Privacy Policy

At Ontriq, we recognize that privacy and data security are of paramount importance, especially within our core operations of background verification, recruitment, and HR management. We are committed to safeguarding the personal and credential data of our candidates, clients, and visitors.

This Privacy Policy outlines how Ontriq collects, stores, processes, and purges personal information in strict compliance with the **Sri Lanka Personal Data Protection Act (PDPA) No. 9 of 2022** and international data protection standards.

1. Internal Storage & Strict Non-Disclosure Policy

2. Rigid Data Retention & Secure Purging (6–12 Months)

In order to balance client auditing needs with the candidate's right to data minimization, Ontriq enforces a strict data lifecycle policy:

• Active Verification Period: Candidate-submitted documentation is processed under explicit consent during active background screening.
• Retention Period: All screening documents, verified records, and generated verification reports are kept in our secure internal database for a minimum of 6 months and a maximum of 1 year (12 months) from the completion of the case.
• Permanent Purging: Immediately following this retention window, all digital documents and case files are permanently and securely deleted from our databases, rendering them completely unrecoverable.

3. Information We Collect

We only collect data that is strictly necessary to conduct our services. Depending on the service chosen by the employing organization, this may include:

• Identity Information: Full name, National Identity Card (NIC) number, Passport details, and current/previous address proof.
• Educational Background: Degrees, diplomas, professional licenses, transcripts, and institutional certificates.
• Professional Experience: Employment history, designations, job scopes, tenure, salary records (where permitted), and performance references.
• Legal Checks: Police clearances, court search histories, and global sanction screenings.

4. Explicit Consent & Candidate Rights

Background verification at Ontriq is **never conducted without candidate consent**. Prior to initiating any search or inquiry, candidates must review and sign our explicit, legal consent form.

Under the Sri Lankan PDPA, candidates retain the following rights, which can be exercised by contacting our privacy officer:

• Right to Access: Request a copy of the background check report and raw documentation collected during the process.
• Right to Rectification: Request correction of any inaccurate or outdated information in your verification file.
• Right to Withdraw Consent: Withdraw your consent at any stage, halting the screening process immediately.
• Right to Erasure: Request early purging of your verification data prior to the automatic 6-to-12-month schedule.

5. Technical Security & Encryption Standards

To guarantee absolute safety, Ontriq deploys industry-standard technical defenses aligned with ISO 27001 cybersecurity frameworks:

• Data in Transit: Encrypted using secure Transport Layer Security (TLS 1.3) protocols.
• Data at Rest: Stored on encrypted database volumes utilizing Advanced Encryption Standard (AES-256).
• Infrastructure: Firewalled network environments with multi-factor authentication (MFA) required for all internal operations.

6. Privacy Enquiries

If you have questions about this policy, want to request access to your records, or need to exercise your candidate rights, please contact our designated Data Protection Officer: