Privacy Notice

Depending on the nature of your interaction with us, Unisyst Engineering Limited may act as the Data Controller responsible for determining the purposes and means of processing your Personal Data.

We may appoint third-party service providers, technology providers, consultants, professional advisers, contractors and other organisations to process Personal Data on our behalf.

Where they act as Data Processors, they are required to process Personal Data only in accordance with our instructions and applicable contractual and legal requirements.

As a company within the Hayleys Group, certain Group-level functions may process Personal Data for shared human resources, finance, technology, governance, compliance, security and administrative purposes.

Depending on your interaction with Unisyst Engineering, we may collect:

• Name and contact details;
• Date of birth and identification details;
• National Identity Card or passport details;
• Residential and correspondence addresses;
• Employment and professional information;
• Educational and professional qualifications;
• Recruitment and employment records;
• Payroll, remuneration and benefits information;
• Attendance, working hours, overtime and leave information;
• Project and site-access information;
• Factory and workplace access information;
• Photographs, CCTV images and security records;
• Vehicle and driving licence information where relevant;
• Health and safety information where necessary;
• Biometric information where required for legitimate business or employment purposes;
• Customer and supplier information;
• Contractor and subcontractor information;
• Device, system and network information;
• IP address and website usage information;
• Information submitted through forms, applications, portals and digital platforms; and
• Other Personal Data reasonably required for our manufacturing, engineering, employment, contractual, operational or legal purposes.

We seek to ensure that Personal Data collected is relevant, proportionate and limited to what is necessary for the purpose for which it is collected.

We may collect Personal Data:

• Directly from you;
• Through recruitment and employment processes;
• Through employment contracts and HR documentation;
• Through attendance, payroll and HR systems;
• Through factory, project and site administration;
• Through access-control and security systems;
• Through CCTV and related security systems;
• From customers, suppliers, consultants and contractors;
• From Hayleys Group companies and shared services;
• From publicly available sources where appropriate; and
• From authorised third parties where permitted by law.

We may process Personal Data for purposes including:

Manufacturing and engineering operations

• Managing manufacturing and engineering activities;
• Managing customer and project requirements;
• Planning and executing projects;
• Design, engineering, fabrication and installation activities;
• Managing factory and project personnel;
• Managing suppliers and contractors;
• Quality assurance and operational management;
• Project-site access and administration.

Human Resources

• Recruitment and selection;
• Employee onboarding and administration;
• Attendance and payroll;
• Leave and benefits administration;
• Performance management;
• Learning and development;
• Employee engagement;
• Workforce planning;
• HR reporting and analytics.

Health, safety and security

• Factory and workplace security;
• Project-site security;
• Access control;
• Occupational health and safety;
• Emergency response;
• Incident management;
• Fraud and misconduct prevention.

Legal and compliance

• Complying with applicable laws and regulations;
• Responding to lawful requests from government and regulatory authorities;
• Maintaining appropriate business records;
• Managing disputes and legal proceedings;
• Protecting our property, rights and legitimate interests.

We process Personal Data based on applicable legal grounds, including consent, contractual necessity, legal obligations, protection of vital interests and legitimate interests, as permitted under the PDPA.

Where necessary and permitted by law, Unisyst Engineering may process Personal Data falling within special categories under the PDPA, including biometric, health, genetic or criminal-offence-related information.

Such information will only be processed where necessary for a legitimate purpose and appropriate safeguards are applied.

Where applicable, biometric information may be used for attendance, identity verification, access control or security purposes.

Our services and business activities are not generally directed towards children under 16. Where Personal Data relating to children is required for a legitimate purpose, appropriate safeguards will be applied in accordance with applicable law.

• Hayleys Group companies;
• Customers and project stakeholders;
• Consultants and professional advisers;
• Suppliers and contractors;
• Manpower suppliers;
• HR, payroll and technology service providers;
• IT and cloud service providers;
• Auditors and insurers;
• Banks and financial institutions;
• Government and regulatory authorities; and
• Other authorised parties where required for legitimate business or legal purposes.

Subject to the provisions and limitations of the PDPA, you may have rights to:

• Access your Personal Data;
• Request correction of inaccurate or incomplete information;
• Request deletion or erasure where legally applicable;
• Request restriction of processing;
• Object to certain processing;
• Request data portability where applicable;
• Withdraw consent where processing is based on consent; and
• Request information regarding certain automated decision-making processes.

Requests may be submitted to our Data Protection Officer.

We will respond within the applicable statutory period. Where a request cannot be fulfilled because of legal, regulatory, security or other permitted grounds, an appropriate explanation will be provided.

Unisyst Engineering maintains technical and organisational safeguards designed to protect Personal Data from unauthorised access, alteration, disclosure, loss, destruction or misuse.

These safeguards may include:

• Access controls;
• Authentication and user permissions;
• Secure information systems;
• Encryption where appropriate;
• Confidentiality obligations;
• Security monitoring;
• Incident response procedures; and
• Privacy and information-security risk assessments.

Unisyst Engineering operates within the Hayleys Group Data Protection Management Programme.

The programme supports ongoing compliance through governance, risk assessments, privacy controls, awareness, incident management, contractual safeguards and continuous improvement.

We retain Personal Data only for as long as reasonably necessary for the purpose for which it was collected or as required by applicable law, contractual obligations, regulatory requirements, audit, dispute resolution or legitimate business requirements.

Applicable internal retention schedules will be used to manage retention and secure disposal.

Where Personal Data is transferred or processed outside Sri Lanka, Unisyst Engineering will implement appropriate safeguards in accordance with applicable law.

Such safeguards may include contractual protections, security measures and other legally recognised mechanisms.

Our websites and digital platforms may use cookies and similar technologies to improve functionality, remember preferences, analyse usage and enhance user experience.

You may manage or disable cookies through your browser settings. Certain functions may not operate fully when cookies are disabled.

This Privacy Notice may be reviewed and updated periodically to reflect changes in applicable legislation, regulatory requirements, technology, business operations and Hayleys Group privacy standards.

The latest version will be made available through appropriate communication channels.