carries the names of the people who took each step, and those names stay on the record even if the person's account is later removed.

Records of what people do on the platform. For security and accountability we log significant actions: who did what, when, from which IP address and browser. These logs cannot be edited.

We do not collect data about the borrowers whose loans led to a sale, and we do not publish it.

4. Why we use it, and on what basis

We do not sell personal data, use it for advertising, or make decisions about you by automated means alone. The six-month check only alerts a person at AnnFar Global, who decides what happens.

If you do not give an identification number when you make an offer, the sale cannot be recorded. If an agent does not give the registration details, we cannot verify them.

5. Who sees it

• The Seller/Institution selling a property sees enquiries about it (without the enquirer's contact details). Once an offer is made, it sees the buyer's name, phone, email and identification, and the agent's details.
• The agent handling an enquiry or a sale sees the buyer's contact details for it.
• AnnFar Global's staff can see what they need to run the platform, verify agents and resolve problems.
• The parties to a sale receive its acceptance record and MoU, by email and as PDF documents. These show names, phone numbers and identification numbers in full, because they are the record of who agreed to what.
• Anyone holding a buyer's MoU link can open that MoU until it is accepted or expires (seven days). The link is sent only to the buyer's email address.
• The public sees listings without any personal data (§7).
• Authorities, when the law requires it.

6. Service providers, and where data is held

We use these providers to run Zarubima. They process data only on our instructions.

This means your data is held outside Sri Lanka. We choose providers with strong security, bind them by contract, and will rely on the safeguards the Data Protection Authority specifies for transfers abroad.

7. What is public

• Listings show the ZB code, the Seller/Institution's own file reference, district, property type, extent, floor area, asking price and photographs. They show no address and no people.
• Record verification (/verify): someone who has a record's code sees only the code, the sale's ZB reference, the property's ZB reference, the date issued (and completed), and the accepted price. It names no buyer, Seller/Institution, agent or officer. Record codes are random, and the page is not indexed by search engines.

8. How long we keep it

When a period ends, we delete the data or remove what identifies you from it.

9. Cookies

One cookie, assetlink_session, set only when you sign in. It keeps you signed in for up to 12 hours, cannot be read by scripts on the page, and holds a random token that is stored in our database only as a one-way hash. It is strictly necessary, so we do not ask for consent to it. We use no other cookies. Our fonts are served from our own site, so your browser does not contact Google or anyone else when you visit.

10. How we protect it

• Every table is guarded by database row-level security, so each person's access is decided by the database itself, not only by the application.
• Agents' NIC numbers and bank account numbers, and two-step sign-in secrets, are encrypted in the database.
• Passwords are stored only as one-way hashes, must be at least 12 characters, are checked against known leaks, and repeated failed sign-ins lock the account for 15 minutes.
• Two-step sign-in is available to every account.
• Uploaded documents are only ever reached through links that expire within a minute.
• Links in emails (account invitations, MoU links) are single-purpose, expire, and are stored only as hashes.

No system is perfectly secure. If a breach puts your data at risk, we will tell the Data Protection Authority and, where the risk to you is high, we will tell you, as the law requires.

11. Your rights

You can ask us:

• for a copy of the personal data we hold about you;
• to correct it;
• to delete it, where we are not required to keep it (for example, a completed sale's records must be kept for the period in §8);
• to stop or limit using it, or object to our using it on the basis of legitimate interest;
• to withdraw consent you gave, such as joining the waitlist, at any time.

Write to the privacy contact in §1. We will check it is you and answer within the time the law allows. It costs nothing. For data a Seller/Institution holds for its own sale, we will pass your request to it.

If you are not satisfied, you can complain to the Data Protection Authority of Sri Lanka (dpa.gov.lk).

12. Children

Zarubima is not for anyone under 18. We do not knowingly collect children's data.

13. Changes

When this policy changes, we will publish the new version here with its effective date. If a change affects how we use data you have already given us, we will tell registered users by email before it takes effect.