Privacy Policy

We collect the information required to provide payroll and attendance management services, including:

• Company information – company name, address, email, telephone number and registration details.
• Login information – usernames, hashed passwords, user roles and permissions.
• Employee information – name, NIC or passport number, address, contact details, designation, branch and EPF/ETF information.
• Payroll information – salary, allowances, deductions, overtime, attendance, leave, late arrival and early departure records.
• Attendance-device data – attendance timestamps, device logs and biometric enrolment identifiers. HSPay does not store fingerprint templates or facial images received from attendance machines.
• Technical information – IP address, browser type, device information and login history.
• Usage and audit information – pages accessed and system activity records used for security, troubleshooting and service improvement.

Collected information may be used to:

• Provide payroll and attendance-processing services.
• Generate payslips, EPF/ETF information, overtime reports and attendance summaries.
• Authenticate users and prevent unauthorised access.
• Improve system functionality, security and user experience.
• Send OTP codes, important notifications and system alerts.
• Provide customer support and technical assistance.

HSPay uses appropriate technical and organisational security measures, including:

• Password hashing
• HTTPS/TLS encryption
• Server firewall and access restrictions
• Role-based user permissions
• Audit logs for important system activity

HSPay does not sell or trade personal information. Information may be disclosed only when necessary to:

• Service providers assisting with secure hosting, communication or email delivery.
• Government authorities or law-enforcement agencies when legally required.
• The subscribing company’s authorised administrators, HR staff or payroll officers.

Payroll and employee information provided to HSPay remains under the control of the company using the software. An authorised company representative may request an available data export, subject to identity and authority verification.

We retain information while an account remains active and for any additional period required for legal, regulatory, accounting, security or legitimate business purposes.

Requests for deletion will be reviewed and processed subject to applicable legal retention obligations, contractual requirements and verified authority.

HSPay uses cookies and similar technologies for login sessions, security, essential functionality and, where applicable, analytics. Cookies do not directly store user passwords or complete payroll records.

Subject to applicable legal and contractual requirements, authorised individuals may:

• Request access to relevant information.
• Request correction of inaccurate information.
• Request deletion where legally permitted.
• Request an available payroll data export.
• Withdraw consent where processing depends on consent.

HSPay may use third-party services such as cloud hosting, email delivery, reCAPTCHA or related technical integrations. Those service providers process information according to their own privacy policies and contractual obligations.

We may update this Privacy Policy to reflect changes to our services, security practices or legal obligations. The latest version and its revision date will be published on HSPay.lk.