Privacy Notice

Depending on the nature of your interaction with us, Hayleys Engineering (Pvt) Ltd may act as the Data Controller responsible for determining the purposes and means of processing your Personal Data.

We may appoint Hayleys Group companies, third-party service providers, technology providers, consultants, professional advisers and other organisations to process Personal Data on our behalf. Where they act as Data Processors, they will process Personal Data only in accordance with our instructions and applicable contractual and legal requirements.

As part of the Hayleys Group, certain shared services and Group-level functions may also process Personal Data for legitimate business, governance, compliance, technology, human resources, finance, security and administrative purposes.

Depending on your relationship with Hayleys Engineering, we may collect Personal Data including, but not limited to:

• Name and contact details;
• Date of birth and gender;
• National Identity Card, passport or other identification details;
• Residential and correspondence addresses;
• Employment and professional information;
• Educational and professional qualifications;
• Recruitment and employment information;
• Payroll, remuneration, benefits and financial information;
• Attendance, working hours, overtime and leave information;
• Information relating to projects, site access and work assignments;
• Photographs, CCTV images and security records;
• Vehicle and driving licence information where relevant;
• Information relating to health, safety and occupational requirements where necessary;
• Biometric information where required for legitimate business or employment purposes and processed in accordance with applicable law;
• Information provided by customers, suppliers, contractors and other business partners;
• Device, system and network information;
• IP address, browser information and website usage information;
• Information submitted through forms, applications, portals and digital platforms; and
• Any other Personal Data reasonably required for our legitimate business, contractual, employment or legal purposes.

We seek to ensure that Personal Data collected is relevant, proportionate and limited to what is necessary for the purpose for which it is collected.

We may collect Personal Data:

• Directly from you through forms, applications, contracts, correspondence, meetings, interviews or other interactions;
• Through recruitment and employment processes;
• Through HR, attendance, payroll and other business systems;
• Through project, site access and security processes;
• Through CCTV and other security systems;
• Automatically when you use our websites, systems or digital platforms;
• From Hayleys Group companies and shared service functions;
• From customers, suppliers, contractors, consultants and other business partners;
• From publicly available sources where appropriate; and
• From authorised third parties where permitted by law.

We may process Personal Data for purposes including:

Business and project operations

• Managing construction and engineering projects;
• Communicating with customers, consultants, contractors and suppliers;
• Preparing quotations, tenders and contractual documentation;
• Managing project personnel and site access;
• Procurement, commercial and financial administration;
• Quality, safety and operational management.

Human Resources

• Recruitment and selection;
• Employee onboarding and administration;
• Attendance and payroll processing;
• Leave and benefits administration;
• Performance management;
• Learning and development;
• Employee engagement and communication;
• Workforce planning and HR analytics;
• Compliance with employment-related requirements.

Safety and security

• Site and workplace security;
• Access control;
• Occupational health and safety;
• Incident management;
• Emergency response;
• Fraud, misconduct and security prevention.

Legal and compliance

• Complying with applicable laws and regulatory requirements;
• Responding to lawful requests from government and regulatory authorities;
• Managing disputes and legal proceedings;
• Protecting our rights, property and interests;
• Maintaining appropriate records.

We process Personal Data based on applicable legal grounds, which may include consent, contractual necessity, compliance with legal obligations, protection of vital interests and legitimate interests, as permitted under the PDPA.

Where necessary and permitted by law, we may process Personal Data falling within special categories under the PDPA, including biometric, health, genetic or criminal-offence-related information.

Such information will only be collected and processed where there is a legitimate and necessary purpose and appropriate safeguards are applied.

For example, biometric information may be processed for attendance, identity verification, access control or security purposes where applicable.

Our services and business activities are not generally directed towards children under 16. Where Personal Data relating to children is required for a legitimate business purpose, appropriate safeguards will be applied in accordance with applicable law.

We do not sell or rent your Personal Data.

We may share Personal Data where necessary with:

• Relevant Hayleys Group companies;
• Customers and project stakeholders;
• Consultants, contractors and subcontractors;
• Manpower suppliers;
• Payroll, HR and technology service providers;
• IT, cloud and software service providers;
• Banks and financial institutions where required;
• Professional advisers, auditors and insurers;
• Government and regulatory authorities where legally required; and
• Other authorised parties where necessary for the purposes described in this Notice.

Third-party service providers processing Personal Data on our behalf are required to maintain confidentiality and implement appropriate security measures.

Subject to the provisions and limitations of the PDPA, you may have rights including:

• Accessing your Personal Data;
• Requesting correction of inaccurate or incomplete information;
• Requesting deletion or erasure where legally applicable;
• Requesting restriction of processing in applicable circumstances;
• Objecting to certain processing;
• Requesting data portability where applicable;
• Withdrawing consent where processing is based on consent; and
• Requesting information regarding certain automated decision-making processes.

Requests may be submitted to our Data Protection Officer using the contact details below.

We will respond within the period prescribed under applicable law. Where we are unable to comply with a request for legitimate legal, regulatory or security reasons, we will provide an appropriate explanation.

Hayleys Engineering maintains appropriate technical and organisational safeguards designed to protect Personal Data against unauthorised access, alteration, disclosure, loss, destruction or misuse.

These measures may include:

• Access controls;
• User authentication;
• System permissions based on business requirements;
• Encryption and other technical safeguards where appropriate;
• Secure information systems;
• Confidentiality obligations;
• Security monitoring;
• Incident management procedures; and
• Periodic assessments of privacy and information-security risks.

Hayleys Engineering operates within the Hayleys Group’s Data Protection Management Programme, which supports ongoing compliance with applicable data protection requirements.

The programme includes governance, risk assessment, data protection controls, awareness, incident and breach management, contractual safeguards and continuous improvement.

We retain Personal Data only for as long as reasonably necessary for the purposes for which it was collected, or for periods required by applicable law, contractual obligations, regulatory requirements, dispute resolution, audit or legitimate business requirements.

Our retention practices are supported by applicable internal retention requirements and schedules.

Where Personal Data is transferred or processed outside Sri Lanka, Hayleys Engineering will apply appropriate safeguards in accordance with applicable law.

These safeguards may include contractual protections, appropriate security measures and other legally recognised mechanisms.

Our websites and digital platforms may use cookies and similar technologies to improve functionality, remember preferences, analyse usage and enhance user experience.

You may manage or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of some services.

This Privacy Notice may be reviewed and updated periodically to reflect changes in legislation, regulatory requirements, business operations, technology and Hayleys Group privacy standards.

The latest version will be made available through appropriate communication channels.