Privacy Policy

1. Who we are

CareerConnect.lk is an online talent discovery and recruitment platform operated by DXP Strategic Solutions (Private) Limited (“CareerConnect,” “we,” “us,” or “our”). The platform allows candidates to create professional profiles and allows authorised employers and recruitment professionals to search for and contact suitable candidates.

For data protection purposes, DXP Strategic Solutions (Private) Limited is the organisation that determines why and how personal data is processed through CareerConnect.lk.

If a Data Protection Officer is formally appointed, the relevant contact details will be published here.

2. Scope of this Policy

This Privacy Policy applies when you visit CareerConnect.lk, create or use a candidate or employer account, create a profile, search the talent pool, send or receive messages, purchase a plan, contact support, respond to surveys, or otherwise interact with us.

It also applies to personal data we receive through optional sign-in services such as Google or LinkedIn and to information an employer provides about its authorised account users.

3. Personal data we collect

4. How we collect personal data

We collect data:

• •directly from you when you register, complete a profile, change settings, communicate or pay for a service;
• •from your employer or organisation when it creates or manages an employer-user account;
• •from Google, LinkedIn or another sign-in provider when you choose that option;
• •automatically through logs, cookies and similar technologies;
• •from other users when they report an account or submit a support request; and
• •from public or official sources where reasonably necessary to verify an employer or investigate fraud, misuse or security concerns.

If we receive personal data about you from another source, we will provide appropriate information about the source and processing as required by applicable law.

5. Why we use personal data and our legal bases

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that occurred before withdrawal. Some processing is necessary to provide an account or requested feature; without the required information, we may not be able to provide that service.

6. Candidate profile visibility and employer access

Candidates control profile visibility through the settings made available on the platform. Depending on the available option:

• •Hidden: the profile is not shown in employer search results;
• •Verified-employer visibility: selected professional fields are available to authorised employer users, while personal identity or contact details may remain hidden until the candidate chooses to reveal them or responds; and
• •Public or featured visibility: selected summary information may appear on public pages only after a separate affirmative opt-in.

The exact fields shown at each visibility level should be clearly displayed before the candidate saves the setting.

Employers may use filters such as skills, experience, industry, location, education, availability and role preferences. An employer’s access is subject to its plan, account status and the Employer Terms.

Candidates should understand that an employer may take notes or retain information after lawful access. Employers are contractually required to use candidate data only for legitimate recruitment and to protect and delete it when no longer needed. CareerConnect cannot fully control unauthorised copying by a user, but we may investigate and suspend accounts for misuse.

7. Automated search, matching and review

CareerConnect may use automated tools to organise, filter, rank or suggest candidate profiles based on information such as skills, experience, location, industry, availability and role preferences. These tools are intended to assist discovery. CareerConnect does not make the final hiring decision and does not guarantee that a candidate will be contacted, interviewed or employed.

We may also use automated signals to identify suspicious activity or profiles that require manual review. Where applicable law gives you a right to request review of a significant decision based solely on automated processing, you may contact us using the methods in section 15.

8. Who we share personal data with

We may share personal data with:

• •authorised employers, recruitment agencies and employer account users, according to candidate visibility settings and platform rules;
• •candidates, where necessary to identify or enable communication with an employer;
• •cloud hosting, database, cybersecurity, identity, authentication, communications, customer-support, analytics and software providers;
• •payment gateways, banks, accountants, auditors and professional advisers;
• •Google or LinkedIn when you choose their sign-in services;
• •regulators, courts, law-enforcement agencies or public authorities where required by law or reasonably necessary to protect rights and safety;
• •a purchaser, investor or successor in connection with a genuine merger, financing, reorganisation or sale, subject to confidentiality and data-protection safeguards; and
• •another party where you specifically direct or consent to the disclosure.

We do not sell candidate personal data as a commercial list. Employer subscriptions provide controlled platform access for recruitment; they do not transfer ownership of candidate data or permit resale.

9. Service providers and data processors

We use service providers only for defined business functions and require appropriate confidentiality, security and data-protection commitments.

10. International and cross-border processing

Some technology providers may process or store data outside Sri Lanka, including in countries where their servers, support teams or group companies operate. Where cross-border processing occurs, we will take reasonable contractual, organisational and technical measures required by applicable law to protect the data and to ensure that recipients are bound by appropriate commitments.

The production vendor register and privacy notice must identify actual overseas providers and material processing locations once confirmed.

11. Data retention

We retain personal data only for as long as reasonably needed for the purposes described in this Policy, including providing the service, maintaining security, meeting legal and accounting duties, resolving disputes and enforcing agreements.

Unless a different period is required by law or a dispute:

• •active account and profile data is retained while the account remains open;
• •a candidate profile is hidden promptly when the candidate switches visibility off;
• •accounts inactive for 24 months may be deactivated after reasonable notice and later deleted;
• •platform messages and support records may be retained for up to 24 months after closure of the relevant matter;
• •security and access logs may be retained for up to 12 months;
• •failed verification and abuse-prevention records may be retained for up to 24 months, or longer where necessary to prevent repeat misuse;
• •invoice, payment and accounting records are retained for the period required by applicable tax and accounting laws;
• •consent, terms-acceptance and complaint records may be retained for the period needed to demonstrate compliance and defend legal claims; and
• •deleted data may remain in protected backups for up to 90 days before routine overwrite, unless restoration, investigation or legal preservation is required.

These periods must be adjusted to match the production system and internal retention schedule before publication.

12. Security

We use reasonable administrative, organisational and technical measures appropriate to the nature and risk of the data. These may include access controls, role-based permissions, secure password handling, encryption in transit, secure backups, logging, monitoring, vulnerability management, staff confidentiality obligations and procedures for handling incidents.

No online service is completely secure. Users must protect their passwords, use unique credentials, sign out of shared devices and report suspected compromise immediately. We will notify regulators and affected users of a personal data breach where required by applicable law.

13. Your choices and rights

Subject to applicable law, you may request to:

• •access and receive information about personal data we process;
• •correct or complete inaccurate data;
• •withdraw consent where processing is based on consent;
• •object to or request that we stop certain processing;
• •erase personal data where the legal conditions are met;
• •request review of an applicable decision based solely on automated processing;
• •hide your candidate profile without deleting your account;
• •close and delete your account; and
• •complain to the Data Protection Authority of Sri Lanka or another competent authority.

We aim to respond without undue delay and ordinarily within one month after receiving a complete and verified request. For complex or multiple requests, the period may be extended by up to two further months where permitted; we will explain the extension.

Some requests may be limited where retention is required by law, needed for fraud prevention, security, legal claims, the rights of another person or another lawful reason. We may ask for information needed to verify identity and authority before acting.

14. Marketing preferences

Marketing consent is optional and separate from acceptance of the Terms. You may unsubscribe using the link in a message, change notification settings or contact us. We may still send essential service messages, such as security, account, billing and material terms notices.

15. How to make a privacy or deletion request

Use any of the following methods:

• •the account settings and privacy controls available in your dashboard;
• •the request page at /privacy-request;
• •email to info@careerconnect.lk or
• •WhatsApp to +94 70 459 7000, clearly marked “Privacy Request.”

Include your account email, the type of request and enough information for us to locate the account. Do not send passwords, one-time passwords or unnecessary identity documents through ordinary email or WhatsApp.

16. Complaints to the Data Protection Authority

You may have the right to complain to the Data Protection Authority of Sri Lanka. Current authority contact information should be obtained from the Authority’s official website. We encourage you to contact us first so we can attempt to resolve the concern promptly.

17. Children and age requirement

CareerConnect is intended for persons aged 18 years or older. We do not knowingly allow persons under 18 to create candidate or employer accounts. If we learn that an underage person has created an account, we may suspend it and delete the data, subject to legal requirements.

If the business later decides to support school students or minors, it must implement a separate age-verification, parental-consent and child-safeguarding process before doing so.

18. Third-party websites

The platform may contain links to employer websites, social networks, payment providers or other external services. Their privacy practices are governed by their own notices, and CareerConnect is not responsible for their independent processing.

19. Changes to this Policy

We may update this Policy to reflect changes in law, technology or services. We will publish the revised date and provide additional notice for material changes where appropriate. Continued use after the effective date of a valid update is subject to the revised Policy, but we will seek consent where legally required.

20. Contact us