Privacy policy
Last updated 20 October 2026 · ESOFT Technologies (Pvt) Ltd
How ET Cloud HR collects, uses and protects personal data across our website, web app and mobile apps. The short version: your employer controls your HR data, we never sell it, and AI only ever assists a person.
1. Who we are
ET Cloud HR is an HR platform made by ESOFT Technologies (Pvt) Ltd ("ESOFT", "we", "us"), a company registered in Sri Lanka (registration number PV 00000), with its registered office at registered address, Colombo, Sri Lanka.
This policy covers our website, the ET Cloud HR web app, and the ET Cloud HR mobile apps for iOS and Android (together, the "Service"). It explains what personal data we collect, why, who we share it with, how long we keep it, and the choices and rights you have.
2. Your employer and us
Most of the personal data in ET Cloud HR belongs to the organisations that use it, our customers. When your employer uses ET Cloud HR to manage hiring, records, attendance, leave, overtime, payroll or reviews:
- Your employer is the data controller. They decide what is collected about you and why, and they are responsible for telling you about it.
- We are the data processor. We handle that data only to run the Service for your employer and under their instructions.
Most HR data about you is added by your employer, for example from your offer letter or their payroll records, or by you through the app. Some comes from others at your organisation, such as a manager's review, or from you when you apply for a job.
If you have a question about how your employer uses your data, for example who can see your payslip, please ask your employer's HR team first. We will help them answer it.
We are the data controller for a smaller set of data: the accounts of people who sign up for or buy ET Cloud HR, visitors to our website, and the technical data we need to keep the Service secure and working.
3. What we collect
Account information
- Your name, work email address, phone number and job title
- Your password (stored only as a secure hash) or, if you sign in with Google, your Google account details (see section 6)
- Your company name, address and billing contact
HR data your employer adds or you add for them
| Module | Examples of the data |
|---|---|
| Hiring | CVs, application answers, interview notes, scorecards, offer letters and their e-signatures |
| People and onboarding | Name, date of birth, NIC or passport number, address, emergency contacts, contracts, certificates and other documents |
| Attendance and overtime | Clock-in and clock-out times, shifts, rosters and overtime hours, and the location of a clock-in if your employer turns that on |
| Leave | Leave requests, balances and approvals, and the reason for leave if you give one |
| Payroll | Salary, allowances, deductions, bank account details, EPF and ETF numbers and contributions, and tax (APIT) details |
| Reviews | Goals, self reviews, peer and manager feedback, and ratings |
Some of this is sensitive, such as health details given as a reason for sick leave. We treat all HR data as confidential and only use it to run the Service.
Some details are needed by law or by your employment contract, such as your NIC number, bank account, and EPF and ETF numbers for payroll. If they are missing, your employer may not be able to pay you correctly or meet their legal duties.
Mobile app data
The mobile apps ask for these permissions only when you use a feature that needs them. You can turn each one off in your device settings, and the app keeps working without it.
- Location: your precise location is read only at the moment you clock in or out, if your employer requires it, to confirm you are at your workplace. It is saved with that clock-in, and your employer can see it. It is never collected in the background or while the app is closed.
- Camera and photos: used only when you choose to take or upload a photo, such as your NIC or a certificate during onboarding. The app sees only the photos you pick.
- Notifications: a push token lets us tell you about things like a leave decision, a new payslip or a task that is due.
If your employer uses fingerprint or face clock-in devices, the device keeps the biometric template and sends us only the time of the clock-in and the device ID.
Technical and usage data
- IP address, browser and device type, operating system and app version
- Pages and features used, and actions taken in the Service
- Error reports and security logs
- Cookies and similar technologies (see section 9)
Payment information
When a customer pays for a subscription, card or bank details go to our payment provider. We do not store full card numbers or card security codes.
4. How we use it
We use personal data to:
- Provide and run the Service, including the features your employer has turned on
- Create and secure your account, including sign-in with Google
- Send messages the Service needs to send, such as invitations, password resets, approvals and payslip notices
- Bill customers and manage subscriptions
- Answer support requests
- Keep the Service secure, and detect and prevent fraud and misuse
- Fix problems and improve the Service, using aggregated or de-identified information where we can
- Meet our legal obligations
We do not sell personal data, and we do not use HR data for advertising.
When we are the controller, we rely on the contract with you or your company, our legitimate interest in running and securing the Service, your consent where we ask for it, and our legal obligations. When we are the processor, your employer decides the lawful basis.
5. AI features
ET Cloud HR includes AI features that your employer can turn on or off for each task. For example, ranking applications against a job, reading the details on an uploaded NIC, flagging unusual numbers in a pay run, or drafting a review summary.
- AI suggests; people decide. No hiring, pay or review decision is made by AI alone, and a person can always review or change what the AI suggests.
- How it works: the AI compares the information in front of it with what it has been asked to check, such as an application against the requirements of the job, or a pay run against past months and approved hours. It then shows a suggestion or a flag with its reasons. The only effect is that a person sees the suggestion before they decide.
- To run these features we send the relevant data to our AI provider, which processes it on our behalf. It may not use your data to train its models.
- You can ask your employer, or us, for a person to review any AI-assisted assessment about you.
- Data we receive through Google APIs is never used for AI features or to train AI models (see section 6).
6. Google sign-in and Google user data
You can sign in to ET Cloud HR with your Google account. When you do, Google shares your name, email address, profile picture and Google account ID with us. We use these only to create your account, sign you in and show your name and picture inside the Service. We do not ask for access to your Gmail, contacts, Drive or other Google data to sign you in.
If you choose to connect Google Calendar, for example to schedule interviews, we read your free and busy times and create or update only the events you schedule through ET Cloud HR. You can disconnect it at any time in your account settings, or from your Google account's security settings.
We store Google user data securely with the rest of your account data, and delete it when you disconnect the integration or delete your account.
ET Cloud HR's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. In particular, data from Google APIs is:
- used only to provide or improve the features you can see and have chosen to use
- not sold, and not transferred to others except to provide those features, to comply with the law, or as part of a merger or acquisition
- not used for advertising, and not used to develop, improve or train AI or machine learning models
- not read by people unless you give us permission, it is needed for security or to comply with the law, or it has been aggregated and anonymised for internal operations
The use of information received from Google Workspace scopes, such as Google Calendar, will adhere to the Google User Data Policy, including the Limited Use requirements.
8. Where we store it and how we protect it
Your data is stored in data centres in Singapore. Some service providers may process data in other countries. When data leaves Sri Lanka, we use contracts and safeguards that protect it to the standard Sri Lankan law requires.
We protect data with encryption in transit (HTTPS/TLS) and at rest, role-based access so people see only what their job needs, audit logs of changes to records, regular backups and security reviews. No system is perfectly secure, so if a breach affects your personal data, we will tell the affected customer and, where the law requires, you and the Data Protection Authority, without undue delay.
10. How long we keep it
- Account data: for as long as the account is active.
- HR data: for as long as your employer is a customer, or until they delete it. Employers often have to keep employment, payroll, EPF and ETF records for several years under Sri Lankan law, and they decide how long.
- When a customer leaves: they can export their data for 30 days, after which we delete it from our live systems. Copies in backups are deleted within a further 35 days.
- Logs and security records: up to 12 months.
- Billing records: as long as tax law requires.
11. Your rights
Under Sri Lanka's Personal Data Protection Act, No. 9 of 2022, and other laws that may apply to you, you can ask to:
- see the personal data we hold about you
- correct data that is wrong or out of date
- delete your data, or stop or limit how it is used
- withdraw consent you have given, at any time, by changing the setting in the app (for example location or notifications) or by emailing us
- have a person review a decision made with AI or other automated processing
- receive your data in a format you can take elsewhere
For HR data, your employer is the controller, so send requests to them first, or to us and we will pass them on. For everything else, email hello@et.lk. We may need to confirm who you are first. We will reply within one month; if a request is complex we may need up to two more months, and we will tell you if so. If we refuse a request, we will explain why. You can appeal a refusal, or complain about how we handle your data, to the Data Protection Authority of Sri Lanka.
12. Deleting your account
You can delete your ET Cloud HR account from inside the app at Profile → Settings → Delete account, or by emailing hello@et.lk from the address on your account. We will confirm by email when it is done, within 30 days. The full steps, and what is deleted and kept, are on our account deletion page.
If your account was created by your employer, deleting it removes your login and the personal data we hold for the app. Employment records your employer must keep, such as payroll and EPF history, stay with your employer under their retention rules.
13. Children
The Service is for businesses and the people who work for them or apply to them. It is not meant for anyone under 16, and we do not knowingly collect personal data from children.
14. Changes to this policy
We may update this policy as the Service or the law changes. We will change the date at the top of this page, and if a change is significant we will tell customers by email or in the Service before it takes effect.
15. Contact us
For privacy questions or requests, contact our data protection officer:
- Email: hello@et.lk
- Phone: +94 77 378 5299
- Post: ESOFT Technologies (Pvt) Ltd, registered address, Sri Lanka