Privacy Notice

Effective Date: 09/03/2026

Last Updated: 09/03/2026

Introduction

Alumex PLC (collectively “Alumex”, “we”, “us”, or “our”) is a subsidiary of Hayleys PLC and Sri Lanka’s foremost manufacturer of aluminium extrusions and value-added aluminium solutions. We are committed to protecting the privacy and confidentiality of the personal information you share with us.

This Privacy Notice explains how we collect, use, disclose, store, and protect personal information obtained through our website www.alumexgroup.com (the “Site”), our showrooms, factories, and other facilities, and through your interactions with us via phone, email, social media, our career portal, or in person. It also describes your rights regarding your personal information and how you may exercise them.

By visiting our Site, submitting your information to us, or otherwise engaging with Alumex, you acknowledge that you have read and understood this Privacy Notice. This Notice is issued in line with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka (“PDPA”) and other applicable data protection laws.

You are not required to share personal information with us simply to browse our Site. However, certain services, such as requesting a quotation, submitting a job application, registering as a fabricator/dealer, or contacting our support team, will require you to share certain personal information with us.

Who This Notice Applies To

This Notice applies to personal information we collect from:

Website visitors browsing www.alumexgroup.com and related Alumex Group domains and
micro-sites (e.g., product and brand pages linked from our Site);
Customers and prospective customers requesting quotations, purchasing products, or engaging
with our sales and customer service teams;
Business partners, suppliers, and fabricators/dealers engaging with us in a commercial capacity;
Job applicants and candidates applying for career opportunities with Alumex, including through our
Careers page;
Visitors to our factories and premises, including those captured on CCTV for security purposes; and
Any other individual who otherwise communicates or interacts with Alumex.

Alumex PLC, within the wider Hayleys Group, may have specific requirements relating to the collection of your personal information, which may be communicated to you independently at the point of collection.

Personal Information We Collect

“Personal Information” means any information that identifies or can be used to identify you, directly or indirectly. Depending on how you interact with us, we may collect the following categories of personal information:

Identification and contact data

Your name, National Identity Card (NIC) or passport number, date of birth, and gender;
Your address, telephone number, and email address; and
Business/commercial details such as your company name, designation, and business address, where you engage with us on behalf of an organisation.

Financial data

Billing and invoicing details, bank account information, and payment records provided in connection with quotations, purchases, or supplier/dealer arrangements. We do not store full payment card details; these are processed securely by our payment partners.

Usage and technical data

Technical data such as your IP address, browser type and version, device information, and operating system; and
Usage data such as the pages you visit, time spent on our Site, referral source, and click-stream data, collected through cookies and similar tracking technologies (see Section 7 below).

Enquiry, transaction, and relationship data

Enquiry, order, and transaction details, including product specifications, quotation requests, and purchase history;
Career and employment-related information, such as your Curriculum Vitae (CV), educational qualifications, work experience, and references, when you apply for a position through our Careers page;
Feedback, testimonials, survey responses, or complaints you choose to share with us; and
Any other information you voluntarily provide when corresponding with us by phone, email, social media, or post.

Surveillance data

CCTV footage where you visit our factories, showrooms, or other premises for the purposes of security and safety.

Information we receive from other sources

Information from Hayleys Group companies, business partners, or publicly available sources, where relevant and permitted by law; and
Information from third-party service providers who assist us in operating our Site or delivering our services.

We do not intentionally collect any special category or sensitive personal data (such as health data, biometric data, or religious beliefs) unless it is voluntarily provided by you or is otherwise necessary and lawful, for example, in connection with employment or workplace safety obligations.

Legal Bases for Processing Your Personal Information

We only collect and process your personal information where we have a valid legal basis for doing so under the PDPA and other applicable law. Depending on the context, this includes:

Consent — where you have given us clear, informed consent to process your personal information for a specific purpose, such as receiving marketing communications;
Contract — where processing is necessary to enter into, or perform, a contract with you, such as fulfilling a quotation, order, or supplier/dealer agreement;
Legal obligation — where we are required to process your personal information to comply with an obligation under applicable law, regulation, or a request from a competent authority;
Legitimate interests — where processing is necessary for our legitimate business interests, such as improving our Site, safeguarding our premises through CCTV, or managing our commercial relationships, provided this does not override your rights and interests; and
Vital interests — in rare circumstances, where processing is necessary to protect your life or physical safety or that of another individual, such as during an emergency at our premises.

Where we rely on your consent, you have the right to withdraw it at any time, as set out in Section 11 below.

Purpose Limitation

We collect and use your personal information only where it is relevant and limited to what is necessary for the specific purpose for which it was collected, and we use it strictly for that intended purpose. We do not use your personal information for any purpose materially different from those described in this Notice without notifying you and, where required, obtaining your consent.

How We Use Your Personal Information

We use your personal information for the following purposes:

To respond to your enquiries and provide requested quotations, product information, or customer support;
To process and fulfil orders, including invoicing, delivery, and after-sales service;
To evaluate job applications and manage the recruitment process;
To maintain and improve our Site, including its content, layout, and functionality;
To personalise your experience and communicate relevant updates, products, or promotions, where you have consented to receive such communications;
To conduct internal reviews, analytics, and research to improve our products, services, and operations;
To manage our relationships with fabricators, dealers, suppliers, and other business partners;
To ensure the safety and security of our employees, visitors, and premises, including through CCTV monitoring;
To comply with applicable legal, regulatory, and statutory obligations; and
To detect, prevent, and address fraud, security, or technical issues.

Sharing and Disclosure of Personal Information

We treat your personal information as confidential and do not sell your personal information to third parties. We may, however, share your personal information in the following circumstances:

Within the Alumex PLC and Hayleys Group, with our subsidiaries, affiliates, and Hayleys Group companies for internal administrative, operational, or reporting purposes;
With fabricators, dealers, and business partners, where necessary to fulfil your request, such as connecting you with an authorised fabricator in your area;
For legal and regulatory reasons, where required to comply with applicable law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Alumex, our employees, or the public; and
In connection with a corporate transaction, such as a merger, acquisition, restructuring, or sale of assets, in which case personal information may be transferred as part of that transaction, subject to appropriate confidentiality arrangements.

Processors and Sub-processors

We engage trusted third-party processors to handle personal information on our behalf, strictly in accordance with our written instructions and for the purposes we specify. These include:

IT infrastructure and website hosting providers;
Payment processors and financial institutions;
Logistics, freight, and delivery partners;
Marketing, advertising, and analytics agencies; and
Professional advisors, such as auditors and legal counsel.

Where a processor engages a sub-processor to assist in delivering their services, we require that the same data protection obligations set out in our agreement with the processor be imposed on the sub-processor. All processors and sub-processors are contractually bound to keep personal information secure, to use it only for the specified purposes, and to process it in accordance with this Notice and applicable law.

We do not permit any third party to use your personal information for their own independent marketing purposes without your consent.

Cookies and Similar Technologies

Our Site uses cookies and similar tracking technologies to enhance your browsing experience, understand how visitors use our Site, and improve our content and services. Cookies may collect information such as your domain name, browser type, and browsing patterns.

You can control or disable cookies through your browser settings; however, please note that disabling cookies may affect the functionality of certain features on our Site.

International Data Transfers

As Alumex PLC and our service providers may operate outside Sri Lanka, your personal information may be transferred to, stored, and processed in other jurisdictions. Where this occurs, we take appropriate steps to ensure that your personal information continues to receive an adequate level of protection consistent with this Notice and applicable data protection laws.

Data Retention

We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. When your personal information is no longer required, we will securely delete, anonymise, or otherwise dispose of it in accordance with our internal data retention practices.

Data Security

We are committed to protecting your personal information and have implemented appropriate technical and organisational measures to safeguard it against unauthorised access, alteration, disclosure, loss, or destruction. Access to personal information is restricted to authorised personnel and agents who have a legitimate business need and who are bound by confidentiality obligations.

Please note that no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security, particularly when transmitted via email or other electronic means. We encourage you not to share highly sensitive information (such as financial account details) with us via unsecured channels.

Your Data Subject Rights

Subject to applicable law, you have the following rights in relation to your personal information:

Right to access — to request confirmation of, and access to, the personal information we hold about you;
Right to correction — to request correction of any inaccurate or incomplete personal information;
Right to erasure — to request deletion of your personal information, subject to any legal or contractual retention requirements;
Right to withdraw consent — to withdraw any consent you have previously given for the processing of your personal information, at any time;
Right to restrict or object to processing — to request that we limit how we use your personal information, or to object to certain processing activities, including for direct marketing purposes;
Right to data portability — to request, where technically feasible, that your personal information be provided to you or transferred to another service provider in a structured, commonly used format; and
Right to lodge a complaint — to raise concerns with us directly or to lodge a complaint with the Data Protection Authority of Sri Lanka.

Please note that withdrawing consent, or requesting the deletion or restriction of certain information, may affect our ability to provide you with products, services, or timely responses to your enquiries.

To exercise any of these rights, please contact us using the details provided in Section 15 below. We may require you to verify your identity before processing your request, and we will respond within a reasonable period as required by applicable law.

Children's Privacy

Our Site is not directed at, nor intended for use by, children. We do not knowingly collect personal information from individuals under the age of 16. If you believe we have inadvertently collected personal information from a minor, please contact us so that we may take appropriate steps to delete such information.

Children's Privacy

Third-Party Links

Our Site may contain links to third-party websites, including those of our business partners, fabricators, or Hayleys Group companies. This Privacy Notice does not apply to such third-party websites, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policies of any third-party website you visit.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Notice or how we handle your personal information, please contact us at:

We will endeavour to respond to your query within a reasonable period of time.

Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, technology, legal requirements, or other operational reasons. Any changes will be posted on this page along with the updated “Last Updated” date. Where changes are material, we will take reasonable steps to notify you, such as through a prominent notice on our Site. We encourage you to review this Notice periodically to stay informed of how we protect your personal information.