Privacy policy
How StaffPay collects, uses and protects personal information about employers and their employees.
Last updated October 2026
Placeholder. This page outlines the sections the final document will cover. Replace it with text reviewed by your legal team before launch.
1. Who we are
The company responsible for StaffPay and how to contact the person handling privacy questions.
2. Information we process
The categories of personal data StaffPay holds to run payroll, such as names, contact details, NIC and EPF numbers, salary and allowance details, bank account details, leave records and sign-in activity.
3. How information is used
The purposes for processing, such as calculating pay and statutory deductions, producing payslips and reports, approving bank-detail changes and keeping an audit trail, and the legal basis for each.
4. Employers and StaffPay
How responsibilities are split between the employer (who decides what employee data is entered) and StaffPay (which processes it on the employer's behalf).
6. Security
Safeguards such as role-based access, two-person approval for bank-detail changes, two-factor authentication and audit logging.
7. Retention
How long payroll records are kept, including any period required by law, and how they are deleted.
8. Your rights
How employees and employers can access, correct or request deletion of their information, and how to raise a complaint, in line with Sri Lanka's Personal Data Protection Act.
9. Changes to this policy
How users will be told about changes to this policy.