Privacy Policy - CMB RENTALS

Last updated: 13 September 2026

CMBRENTALS (PVT) LTD, trading as CMB RENTALS (“CMB RENTALS”, “we”, “us” or “our”), respects your privacy. This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you visit cmbrentals.lk, create an account, save a property, submit a property inquiry, advertise a property or communicate with us.

By using our website or voluntarily providing personal data, you acknowledge that your information will be handled as described in this Privacy Policy. Where consent is legally required, we will request it separately.

1. Who We Are

CMBRENTALS (PVT) LTD, trading as CMB RENTALS, is responsible for determining how personal data collected through this website and our rental-related services is processed.

Contact address: 12, 10 Abdul Caffoor Mawatha, Colombo 03, Sri Lanka.
Email: hello@cmbrentals.lk
Telephone: +94 77 217 1722

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data collected through:

Our website and property listings;
Account registration, login, password-reset and saved-favourite features;
Property inquiry and contact forms;
Telephone calls, email, WhatsApp and Telegram communications;
Property-owner, landlord, agent and representative submissions;
Viewings, negotiations, reservations and rental-related services; and
Cookies, security logs and similar website technologies.

Third-party websites and services linked from our website have their own privacy practices. We are not responsible for how an independent third party processes personal data, and you should review its privacy policy before providing information.

3. Personal Data We May Collect

Depending on how you interact with CMB RENTALS, we may collect the following categories of personal data:

Contact and identification information

Name, telephone number, email address and communication preferences;
Nationality, residency status, occupation or identification details where reasonably required for a viewing, reservation, tenancy or legal verification;
Information required to verify that a person is authorised to advertise, manage or rent a property.

Account information

Email address, username, account identifiers and authentication information;
Saved properties, favourites and account preferences;
Account activity and security-related records.

Property and rental information

Properties viewed, searched for, saved or inquired about;
Preferred location, property type, furnishing status, budget, move-in date and rental requirements;
Property descriptions, addresses, photographs, ownership or authority information supplied by owners, landlords, agents or representatives;
Viewing, reservation, negotiation and tenancy-related communications;
Transaction references, deposits, commissions or payment records where relevant. Unless expressly stated, we do not directly collect or store complete payment-card information through this website.

Communication information

We may retain messages and information provided through contact forms, email, telephone, WhatsApp, Telegram or other communication channels, including the date, time, subject and content of the communication.

Technical and website information

IP address, browser type, device type, operating system and approximate location derived from technical information;
Pages visited, links used, referring pages, session information and timestamps;
Cookie preferences, account-security events, error reports and server logs;
Information reasonably required to prevent fraud, abuse or unauthorised access.

4. How We Collect Personal Data

We may collect personal data:

Directly from you when you contact us, create an account, save a property, request a viewing, submit an inquiry or provide a property listing;
From landlords, property owners, agents, authorised representatives or business partners involved with a property;
From publicly available property or business sources where collection and use are lawful;
Automatically through cookies, server logs and website technologies;
From service providers that assist us in operating the website or responding to inquiries.

If you provide personal data relating to another person, you must have lawful authority to provide that information and, where required, inform that person about this Privacy Policy.

5. Why We Use Personal Data

We may process personal data for the following purposes:

Responding to property inquiries and arranging viewings;
Matching prospective tenants or customers with relevant properties;
Connecting customers with landlords, property owners, agents or authorised representatives;
Creating, maintaining and securing user accounts;
Providing saved-property and favourite-property functionality;
Advertising, updating, verifying and managing property listings;
Assisting with rental negotiations, reservations, documentation and related services;
Communicating through email, telephone, WhatsApp, Telegram or other requested channels;
Maintaining business, accounting, contractual and legal records;
Preventing fraud, misleading listings, misuse and security incidents;
Improving website performance, functionality and customer experience;
Establishing, exercising or defending legal claims;
Complying with legal, regulatory, court or governmental requirements;
Sending promotional communications where you have consented or where otherwise permitted by law.

We will not sell personal data. We will not use personal data for a materially different and incompatible purpose without providing appropriate notice and, where required, obtaining consent.

6. Legal Basis for Processing

Depending on the circumstances and applicable law, we may process personal data because:

You have provided consent;
Processing is necessary to take steps requested by you before entering into a contract;
Processing is necessary to perform a contract;
Processing is necessary to comply with a legal obligation;
Processing is necessary for our legitimate interests or those of a third party, provided those interests do not override your rights;
Processing is required to prevent fraud, protect network and information security, or establish, exercise or defend legal claims;
Another lawful basis recognised by applicable law applies.

Our legitimate interests may include operating and securing the website, responding to expected customer inquiries, managing property listings, keeping appropriate business records and protecting CMB RENTALS, its customers and property representatives against fraud or misuse.

7. Property Listings and Public Information

Property descriptions, photographs, approximate locations, prices, facilities and contact-related information intended for advertising may be displayed publicly on the website. Property owners, landlords, agents and representatives must ensure that they have lawful authority to provide such information and images for publication.

We may edit, restrict, suspend or remove content that appears inaccurate, misleading, unauthorised, unlawful or harmful. However, property information supplied by third parties may change, and users should independently verify availability, ownership, price and contractual terms before making a payment or commitment.

Do not submit identity cards, bank statements, tenancy agreements, private photographs or other sensitive documents through a public property-description field.

8. Sharing Personal Data

We may share personal data only where reasonably necessary with:

The landlord, property owner, agent or authorised property representative connected with an inquiry;
Prospective tenants or customers where an owner or representative has authorised us to share relevant information;
Website hosting, email, IT, cybersecurity, account-management and technical-service providers;
Communication and social-media services such as WhatsApp, Telegram and social-sharing providers when you choose to use those services;
Professional advisers, including accountants, auditors, insurers and lawyers;
Government authorities, regulators, law-enforcement bodies and courts where disclosure is legally required or reasonably necessary to protect legal rights;
A purchaser, investor or successor in connection with a proposed or completed sale, merger, restructuring or transfer of all or part of our business, subject to appropriate confidentiality safeguards.

Service providers acting on our behalf should process personal data only for agreed purposes and with appropriate confidentiality and security obligations.

CMB RENTALS does not sell or rent personal data to third parties.

9. WhatsApp, Telegram and Social Media

If you contact us through WhatsApp, Telegram or another social-media service, that provider may process your telephone number, username, message content, device information and other information under its own privacy terms.

We may retain relevant communications where reasonably necessary to respond to an inquiry, maintain business records, prevent fraud or establish and defend legal claims. You should avoid sending sensitive documents through these services unless requested through an approved channel.

10. Cookies and Similar Technologies

Our website may use cookies and similar technologies for:

Essential website operation and security;
Account login and session management;
Remembering preferences and cookie choices;
Measuring website performance and usage;
Supporting social-sharing and communication functionality;
Analytics or marketing where enabled and lawfully permitted.

Essential cookies may be used where necessary to provide the website or a feature requested by you. Where consent is required for non-essential cookies, you can accept, reject or adjust your choices through our cookie-consent tool. You may also restrict cookies through your browser, although some website features may not function correctly.

Our website may use tools or components including WordPress, Estatik, SureCookie and AddToAny. These technologies may process technical, account, preference or interaction information depending on how they are configured and used.

11. International and Cross-Border Processing

Some technology, hosting, email, communication, social-media or professional-service providers may process personal data outside Sri Lanka. This may include communication through international services such as WhatsApp or Telegram.

Where personal data is transferred or processed outside Sri Lanka, we will take reasonable steps to use an applicable legal basis and appropriate safeguards as required by the law in force at that time. These safeguards may include contractual commitments, security controls, consent where legally appropriate, or another legally recognised transfer mechanism.

12. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including providing services, managing inquiries and accounts, maintaining records, resolving disputes, preventing fraud and meeting legal, accounting or regulatory requirements.

Retention is determined by factors including:

The nature and purpose of the information;
Whether an inquiry, account, listing, transaction or agreement remains active;
Legal, accounting and contractual record-keeping requirements;
The need to resolve complaints or establish, exercise or defend legal claims;
Security, fraud-prevention and operational requirements;
Whether consent has been withdrawn or an account has been closed.

When personal data is no longer reasonably required, we may securely delete, anonymise or aggregate it. Anonymised information that can no longer identify an individual may be retained for statistical, security and business-analysis purposes.

13. Data Security

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, misuse, alteration, disclosure, loss or destruction. Measures may include access restrictions, authentication controls, software updates, backups, security monitoring and confidentiality requirements.

However, no website, internet transmission or electronic-storage system can be guaranteed to be completely secure. Users are responsible for keeping account passwords confidential and should notify us promptly if they suspect unauthorised account use.

Nothing in this Privacy Policy excludes or limits any responsibility that cannot lawfully be excluded or limited.

14. Your Privacy Rights

Subject to applicable law and any lawful exceptions, you may have the right to:

Request confirmation of whether we process your personal data;
Request access to your personal data and relevant processing information;
Request correction or completion of inaccurate or incomplete information;
Request erasure of personal data where the legal conditions are satisfied;
Withdraw consent where processing is based on consent;
Object to or request that we stop certain processing;
Request review of a qualifying decision based solely on automated processing;
Complain or appeal to the Data Protection Authority of Sri Lanka where applicable.

Withdrawal of consent does not affect processing lawfully completed before withdrawal. We may also retain or continue processing information where required or permitted by law, including for legal compliance, fraud prevention, contractual records and the establishment, exercise or defence of legal claims.

15. Exercising Your Rights

To submit a privacy request, email hello@cmbrentals.lk with the subject line “Privacy Request”. Please clearly describe your request and the information concerned.

To protect personal data, we may request reasonable information to verify your identity and authority before responding. We may refuse or limit a request where permitted by law, including where we cannot reasonably verify identity, another person’s rights would be affected, information must be retained by law, or the request is otherwise subject to a lawful exception.

We will respond without undue delay and within the period required by applicable law. Where legally permitted, additional time may be taken for a complex request, and we will inform you accordingly.

16. Marketing Communications

We may send property alerts, promotional messages or similar communications where you have requested them, provided consent or where another lawful basis applies.

You may unsubscribe at any time by using an available unsubscribe method or contacting us. We may retain a limited suppression record to ensure that your opt-out preference continues to be respected.

Service messages relating to an active inquiry, account, viewing, reservation or transaction are not promotional messages and may continue where reasonably necessary.

17. Children’s Privacy

Our website and services are not directed to children. We do not knowingly request personal data directly from a child without appropriate authority or consent where required by law.

If you believe a child has provided personal data without appropriate authorisation, contact us so that we can review and take appropriate action. Information about children supplied for a lawful family rental requirement will be handled only where reasonably necessary and in accordance with applicable law.

18. Automated Decision-Making

We do not currently use solely automated decision-making that produces legal or similarly significant effects on individuals. Property-search filters and suggested listings may use preferences or listing information to display potentially relevant properties, but they do not independently make a tenancy or contractual decision.

If this practice changes, we will update this Privacy Policy and provide any additional information required by applicable law.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, website technology, business practices or legal obligations. The revised policy will be published on this page with an updated date.

Material changes may also be communicated through the website, email or another appropriate method where reasonably necessary or legally required.

20. Complaints and Contact Details

If you have a question, concern or complaint regarding personal data, please contact us first:

CMBRENTALS (PVT) LTD, trading as CMB RENTALS
12, 10 Abdul Caffoor Mawatha,
Colombo 03, Sri Lanka.
Email: hello@cmbrentals.lk
Telephone: +94 77 217 1722