Legal & Privacy



This privacy notice describes how BDO Sri Lanka ('we', 'us') collects and processed personal information about you; how we use and protect this information, and your rights in relation to this information.
This privacy notice applies to all personal information we collect about you. Personal information is information, or a combination of pieces of information that could reasonably allow you to be identified.  

1. Information we collect
We may collect your personal information from a variety of sources, including information we collect from you directly (e.g. when you contact us and provide services to us), and information we collect about you from other sources, including commercially available sources, such as public databases (where permitted by law).
Certain personal information is required as a consequence of any contractual relationship we have with you or your employer, to enable us to carry out our contractual obligations to you or your employer. Failure to provide this information may prevent or delay the fulfilment of these obligations.
Information we collect directly from you

The categories of information that we may collect directly from you include the following:

  • personal details (e.g. name, age, date of birth);
  • contact details (e.g. phone number, email address, postal address or mobile number);
  • employment details (e.g. job title; employer name);
  • Other personal details required for the engagement (where applicable)
  • Information we collect from other sources


The following are examples of the categories of information we may collect from other sources. These sources include your employer, and public websites.

  • personal details (e.g. name, age, date of birth);
  • contact details (e.g. phone number, email address, postal address or mobile number);
  • other personal details required for the engagement (where required)


2. How we use your personal information and the basis on which we use it
We use your personal information to:

  • carry out background checks prior to accepting you as a client;
  • contact you with questions and other information regarding the services we are providing to you;
  • ensure that our records are kept accurate and up to date where you, your employees or contractors work on or visit our facilities;
  • ensure we issue accurate invoices for our services;
  • send you messages about products and services which we think will be of interest to you;
  • comply with legal obligations to which we are subject
  • any other requirement where performing the engagement


We must have a legal basis to process your personal information. In most cases the legal basis will be one of the following:

  • to fulfil our contractual obligations to you, for example to ensure that invoices are issued correctly, and for ensuring you are able to access our premises when required;
  • to comply with our legal obligations to you, for example health and safety obligations while you are on our premises, or to a third party ( e.g to comply with a court order);
  • to meet our legitimate interests so that: we are able to provide the services you request; our services function correctly in relation to your business; any complaints or concerns can be promptly relayed to you; we can respond to any questions or concerns you might have; we may carry out research and analysis to ensure products and services we offer are relevant to you, and; our records are kept up to date and accurate. When we process your personal information to meet our legitimate interests we put in place robust safeguards to ensure that your privacy is protected and to ensure that our legitimate interests are not overridden by your interests or fundamental rights and freedoms. For more information about the balancing test that we carry out to process your personal information to meet our legitimate interests or if you want to object to these uses of your personal information, please contact us at the details below; and
  • send you direct electronic marketing messages to the extent you have consented to receiving such messages in accordance with applicable law.


3. Your rights over your personal information
Please let us know if any of the personal information that we hold about you changes so that we can correct and update the information on our systems.
[You can view, delete, correct or update the personal information you provide to us by sending us an email to bdopartners@bdo.lk.
In certain circumstances you may object to specific processing activities (including where we rely on our legitimate interests as set out above, require us to restrict how we process your personal information and ask us to share your personal information in a usable format with another company.  Where you have given your consent to a particular type of processing, you may withdraw that consent at any time.
To exercise any of the above rights, please contact us using the contact details set out below.

4. Information sharing
In general, we do not share your personal information with third parties (other than service providers acting on our behalf) unless we have a lawful basis for doing so.
We rely on third-party service providers to perform a variety of services on our behalf, such as website hosting, electronic message delivery, payment processing, data analytics and research. This may mean that we have to share your personal information with these third parties. When we share your personal information in this way, we put in place appropriate measures to make sure that our service providers keep your personal information secure.
Other situations in which we may disclose your personal information to a third party, are:

  • perform other services we request from service providers;
  • in the course of a sale or an acquisition of a [member firm], any shares in [member firm] or any of [member firm’s] assets;
  • where permitted by law, to protect and defend our rights and property; and
  • when required by law, and/or public authorities;
  • where it is required by any engagement specific requirement

We may also share aggregated information that cannot identify you for general business analysis, e.g. we may disclose the number of visitors to its websites or services.

5. Information Security
We will keep your personal information for as long as we have a relationship with you. Once our relationship with you has come to an end, we will retain your personal information for a period of time that enables us to: maintain our business records for analysis and/or audit purposes; comply with record retention requirements under the law; defend or bring any legal claims; and deal with any complaints
We will delete your personal information when it is no longer required for these purposes. If there is any information that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further processing or use of the data.

6. Information Transfer
Your personal information may be transferred to, stored, and processed in a country other than the one in which it was provided. When we do so, we transfer the information in compliance with applicable data protection laws.
Where the transfer is to a country which provides a lower level of protection we take steps to ensure the security and confidentiality of your personal information in accordance with applicable data protection law, including using the [European Commission's approved Standard Contractual Clauses, [and for transfers to other BDO Member Firms, we use the BDO Global Privacy Policy, BDO’s Binding Corporate Rules for Controllers and Processors]. If you wish to see a copy of the relevant mechanism that we use to transfer your personal information, please contact us using the contact details set out below.

7. Contact Us
If you have questions or concerns regarding the way in which your personal information has been used, please contact bdopartners@bdo.lk.
We have also appointed a Data Protection Officer, who you can contact with questions about our uses of personal information at dinushar@bdo.lk.

8. Changes to the Privacy Notice
You may request a copy of this privacy notice from us using the contact details set out above. We may modify or update this privacy notice from time to time. You will be able to see when we last updated the privacy notice because we will include a revision date. Changes and additions to this privacy notice are effective from the date on which they are posted.

Last Updated [10th November 2025]


Cookie Policy
This web site is intended to provide general information on the BDO network, and the professional services and solutions provided by the BDO member firms around the world.
We gather information from users of this web site automatically and when you decide to provide us with information, for example, when you complete a form on www.bdo.lk . This information is treated with confidence and is only used by BDO as per the terms of the Privacy Policy.
We may use "cookies" to keep, and sometimes track, information about you.

Cookies
Cookies are small text files which are downloaded to your computer or mobile device when you visit a web site or application. Your web browser (such as Internet Explorer, Mozilla Firefox or Google Chrome) then sends these cookies back to the web site or application on each subsequent visit so that they can recognize you and remember things like personalized details or user preferences. Cookies do not damage your system. You can reset your browser to refuse any cookie or to alert you to when a cookie is being sent.
To improve your experience and to make our service to you better we use cookies for the purposes of system administration and analytics of our web site. This gives us information about the number of visitors to different parts of our web site.
BDO does not share this data with third parties. Our cookies do not store sensitive information such as your name or address, they simply just enable us to see behavior on the web site to help us improve your experience. However, if you’d prefer to restrict, block or delete cookies from www.bdo.in, or any other web site, you can use your browser to do this. Each browser is different, so check the ‘Help’ menu of your browser (or your mobile phone’s handset manual) to learn how to change your cookie preferences.

How to control my cookies
There are various ways that you can control and manage your cookies which are discussed in a bit more detail below. Please remember that any settings you change will not just affect www.bdo.in cookies. These changes will apply to all web sites that you visit (unless you choose to block cookies from web sites).

Managing cookies in my browser
Most modern browsers will allow you to:
  • See what cookies you’ve got and delete them on an individual basis
  • Block third party cookies
  • Block cookies from web sites
  • Block all cookies from being set
  • Delete all cookies when you close your browser
  • You should be aware that any preferences will be lost if you delete cookies. This includes where you have opted out from cookies, as this requires an opt-out cookie to be set. Also, if you block cookies completely many web sites will not work properly and some functionality on these web sites will not work at all.

Managing analytics cookies
It is possible to opt out of having your anonymized browsing activity within web sites recorded by analytics cookies. www.bdo.in uses Google Analytics and you can opt out of their cookies by visiting the Google Analytics opt-out page. Please note that this will take you to Google Analytics’ web site and generate a ‘no thanks’ cookie, which will stop any further cookies being set by those third parties.
 
Last Updated [April 2024]