Privacy notice for staff
For everyone who works at Exline Labs: employees, interns and contractors. Last updated 28 October 2026.
Who we are
Exline Labs (Pvt) Ltd ("Exline Labs", "we") is the controller of the personal data in Pulse, our workspace for attendance, leave, pay and projects. Registered office: Trincomalee, Sri Lanka. Company number: [company registration number: fill in under Settings, Company]. Privacy contact: hello@exlinelabs.com.
What we keep about you
| Kind | Details |
|---|---|
| Identity and contact | Name, preferred name, work email, personal email and mobile, home address, date of birth, NIC number and NIC images, photo. |
| Emergency contacts | Name, relationship and phone number of the people you give us. |
| Employment | Position, start and end dates, contract, probation, letters, the confidentiality agreement and your declaration of other work, CV and certificates, equipment you hold. |
| Pay | Salary and allowances, pay changes, payslips, EPF, ETF and APIT, salary advances, expense claims and receipts, the bank account your salary goes to. |
| Time and leave | Clock-in and clock-out times, attendance corrections, leave requests and balances, documents you attach (for example a medical certificate). |
| Work tracking | Your Jira account and the issues and activity in Jira, which projects you work on and how your days are split between them. |
| Sign-in and security | When and from where (IP address, browser) you sign in, devices, and a log of sensitive actions such as viewing salaries, personal details or downloading files. |
Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Paying you, leave, claims, and running your employment | Contract: we need it to employ you and pay you. |
| EPF, ETF, APIT and keeping payroll and employment records | Legal obligation under Sri Lanka law. |
| Attendance (clock-in and clock-out) | Legitimate interests: knowing who is working, planning cover and paying for the days worked. We do not record your screen, keystrokes or location. |
| Work tracking from Jira and the daily project split | Legitimate interests: planning delivery, costing projects and telling clients when their work is late. It is not used on its own for disciplinary decisions. |
| Security: two-step login, the activity log, alerts on unusual activity | Legitimate interests: keeping your pay and personal details safe, and noticing misuse. |
| Medical details in a sick leave document | Employment law obligations; only HR and Admin can open it. |
| Telling a client you are on leave (dates only) | Legitimate interests: the client plans around it. No reason or details are shared. |
Where we rely on legitimate interests we have weighed them against your rights; the assessment is available on request.
Who can see it
Inside Pulse, access follows your role: you see your own details and pay; your team lead sees your attendance, leave and work but not your pay or personal details; HR and Admin see what they need to run payroll and employment. Every view of salaries and personal details is logged.
Outside Exline Labs, these service providers handle data for us under contracts that require them to keep it safe and use it only for us:
| Who | What for |
|---|---|
| Our server host | Runs Pulse and stores its data and backups, on a server in the United Kingdom. |
| Brevo | Sends Pulse emails (invites, reminders, payslip notices). Sees your name, email address and the email text. |
| Slack | Sends Pulse messages to staff. Sees your Slack ID and the message text. |
| Atlassian (Jira) | Where project work is planned. Pulse reads issue and activity data from it; it never writes back. |
| Workspace email and files; reCAPTCHA if it is the bot check in use. | |
| Cloudflare | Turnstile, the bot check on the sign-in page after failed tries, if it is the one in use. |
| Our accountant | Payroll and month-end figures, to prepare accounts and statutory returns. |
| Banks and government bodies | Your bank (salary payments), the EPF and ETF authorities and the Inland Revenue Department (statutory returns). |
Where it is kept
Pulse runs on a server in the United Kingdom, and the Exline Labs team works from Sri Lanka. Some providers above process data in the European Union or the United States. Where data leaves the UK or Sri Lanka we rely on the provider's data processing agreement with standard contractual clauses (or the UK addendum to them).
How long we keep it
| What | How long |
|---|---|
| Payroll, payslips, EPF and ETF records, contract and letters | 7 years after you leave (Sri Lanka record-keeping rules). |
| Personal contact details, emergency contacts, NIC images, CV, certificates, photo | Deleted automatically 7 years after your last day. |
| Sign-in attempts | 180 days. |
| The log of emails and Slack messages Pulse sent (no links or attachments) | 1 year. |
| The activity log | 6 years. |
| Backups | 30 days, encrypted. |
Your rights
Under UK GDPR and the Sri Lanka Personal Data Protection Act, No. 9 of 2022, you can ask us to:
- give you a copy of the personal data we hold about you (staff can download it from My profile in Pulse),
- correct anything that is wrong or out of date,
- delete it, where we do not have to keep it by law,
- stop or limit using it, or object to uses based on our legitimate interests,
- give it to you, or another organisation, in a common format.
Write to hello@exlinelabs.com. We reply within one month. It is free. If you are not happy with our answer you can complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113) or the Data Protection Authority of Sri Lanka (dpa.gov.lk).
Keeping it safe
Two-step login for everyone, bank and NIC numbers and every stored file encrypted, access by role enforced by the database itself, an activity log nobody in Pulse can edit, nightly encrypted backups, and email alerts to Admin about exports and changes to access, pay and bank details.
If this notice changes
We will tell you in Pulse or by email before a change that affects you.
Staff notice · Clients and contacts notice · Sign in to Pulse