Privacy Notice

This Privacy Notice explains how Payable Capital (Pvt) Ltd ("Credible", "we", "us"), the provider of the Credible merchant cash advance service, collects and uses your personal data. We are the data controller for the purposes of the Personal Data Protection Act, No. 9 of 2022 (as amended) ("PDPA").

Where you enter into a Merchant Cash Advance agreement with us, our handling of your data is also governed by that agreement and by the Master Agreement between Payable Capital and Payable. If anything here conflicts with those agreements, the agreements prevail.

What we collect

• Identity and business details — your name, National Identity Card number, and, where applicable, your business name and registration details.
• Contact details — phone number, email, and address.
• Bank details — the account used to receive your advance and from which repayments are collected.
• Card sales information — transaction and settlement data relating to your business, which we receive through Payable's payment network.
• Onboarding information — details you confirm when you use our SMS link and onboarding flow, including verification data.
• Communications — records of your calls and messages with our team.
• Website information — basic usage data and cookies when you visit our website.

How we use it, and our lawful basis

We use your personal data to assess your eligibility, provide and administer your cash advance, collect repayments through your card settlements, prevent fraud, manage risk, communicate with you, and meet our legal obligations.

We rely on the following lawful bases under the PDPA: the performance of our agreement with you (and steps taken before entering it), our legitimate interests in assessing and managing advances responsibly, compliance with legal obligations, and your consent where it is specifically required. We do not rely on consent alone, so withdrawing consent will not affect processing that we carry out on these other bases.

Automated assessment. We may use automated processing, including scoring based on your card sales history, to help assess eligibility. You can ask us to review a decision made in this way.

Who we share it with

We share personal data only where needed, with: Payable, for settlement data and to operate repayment collection; your bank, to disburse your advance and collect repayments; service providers who support us under confidentiality obligations; and regulators, authorities or courts where we are required to by law. We do not sell your personal data.

How long we keep it

We keep your personal data for as long as necessary for the purposes above and to meet our legal and contractual obligations — generally for the duration of your agreement with us and for a period afterwards as required by law.

Your rights

Subject to the conditions in the PDPA, you have the right to access your data, request correction or completion, request erasure, object to certain processing, withdraw consent where our processing is based on consent, and request a review of an automated decision. Some of these rights are limited where we are required to continue processing to perform our agreement or meet a legal obligation — for example, while you have outstanding obligations under a Merchant Cash Advance agreement.

To make a request, contact us using the details below. We will respond within the time required by the PDPA (currently twenty-one business days).

Security

We take reasonable steps to protect your personal data against loss, misuse, and unauthorised access.

Contact and complaints

For any privacy question or request, contact us at hello@credible.lk or +94 11 750 1444, or write to Payable Capital (Pvt) Ltd, 6th Floor, Huejay Court, No. 32 & 32/5, Sir Mohamed Macan Markar Mawatha, Colombo 03.

If you are not satisfied with our response, you may complain to the Data Protection Authority of Sri Lanka.

Changes to this Notice

We may update this Notice from time to time. The date at the top shows when it was last revised.