Privacy Notice
We understand that your personal data is important to you. Guided by our corporate values and our code of conduct, the Hayleys Way, S&T Interiors (Pvt) Ltd is committed to protecting your privacy and handling your personal information responsibly.
This Privacy Notice explains how S&T Interiors (Pvt) Ltd collects, uses, stores, shares and protects Personal Data in connection with our interior fit-out, design, contracting, manufacturing, project and corporate activities.
This Notice applies to employees, prospective employees, customers, suppliers, contractors, consultants, project personnel, visitors and other individuals who interact with S&T Interiors.
We operate in accordance with the Personal Data Protection Act No. 9 of 2022 of Sri Lanka (“PDPA”) and, where applicable, relevant international standards and data protection requirements.
For the purposes of this Notice, “Personal Data”, “Data Controller” and “Data Processor” shall have the meanings assigned to them under the PDPA.
Who collects your Personal Data
Depending on the nature of your interaction with us, S&T Interiors (Pvt) Ltd may act as the Data Controller responsible for your Personal Data.
We may engage third-party service providers, consultants, technology providers, professional advisers, contractors and other organisations to process Personal Data on our behalf.
Where such organisations act as Data Processors, they are required to process Personal Data in accordance with our instructions, applicable agreements and legal requirements.
As a company within the Hayleys Group, certain Group-level functions may process Personal Data for shared HR, finance, technology, governance, compliance, security and administrative purposes.
What Personal Data we collect
- Name and contact details;
- Date of birth and identification details;
- National Identity Card or passport details;
- Residential and correspondence addresses;
- Employment and professional information;
- Educational and professional qualifications;
- Recruitment and employment records;
- Payroll, remuneration and benefits information;
- Attendance, working hours, overtime and leave information;
- Project and site-access information;
- Photographs, CCTV images and security records;
- Vehicle and driving licence information where relevant;
- Health and safety information where necessary;
- Biometric information where required for legitimate business or employment purposes;
- Customer and supplier information;
- Contractor and subcontractor information;
- Information relating to project personnel;
- Device, network and system information;
- IP address and website usage information;
- Information submitted through forms, portals and digital platforms; and
- Other Personal Data reasonably required for our business, contractual, employment or legal purposes.
How we collect your Personal Data
- Directly from you;
- Through employment and recruitment processes;
- Through contracts, forms and business correspondence;
- Through HR, attendance, payroll and other digital systems;
- Through project and site administration;
- Through site access and security systems;
- Through CCTV and related security systems;
- From customers, consultants, contractors and suppliers;
- From Hayleys Group companies and shared services;
- From publicly available sources where appropriate; and
- Through authorised third parties where permitted by law.
Why we use your Personal Data
We may process Personal Data for purposes including:
Project and business operations
- Managing interior fit-out and contracting projects;
- Project planning and administration;
- Customer and stakeholder communication;
- Tendering and commercial activities;
- Procurement and supplier management;
- Contractor and subcontractor management;
- Project-site access and administration;
- Quality and operational management.
Human Resources
- Recruitment and selection;
- Employee onboarding;
- Attendance and payroll;
- Leave and benefits;
- Performance management;
- Learning and development;
- Employee engagement;
- Workforce planning;
- HR reporting and analytics.
Health, safety and security
- Workplace and project-site safety;
- Access control;
- Emergency management;
- Occupational health and safety;
- Incident investigation;
- Security and fraud prevention.
Legal and regulatory compliance
- Meeting legal and regulatory obligations;
- Maintaining business records;
- Responding to government or regulatory requests;
- Managing legal claims and disputes;
- Protecting our rights and interests.
Special Categories of Personal Data and Children
Where necessary, we may process special categories of Personal Data as defined under the PDPA, including health, biometric, genetic or criminal-offence-related information.
Such information will only be processed where necessary for a legitimate purpose and subject to appropriate safeguards and applicable legal requirements.
Biometric information may, where applicable, be used for attendance, identity verification, access control or security purposes.
Our services are not generally intended for children under 16. Where information relating to children is required for a legitimate purpose, appropriate safeguards will be applied.
Sharing your Personal Data
We do not sell or rent your Personal Data.
Where necessary, we may share Personal Data with:
- Hayleys Group companies;
- Customers and project stakeholders;
- Consultants and professional advisers;
- Contractors and subcontractors;
- Manpower suppliers;
- HR, payroll and technology providers;
- IT and cloud service providers;
- Auditors and insurers;
- Financial institutions;
- Government and regulatory authorities; and
- Other authorised parties where necessary for legitimate business or legal purposes.
Your rights
- Access your Personal Data;
- Request correction of inaccurate information;
- Request deletion or erasure where applicable;
- Request restriction of processing;
- Object to certain processing;
- Request data portability where applicable;
- Withdraw consent where processing is based on consent; and
- Request information regarding certain automated decision-making.
Requests may be directed to our Data Protection Officer.
Where a request cannot be fulfilled because of legal, regulatory, security or other permitted grounds, an appropriate explanation will be provided.
How we keep your Personal Data safe
S&T Interiors maintains technical and organisational safeguards to protect Personal Data against unauthorised access, loss, alteration, disclosure, destruction or misuse.
These safeguards may include:
- Access controls;
- Authentication and user permissions;
- Secure systems;
- Encryption where appropriate;
- Confidentiality obligations;
- Security monitoring;
- Incident response procedures; and
- Privacy and information-security risk assessments.
Data Protection Management Programme
S&T Interiors operates within the Hayleys Group Data Protection Management Programme.
The programme supports governance, risk management, privacy controls, employee awareness, incident management, contractual safeguards and continuous improvement.
How long we keep your Personal Data
Personal Data is retained only for as long as reasonably necessary for its intended purpose or as required by law, regulation, contract, audit, dispute resolution or legitimate business requirements.
Applicable internal retention schedules and requirements will be used to manage retention and disposal.
How we protect cross-border transfers of Personal Data
Where Personal Data is transferred or processed outside Sri Lanka, S&T Interiors will implement appropriate safeguards in accordance with applicable law.
These may include contractual safeguards, security controls and other legally recognised mechanisms.
Cookies and tracking
Our websites and digital platforms may use cookies and similar technologies to provide functionality, remember preferences and understand website usage.
Users may manage or disable cookies through browser settings. Some functionality may be affected if cookies are disabled.
Updates to this Notice
This Notice may be reviewed and updated periodically to reflect changes in legislation, regulatory requirements, technology, business operations and Hayleys Group privacy standards.
The latest version will be communicated or published through appropriate channels.
Contact our Data Protection Officer
No. 400, Deans Road,
Colombo 10, Sri Lanka