Enterprise Privacy Commitment
Prime One Global safeguards employee and enterprise records with AES-256 encryption at rest, TLS 1.3 in transit, and strictly restricted role-based administrative access controls.
1. Data Controller & Scope
The data controller is Prime One Global and its affiliated group corporate subsidiaries. This policy applies to all employees, staff members, contractors, and authenticated users accessing the PRIME 1 Enterprise HRMS, Payroll & Biometric Attendance Portal.
2. Categories of Personal Data Collected
- Identification: Full legal name, National Identity Card (NIC) / Passport number, employee ID, profile photo, and tax identification.
- Biometric Data: Mathematical template representations from ZKTeco biometric terminals for fingerprint and face-scan verification (raw images are never stored or transmitted).
- Workforce Telemetry: Punch clock timestamps, geo-fenced coordinates during remote Web Punch, shift schedules, and IP address audit trails.
- Statutory & Financial Data: Basic salary, allowances, EPF (8% & 12%), ETF (3%), APIT tax brackets, bank account details for payroll direct deposit.
3. Legal Basis for Processing (GDPR Article 6 & 9)
We process personal telemetry under the following lawful grounds:
- Performance of Employment Contract: To compute remuneration, track attendance, and process leave applications.
- Legal & Statutory Compliance: In accordance with Sri Lankan Labour Law, Inland Revenue Department APIT regulations, and Central Bank EPF/ETF statutory filing obligations.
- Legitimate Interests: Corporate security, automated biometric punch deduplication, and preventing fraudulent buddy-punching.
4. Cookie & PWA Storage Policy
Our platform uses minimal, privacy-first cookie technologies:
- Essential Session Cookies: Encrypted HTTPS session identifier for keeping you signed in safely across app closures (SameSite=Lax, HttpOnly).
- Preferences (localStorage): Storing UI preferences such as Office Theme (White / Dark Gray) without tracking user identities.
- Service Worker Cache: Caches static application icons and layout assets for offline resilience and PWA speed optimization.
5. Data Retention & Secure Disposal Schedule (ISO/IEC 27001 Control A.8.10)
In accordance with ISO/IEC 27001:2022 Control A.8.10 (Information Deletion) and the Sri Lanka Inland Revenue Act No. 24 of 2017 (Section 120), PRIME 1 maintains an automated lifecycle and retention schedule:
| Information Category |
Retention Period |
Statutory & Security Authority |
Disposal Method |
| Payroll, EPF, ETF & APIT Tax Records |
7 Years past employee termination |
Inland Revenue Act (Sec 120) & Central Bank of Sri Lanka EPF Act |
Cryptographic erasure & database shredding |
| Biometric Punch & Raw Attendance Logs |
3 Years rolling active window |
Shop & Office Employees Act & Wages Board Ordinance |
Automated table pruning to encrypted cold storage |
| Biometric Hash Templates (Fingerprint/Face) |
Immediately upon termination (within 30 days) |
EU GDPR Art. 17 (Right to Erasure) & PDPA Sec. 16 |
Permanent removal from ZKTeco terminals & database |
| Security Audit Logs & Access History |
5 Years post event date |
ISO 27001 Control A.8.15 (Logging) & PDPA Compliance |
Secure sanitization with immutable archive records |
Disposal Standard: All digital data scheduled for permanent purging undergoes cryptographic sanitization in accordance with NIST SP 800-88 Rev. 1 (Guidelines for Media Sanitization).
6. Your Rights as a Data Subject
Under GDPR and the Personal Data Protection Act, you have the right to:
- Right to Access: View your complete employment history, attendance logs, and payslips anytime via the Staff Portal.
- Right to Rectification: Request corrections to outdated personal, statutory, or contact information.
- Right to Portability & Digital Payslips: Download authenticated digital PDF copies of your salary slips and tax deductions.
- Data Protection Inquiries: Contact your appointed HR Data Protection Officer at privacy@primeone.lk.