Privacy Notice
How Uga uses the personal data in the systems you use at work – Gate Pass, Fleet, IT Helpdesk, Asset Management, Uga Academy and the rest of Uga Operations – and the rights you have under Sri Lanka’s Personal Data Protection Act, No. 9 of 2022.
In short
- We collect only what each tool needs to do its job.
- Only people whose role needs it can see it – mostly your own property and department.
- We keep it only as long as needed, and delete temporary data automatically.
- You can ask to see it, correct it, and in some cases have it erased.
Who is responsible
Uga Escapes Management (Pvt) Ltd, 55 1/1, Galle Road, Colombo 03, Sri Lanka, is the controller of the personal data in Uga Operations. Each Uga resort uses these systems under its management.
Questions or requests: the IT department – dit@ugaresorts.com. Your request is passed to HR or the data protection officer where needed.
What each product holds, and why
Uga Operations account (all products)
What: Your name, work email, Employee ID and employee number, job title, home property and department, phone number (if given), the products and roles you have, sign-in times, IP address and browser, two-step sign-in settings, your Uga Promise acknowledgement.
Why: To give you one secure sign-in, the right access, and to protect accounts.
Gate Pass
What: Who raised and approved each pass, and the receiver’s name, NIC or ID number, phone, email and vehicle number, items, photos and documents attached to the pass, gate scans and returns.
Why: Security and asset control: knowing what leaves a property, who approved it and that it came back.
Fleet
What: Vehicle requests, trips, the driver and passengers, fuel and expenses. For drivers on duty: the vehicle’s GPS position during a trip.
Why: Safe and efficient transport, cost control. GPS is recorded only while a driver is on duty or on a trip – never off duty.
IT Helpdesk
What: Tickets you raise, messages, screenshots and files you attach, and who worked on them.
Why: Fixing IT problems and improving IT service.
Asset Management
What: Equipment issued to you (asset custody), handover and takeover forms with signatures, repairs and disposals.
Why: Knowing who holds company equipment and keeping it safe.
Uga Academy
What: Courses assigned and completed, quiz and assessment scores, certificates, classroom attendance.
Why: Training, mandatory compliance records and your development.
ESG, Connectivity, Meeting Rooms and other tools
What: Mainly business data. Where your name appears it is as the person who entered data, responded to an alert or booked a room. On-call staff for network alerts: name and phone number.
Why: Running the service and showing who did what.
Forms that need an NIC
What: Some forms (for example gate passes for outside receivers) ask for an NIC or ID number.
Why: Only to identify the person at the gate or for a legal or audit need. Do not enter it where it is not asked for.
Our lawful basis
- Your employment – to run the work you are employed to do (access, approvals, trips, equipment, training).
- Legal duties – for example finance, tax, health and safety and audit records.
- Legitimate interests – keeping guests, staff and company property safe, preventing fraud and keeping our systems secure. We weigh these against your rights.
- Consent – only where we ask for it separately; you can withdraw it at any time.
Who can see it
- You, for your own records.
- People whose role needs it – your Head of Department, approvers, security at the gate, IT, HR and L&D – usually limited to your property or department.
- Platform administrators and auditors, for support, security and audit. Viewing people’s records and exports is logged.
- Service providers who host or support our systems, under contract and only on our instructions. We do not sell personal data.
How long we keep it
| Data | Kept for |
|---|---|
| Your account and access history | While you work with us, then kept disabled (not deleted) for the period HR and the law require. |
| Sign-in sessions and one-time links | Sign-in session records: 90 days. Password and invitation links: 30 days after use or expiry. |
| Activity log from the products | 24 months. |
| Security audit trail (who changed what) | Kept as a tamper-evident record for audit and investigations, for as long as the law and our auditors require. |
| Fleet GPS positions | Up to 180 days, then deleted automatically. |
| Gate passes, tickets, assets, training records | As long as needed for audit, finance and legal duties (generally the statutory period for business records). Receiver NIC, phone and email on closed gate passes are removed automatically 24 months after the pass is closed. |
How we protect it
- Encrypted connections (HTTPS) everywhere; passwords stored only as strong hashes.
- Two-step sign-in for administrators; automatic sign-out after 30 minutes without activity.
- Access by role and property, checked on the server for every page and file.
- Uploads checked before they are saved; nightly backups; a tamper-evident audit trail.
Your rights
- Access – ask what we hold about you and get a copy.
- Correction – ask us to fix anything wrong or out of date.
- Erasure – ask us to delete data we no longer need or have no right to keep (some records must be kept by law).
- Objection – object to processing based on legitimate interests, or withdraw consent you gave.
- Review – ask for a person to review a decision made only by a system.
Email dit@ugaresorts.com. We reply within the time the Act allows (normally 21 working days). If you are not satisfied, you may complain to the Data Protection Authority of Sri Lanka.
Changes to this notice are announced in Uga Operations. Sign in to Uga Operations