Privacy Policy

MiHR ("MiHR", "we", "us") builds MiHR, an HR and workforce management platform. This policy covers https://mihrissystems.com the website you are reading and we are the controller of the personal data described below.

If you are an employee of a company that uses the MiHR platform, this policy is not the one that applies to you. Your employer decides what happens to the data inside their MiHR account, and we handle it on their instructions under our agreement with them. Ask your HR team for their own privacy notice.

You can reach us about anything in this policy at:

info@mihrissystems.com

We collect very little, and only where you hand it to us or where serving the page requires it.

• Demo requests - your name, your company, your work email, your team size and anything you type into the notes field. Every one of these is filled in by you; nothing is taken from your device to complete the form.
• Emails you send us - whatever your message and your email signature contain, kept so we can reply and keep track of the conversation.
• Server logs - our hosting provider records the usual request data, including your IP address, browser and operating system, the page requested and the time. These are the host's standard logs; we do not build profiles from them.
• Anti-spam signals - Google reCAPTCHA collects device and browsing information from your browser to judge whether a demo request came from a person. See the section on reCAPTCHA below.

We do not ask for, and this website has no way to take, payment card details, national identity numbers or any special category of data such as health or biometric information. Please do not put information like that into the notes field.

Under the Personal Data Protection Act No. 9 of 2022 we have to have a lawful basis for each use. Ours are:

• To answer your demo request - arranging the demo, preparing for it and following up afterwards. Basis: your consent in submitting the form, and the steps taken at your request before entering into a contract.
• To reply to your emails and keep a record of what was discussed. Basis: your consent, and our legitimate interest in running the business we are being asked about.
• To keep this website working and secure - verifying that a submission is not automated, and investigating abuse. Basis: our legitimate interest in a site that is not a spam target.
• To meet a legal or regulatory obligation, or to establish or defend a legal claim, if it ever comes to that. Basis: legal obligation and legitimate interest.

We do not use your information to advertise to you, we do not profile you, and no decision affecting you is made about you automatically.

This website sets no cookies of its own. There is no analytics, no advertising tag and no tracking pixel on it, so there is no cookie banner to click through.

The one exception is Google reCAPTCHA v3, which protects the demo form. It loads only when you open the demo dialog if you never open it, nothing from Google runs on the page. Once it loads, reCAPTCHA collects hardware and software information from your browser and may set cookies in your browser under Google's own domains, in order to score the request as human or automated. That collection is governed by Google's Privacy Policy and Terms of Service, and it is subject to them rather than to this policy.

You can block those requests with your browser or an extension. The demo form will still be there, but a submission may not get through, in which case email us instead.

We do not sell your personal data, and we do not share it for anyone else's marketing. It reaches these service providers only because they run parts of this website for us:

• Google - a demo request is sent from your browser to a Google Apps Script and stored as a row in a Google Sheet in our company Google account. Google also provides the reCAPTCHA check on that form.
• Our web host - serves the pages and keeps the server logs described above.
• Our email provider - carries and stores the messages you send us.

Beyond those, we disclose personal data only where the law requires it, where a regulator or court properly demands it, or where it is necessary to protect our rights or someone's safety. If our business is ever sold or merged, the information may transfer with it, and this policy travels with the data.

Our providers operate globally, so your information is likely to be stored and processed on servers outside Sri Lanka Google's infrastructure in particular. Where that happens, we rely on the provider's contractual commitments and the safeguards permitted under the Personal Data Protection Act to keep the protection travelling with the data.

• Emails - kept for as long as the correspondence is useful, and reviewed periodically.
• Server logs - kept for the short retention period our hosting provider applies, and used only for security and troubleshooting.

Ask us to delete something sooner and we will, unless we are required to keep it.

The site is served over HTTPS, the sheet holding demo requests sits in an access-controlled company Google account, and only the people who need to read a request can open it. The keys reCAPTCHA is verified with are held server-side, out of reach of the browser.

No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your personal data, we will notify you and the Data Protection Authority as the Act requires.

Under the Personal Data Protection Act you can ask us to:

• Tell you what personal data of yours we hold, and give you a copy of it.
• Correct anything inaccurate or incomplete.
• Delete it, where there is no longer a good reason for us to keep it.
• Stop or restrict a particular use, including any use based on our legitimate interests.
• Withdraw a consent you gave us - which does not undo what was done while the consent stood.

Email us and say which of these you want. We may need to check who you are before acting, so that we are not handing your information to someone else. We will respond as quickly as we can, and within the time the Act allows.

info@mihrissystems.com

If our answer does not satisfy you, you are entitled to complain to the Data Protection Authority of Sri Lanka. We would rather you came to us first, so we get the chance to put it right.

Where we link out to a site we do not run, that site's own privacy policy governs what it does. We have no control over those sites and take no responsibility for them.

We update this policy when what we do with your information changes. The date at the top always reflects the current version. If a change matters to you, we will make it obvious rather than leaving you to spot the edit.