This Privacy Statement governs the way Cinnamon Hotel Management Limited (“Company”) [company registration number PB 7] of No. 117, Sir Chittampalam A. Gardiner Mawatha, Colombo 02, Sri Lanka and the hotels it operates under the Cinnamon Brand (jointly “Cinnamon Hotels & Resorts”) collects, uses, maintains and discloses information collected before, during, and after your working relationship with Cinnamon Hotels & Resorts. It applies to all permanent and temporary employees, workers, contractors, past employees and any other individuals who are working for us but are not directly employed (“employees” or “you”). It also applies to those who have applied for employment with Cinnamon Hotels & Resorts (“employment candidates” or “you”). This privacy statement may also be referred to as the ‘Employee & Employment Candidate Privacy Policy”.
1. WHAT PERSONAL DATA DO WE COLLECT?
We collect, maintain, and use different types of Personal data in the context of our employment relationship or potential employment relationship with you. The following provides examples of the type of information that we collect from you and how we use the information.
- Contact information (such as name, address, telephone number, email address, etc.)
- Unique Identifiers (such as national identity card, passport, driver’s license etc.)
- Educational and professional information (qualifications and licenses etc.)
- Employment history (previous employment records, information of and from referees, information from your social media accounts such as LinkedIn and from other John Keells Group companies)
- Special categories of personal information (police reports, grama sevaka certificates, religion, Biometrics, gender, race, nationality, medical reports)
- Financial information (bank account details, credit and debit card etc.)
- Technology equipment and system information (call logs, system usage logs, browsing history etc.)
- Audio recordings
- Photographs and CCTV footage
- Contact details of your family or other relationships for emergency
- Other master data required such as marital status, spouse and dependent children with name and date of birth, residence permit (when applicable), work permit (when applicable) and tax information
2. HOW DO WE USE AND PROCESS YOUR PERSONAL DATA?
- Your personal data is only used for lawful and necessary purposes in furtherance to your employment and/ or as per our requirement to comply with any of our contractual and legal obligations.
- Most commonly, we will rely on the following types of lawful basis to process your Personal Data:
- Legitimate Interests: The legitimate interests of CH&R in conducting and managing its business in order to ensure a high standard of service, secure experience and legal compliance. We use best endeavors to balance any potential impact on you and your rights (both positive and negative) prior to processing your Personal Data for our legitimate interests. We will not use your Personal Data for activities where our interests are overridden by the impact on you (save with your express consent or as required/permitted by law).
- Performance of Contract: Processing and using your data is necessary for the performance of any services or contract to which you are a party to or to take steps at your request before entering into such a contract and the provision of the same to our service providers, agents and other parties as required for the purpose of facilitating the performance of the contract with you.
- Comply with a legal or regulatory obligation: It may be necessary for us to process your Personal Data to ensure compliance with applicable legal obligations or to comply with requests from Government, law enforcement, regulatory, judicial or related authorities in relation to obligations under law, regulation, national or public security or related inquiry.
- Consent: Where you have explicitly provided your consent, we will process your Personal Data for the specific purpose(s) for which that consent was obtained. You have the right to withdraw your consent at any time; however, this will not affect the lawfulness of any processing carried out prior to withdrawal. Where consent is the basis for processing, we will ensure that it is freely given, informed, specific, and unambiguous.
- Public Interest: We may process your Personal Data where such processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in CH&R. This may include situations where processing is required to support public functions or statutory duties that contribute to broader societal or community objectives, while ensuring that your rights and freedoms are respected.
Vital Interests: In rare circumstances, we may process your Personal Data where it is necessary to protect your vital interests or those of another individual. This basis will only be relied upon where the processing is essential to protect someone’s life or physical safety, and when no other lawful basis is available
3. WHEN DO WE COLLECT YOUR PERSONAL DATA?
- When you make an employment application (such to us through the website, by post or in person)
- When you communicate with us (such as via SMS, telephone calls, emails, etc.).
- From external agencies (such as employment agencies or background check providers).
- When you visit any of our premises.
- From your referees.
- From your previous employers.
- From anyone with whom you may have or had a business relationship with.
- From your doctor or other medical professional
- From our surveillance camera (CCTV) system.
- From other John Keells Group companies.
4. HOW DO WE USE YOUR PERSONAL DATA?
For employment Candidates
Purpose/Activity
Lawful Basis for Processing
- An item
- A second item
- A third item
- A fourth item
- And a fifth one