Privacy Policy

Effective Date: 1st January 2025

Introduction

Welcome to eHRIS.lk, an advanced Human Resource & Payroll Management System developed to help organizations efficiently manage their workforce, payroll, attendance, leave, recruitment, performance, and related HR operations.

At eHRIS.lk, we respect your privacy and are committed to protecting the personal information entrusted to us. This Privacy Policy explains how we collect, use, store, process, and protect your personal information when you use our website, software, and related services.

By accessing or using our website and services, you agree to the collection and use of information in accordance with this Privacy Policy.

Scope of this Privacy Policy

This Privacy Policy applies to:

• www.ehris.lk
• eHRIS Web Application
• Mobile Applications (where applicable)
• Customer Support Services
• Software Demonstrations and Training Services

This policy applies to information collected from:

• Website visitors
• Organizations using eHRIS
• Employees whose information is managed within eHRIS by their employers
• Prospective customers
• Business partners
• Vendors

This Privacy Policy does not apply to third-party websites or services linked from our website. Such websites operate under their own privacy policies.

Information We Collect

Depending on how you interact with eHRIS, we may collect the following information:

Personal Information

• Full Name
• Company Name
• Designation
• Email Address
• Telephone Number
• Office Address
• Billing Information

Employee Information (Provided by Employer)

Our customers may store employee information within the eHRIS system, including but not limited to:

• Employee Name
• Employee Number
• National Identity Number (NIC)
• Date of Birth
• Gender
• Contact Details
• Emergency Contacts
• Employment History
• Salary Information
• Bank Account Details
• Attendance Records
• Leave Records
• Performance Evaluations
• Payroll Information
• Tax Information
• EPF/ETF Information
• Recruitment Information

The employer remains the Data Controller of employee information, while eHRIS acts as the Data Processor.

How We Use Your Information

We use the collected information to:

• Provide HR & Payroll software services
• Process payroll calculations
• Manage attendance and leave
• Generate statutory reports
• Improve system performance
• Provide customer support
• Conduct software maintenance
• Send service-related notifications
• Respond to customer inquiries
• Prevent unauthorized access and fraud
• Comply with legal and regulatory requirements

We do not sell or rent your personal information to third parties.

Sharing of Information

We may share information only under the following circumstances:

• With your organization as part of normal HR operations.
• With authorized implementation partners or service providers under confidentiality agreements.
• When required by applicable laws, court orders, or government authorities.
• To protect the rights, safety, or property of eHRIS, our customers, or the public.

We will never sell employee or customer data to advertisers or unrelated third parties.

Data Storage and Security

Protecting your data is one of our highest priorities.

We implement appropriate technical and organizational safeguards including:

• Secure cloud infrastructure
• Data encryption during transmission
• Role-based user access
• Password protection
• Session timeout and automatic sign-out after inactivity
• Regular security updates
• Firewall protection
• Backup and disaster recovery procedures
• Activity logging and audit trails where applicable

Although we employ industry-standard security measures, no electronic storage or internet transmission is completely secure. Therefore, we cannot guarantee absolute security.

Cookies and Website Analytics

Our website may use cookies and similar technologies to:

• Improve website functionality
• Remember user preferences
• Analyze website traffic
• Improve user experience

You may disable cookies through your browser settings; however, some features of the website may not function properly.

Data Retention

We retain personal information only for as long as necessary to:

• Provide our services
• Fulfil contractual obligations
• Meet legal, accounting, or regulatory requirements
• Resolve disputes
• Enforce our agreements

Customer data will be retained according to the service agreement with each organization.

Your Rights

Subject to applicable laws, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion of personal information
• Request restriction of processing
• Object to certain processing activities
• Request a copy of your personal data where applicable

Requests relating to employee records should normally be made through your employer, who controls the data within the eHRIS platform.

Third-Party Services

Our services may integrate with third-party providers including:

• Biometric attendance devices
• Email service providers
• SMS gateways
• Payment gateways
• Government reporting systems
• Cloud hosting providers

These third parties maintain their own privacy and security policies.

International Data Transfers

Where necessary, personal information may be processed or stored on servers located outside Sri Lanka by trusted infrastructure providers or service partners. By using eHRIS, you acknowledge and consent to such transfers, subject to appropriate safeguards.

Data Breach Notification

We are committed to safeguarding your information.

In the unlikely event of a security breach affecting personal information, we will:

• Investigate the incident promptly.
• Assess the scope and potential impact.
• Notify affected customers where legally required.
• Take appropriate corrective actions.
• Cooperate with relevant authorities where necessary.
• Provide guidance to affected users to help minimize potential risks.

Transparency and timely communication remain central to our incident response process.

Children's Privacy

eHRIS services are intended for business and employment purposes and are not directed toward children under the age of 16. We do not knowingly collect personal information from children.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, technology, or our services.

The latest version will always be published on www.ehris.lk, and continued use of our services constitutes acceptance of the updated policy.

Contact Us

If you have any questions regarding this Privacy Policy or our data protection practices, please contact us: