Privacy Policy

Last Updated: 1 August 2026

1. Purpose and Scope

This Privacy Policy explains how Hoslift collects, uses, discloses, stores and protects Personal Data relating to:

• visitors to the Hoslift website at hoslift.com;
• people who submit an enquiry, project request, application or partnership request;
• prospective, current and former Clients and their personnel;
• suppliers, contractors, professional advisers and business contacts; and
• people who otherwise communicate or interact with Hoslift.

It applies when Hoslift determines the purposes and means of processing. A project, product, employment process or third-party platform may provide an additional privacy notice. Where Hoslift processes Personal Data only on a Client's documented instructions, the Client is normally the controller and the applicable service agreement and DPA govern that processing.

2. Controller Identity and Contact Details

Hoslift is the public brand of Hoslift Studio, based at 66/01/B, Uswewa, Tangalle, Sri Lanka. For this Policy, "Hoslift", "Hoslift Studio", "we", "us" and "our" mean Hoslift Studio. Hoslift Studio is the controller of Personal Data collected for the Website and its business purposes.

Privacy contact:

Hoslift Studio
66/01/B, Uswewa
Tangalle, Sri Lanka
Submit a privacy enquiry or rights request

Please label the request "Privacy" and provide enough information for Hoslift to identify the relevant interaction. Do not send passwords, private keys, payment credentials or unnecessary identity documents through an ordinary Website form.

3. Key Terms

"Personal Data" means information that identifies, relates to or can reasonably be linked to an individual, as defined by applicable law.

"Process" or "processing" includes collecting, recording, organising, storing, using, disclosing, transferring, restricting and deleting Personal Data.

"Sensitive Personal Data" includes categories given additional protection by applicable law, such as health, biometric, genetic, racial or ethnic origin, political opinion, religious or philosophical belief, trade-union membership, sexual-life or sexual-orientation data, criminal data and other legally protected categories.

4. Personal Data We Collect

Depending on the interaction, Hoslift may collect:

• Identity and contact data: name, organisation, role, postal address, country, email address, telephone number and preferred contact method.
• Enquiry and relationship data: project goals, requested services, budget range, timeline, referral source, meeting notes, communications, decisions and feedback.
• Client and delivery data: contract details, authorised users, Client Materials, requirements, approvals, support records, access history and project documentation.
• Application and partnership data: professional profile, experience, portfolio or application materials, referral information and assessment records.
• Transaction and accounting data: quotations, invoices, payment status, transaction references, tax details and limited billing records. Hoslift does not intentionally collect full card details through ordinary Website forms.
• Uploaded content: files and metadata a person chooses to provide. Uploads should contain only information necessary for the stated purpose.
• Technical and security data: IP address, device and browser information, request time, URLs, error and diagnostic data, security events, bot-detection signals and necessary session or preference data.
• Consent and compliance data: consent choices, policy version, notices provided, objections, rights requests and records required to demonstrate compliance.
• Information inferred from the above: such as the likely service fit, relationship status or security risk, where reasonably necessary and lawful.

Hoslift does not intentionally request Sensitive Personal Data through general Website forms. If it is necessary for a specific engagement, Hoslift will identify the need, applicable legal condition and safeguards before processing.

5. How We Obtain Personal Data

Hoslift obtains Personal Data:

• directly from the individual;
• from the individual's employer, organisation or authorised representative;
• from a person making an authorised referral or introduction;
• from contracts, meetings, correspondence and service delivery;
• automatically through necessary Website, hosting and security technologies; and
• from publicly available professional or business sources where lawful and reasonably expected.

If a person provides Personal Data about someone else, that person must have authority or another lawful basis to do so and must provide any notice required by law.

6. Purposes and Lawful Bases

Hoslift processes Personal Data only for specified, explicit and legitimate purposes. The lawful basis depends on the data, relationship and applicable law.

Purpose	Typical data	Typical lawful basis
Operate, secure and troubleshoot the Website	Technical, security, session and preference data	Legitimate interests in secure and reliable operations; legal obligation where applicable
Respond to enquiries and assess project, supplier or partnership opportunities	Contact, enquiry, communication and submitted content	Steps requested before a contract; legitimate interests in responding and managing business opportunities
Prepare, enter into and perform agreements	Identity, relationship, contract, delivery and transaction data	Contract performance or requested pre-contract steps; legitimate interests where the contract is with an organisation
Deliver, support and improve Services	Client, delivery, support and proportionate diagnostic data	Contract performance; legitimate interests in quality, security and service improvement
Manage billing, accounting and tax	Identity, contract, invoice, payment-status and tax data	Contract performance; legal obligation; legitimate interests in financial administration and debt recovery
Protect rights, prevent misuse and manage disputes	Communications, contracts, technical, security and compliance records	Legal obligation; legitimate interests in security, fraud prevention and establishing, exercising or defending legal claims
Manage recruitment or contractor applications	Contact, application, qualification and assessment data	Requested pre-contract steps; legitimate interests in recruitment and workforce planning; consent where required
Send optional marketing communications	Contact details, preferences and engagement records	Consent where required, or another basis expressly permitted by applicable law
Comply with law and lawful authority requests	Data relevant to the request or obligation	Legal obligation or another lawful condition under applicable law

Where Hoslift relies on legitimate interests, it considers necessity, reasonable expectations and the effect on the individual and uses safeguards to prevent those interests from being overridden by the individual's rights.

Where consent is the basis, it is voluntary, specific and capable of withdrawal. Withdrawal does not affect processing lawfully completed before withdrawal.

7. Required and Optional Information

Required fields are identified at the point of collection. Hoslift may be unable to respond, assess a request, form an agreement or provide a Service without information that is necessary for that purpose.

Optional information may be omitted. Providing an enquiry does not subscribe a person to marketing. Hoslift will not make consent to unrelated processing a condition of a Service where consent must be freely given.

8. Sensitive Personal Data and Criminal-Offence Data

Hoslift processes Sensitive Personal Data or criminal-offence data only when necessary, proportionate and supported by a condition permitted by applicable law. Depending on the context, this may include explicit consent, employment or legal obligations, protection of vital interests, legal claims or another statutory condition.

Additional safeguards may include restricted access, encryption, separation, shorter retention, documented approval and a data-protection impact assessment. General Website forms must not be used to submit such data unless Hoslift expressly requests it through an appropriate process.

9. AI-Assisted Processing

Hoslift may use approved AI-assisted tools for suitable research, drafting, coding, testing, summarisation, documentation, search or workflow support as described in the AI-Assisted Services and Data Use Notice.

Hoslift applies data minimisation, access controls, provider review and human oversight proportionate to risk. Hoslift does not use Website enquiry data, Client confidential information or other Personal Data to train a general-purpose model without express authorisation and a valid legal basis.

Hoslift does not make a decision producing legal or similarly significant effects about an individual solely by automated processing unless it is lawful, necessary and accompanied by the safeguards and rights required by applicable law.

10. Disclosure of Personal Data

Hoslift may disclose Personal Data only where necessary and lawful to:

• authorised personnel and contractors who need it for their duties and are subject to confidentiality;
• hosting, database, communications, file-processing, security and other approved providers identified in the Subprocessors and Third-Party Services page;
• accountants, auditors, insurers, lawyers and other professional advisers;
• a prospective buyer, investor, lender or transaction adviser under appropriate confidentiality in connection with a genuine business transaction;
• a Client or project party where Hoslift processes the data for that engagement and the disclosure is authorised;
• courts, regulators, law-enforcement bodies or other authorities where required or lawfully permitted; and
• another person where the individual has directed or validly authorised the disclosure.

Hoslift does not sell or rent Personal Data. Hoslift does not disclose Personal Data for third-party behavioural advertising.

Providers may process some account, billing, security or legal-compliance data as independent controllers under their own privacy notices. Hoslift assesses role allocation and uses contractual protections where required.

11. International Processing and Transfers

Hoslift is based in Sri Lanka, and some providers or recipients may process Personal Data in other countries. Those countries may have different data-protection laws.

Before a restricted international transfer, Hoslift will identify a lawful transfer mechanism and implement safeguards required by applicable law. Depending on the circumstances, these may include an adequacy or recognised-country mechanism, a contract or approved instrument, binding rules, explicit informed consent for a permitted situation, or another statutory derogation. Hoslift also considers data minimisation, access control, encryption and provider security.

Information about relevant providers and processing locations appears in the Subprocessors and Third-Party Services page and may be requested through the privacy contact.

12. Retention

Hoslift keeps Personal Data only as long as necessary for the purpose collected, including legal, accounting, security and dispute requirements. Unless a longer or shorter period is required by law, an Applicable Agreement, a legal hold or a documented project need, the following target periods apply:

Record	Target retention
General enquiries that do not become an engagement	Up to 12 months after closure
Unsuccessful project, supplier or partnership assessments	Up to 24 months after closure
Unsuccessful recruitment or contractor applications	Up to 12 months after closure, unless the person agrees to longer consideration
Unused attachments	Up to 90 days after the related matter closes
Website security and operational logs	Normally up to 90 days, unless needed for an incident or legal obligation
Client, contract, project, invoice and accounting records	For the engagement and the applicable statutory, tax, limitation and audit period
Rights requests, consent and compliance evidence	For as long as necessary to demonstrate compliance and resolve related claims

When retention ends, Hoslift deletes, anonymises or securely isolates the data. Backup copies are removed or overwritten through the normal backup cycle and are not restored for ordinary use after scheduled deletion. A legal hold, investigation, dispute or security incident may pause deletion for the relevant records.

13. Security

Hoslift uses safeguards proportionate to the nature, context and risk of processing. Measures may include:

• least-privilege access and role controls;
• multi-factor authentication for appropriate systems;
• encryption in transit and, where appropriate, at rest;
• secure development, configuration and change practices;
• provider and subprocessor review;
• logging, monitoring, malware protection and incident procedures;
• confidentiality commitments and personnel access controls; and
• backup, recovery and continuity measures appropriate to the relevant Service.

No transmission or storage method is completely secure. A person who believes data or a Hoslift-controlled system may have been compromised should use the Security and Responsible Disclosure process and avoid including exploit details in an ordinary contact form.

14. Personal Data Breaches

Hoslift assesses suspected Personal Data breaches, takes reasonable containment and remediation steps, documents the incident where required, and notifies the competent authority and affected individuals when and within the period required by applicable law.

Where Hoslift acts as a processor for a Client, it will notify and assist the Client as required by the applicable DPA or service agreement.

15. Individual Rights

Subject to applicable law and relevant exemptions, an individual may have the right to:

• receive information about the processing of their Personal Data;
• withdraw consent where processing relies on consent;
• request access to Personal Data and information about its processing;
• request correction or completion of inaccurate or incomplete Personal Data;
• request erasure where the legal conditions are met;
• object to processing in circumstances provided by law, including certain direct marketing;
• request restriction or another remedy recognised by applicable law;
• receive safeguards relating to a decision based solely on automated processing that produces legal or similarly significant effects; and
• seek review, appeal or complain to the competent authority.

A request may be submitted through the privacy contact in section 2. Hoslift may request information reasonably necessary to verify identity, authority and scope. Hoslift will respond within the period required by applicable law and will explain any lawful refusal, restriction, fee or appeal route.

An authorised representative may make a request where permitted, but Hoslift may verify both the representative's authority and the individual's identity.

16. Marketing Communications

Hoslift sends optional marketing only where a lawful basis exists and required preferences have been recorded. A recipient may opt out at any time using the method in the message or the privacy contact.

Service, security, billing and legal communications are not marketing and may still be sent where necessary for the relationship or required by law.

17. Cookies and Similar Technologies

The current Website does not intentionally set cookies or place information in local storage or session storage. Hosting and network providers may still process request metadata in server-side logs to deliver, secure and troubleshoot the Website.

Hoslift does not currently use visitor analytics cookies, advertising cookies, marketing pixels or cross-site tracking. If Website technology changes, Hoslift will update its Cookie Policy and provide notice and choice where required by applicable law. Details and current controls are provided in the Cookie Policy.

18. Third-Party Websites

The Website may link to third-party websites or services. Their operators determine their own processing, and their privacy notices apply. Hoslift is not responsible for a third party's independent privacy practices, but this does not limit responsibility Hoslift has expressly accepted for selecting or managing a provider in a Client engagement.

19. Children

The Website and general business Services are not directed to children, and Hoslift does not knowingly collect children's Personal Data through general enquiry forms.

A project involving children requires an appropriate service design, age assessment, parent or guardian process where required, specific privacy information, data minimisation and safeguarding review before processing begins. If a parent or guardian believes a child submitted Personal Data through the Website, they should contact Hoslift for review and deletion where appropriate.

20. Complaints and the Supervisory Authority

A privacy concern should first be submitted to Hoslift using section 2 so it can be investigated and addressed.

An individual may also have the right to complain to the Data Protection Authority of Sri Lanka or another competent authority. Information about the Sri Lankan authority is available at dpa.gov.lk. Contacting Hoslift first does not remove a statutory right to approach an authority or court.

21. Changes to This Policy

Hoslift may update this Policy to reflect changes in law, processing, providers or Services. The current version and Last Updated date will be published on this page.

If a change materially affects an existing relationship or requires consent, Hoslift will provide additional notice or obtain consent where required. Earlier processing remains governed by the law and notice applicable at the relevant time.

22. Contact

Questions, complaints and rights requests may be submitted through the Contact page or sent by post to the address in section 2.