Privacy policy

Last updated: 5 November 2026

This privacy policy explains how Elevracorp handles personal data that we collect through elevracorp.com, through our enquiry and job application forms, and when you email, call or message us. It also explains your rights and how to use them.

Who we are

This website is run by Elevracorp, a call centre and business process outsourcing (BPO) company based at No. 26, Narahenpita, Nawala, Colombo, Sri Lanka. We decide how and why the personal data described in this policy is used, which makes us its "controller" in data protection law.

This policy does not cover personal data we handle for our clients when we answer or make calls for them. In that work we follow the client's instructions, and the client's own privacy notice explains how the data is used. If we called you on behalf of a client, you can still contact us with questions or ask us to stop calling you.

The laws we follow

Sri Lanka's Personal Data Protection Act No. 9 of 2022, as amended by Act No. 22 of 2025 (the PDPA), governs how we handle personal data. Its core obligations, including the rules on lawful processing and the duties of organisations that handle personal data, take effect on 1 January 2027 (Daily FT, 10 August 2026). We are preparing for them and will update this policy as our arrangements change.

If you are in the European Economic Area (EEA) or the United Kingdom, for example as a visitor to this site or as a client, the EU General Data Protection Regulation (GDPR) or the UK GDPR may also apply to how we handle your data. Where they apply, you have the rights they give you.

What we collect

Enquiries

Our quote form asks for your name, a work email or a phone or WhatsApp number (at least one of the two), the service you need and a message about the work. You can also give your company, where your customers are, the languages you need and the team size you have in mind.

The form also records the page you sent it from and, where your browser allows it, how you first reached the site during that visit: the first page you opened, the website that sent you (if any) and any campaign tags in the link you followed, such as utm_source. The site keeps a short note of these in your browser's session storage, which is cleared when you close the tab (see our cookie policy).

Job applications

Our application form asks for your name, phone or WhatsApp number, email address, the languages you speak, a few lines about you and the role you are applying for. Email and the few lines about you are optional.

You can also send your CV by email or on WhatsApp. We then hold whatever you send, such as your contact details, education and work history. If we interview you, we also keep our notes and the outcome. Please do not include sensitive details, such as health information, religion or your national identity card number, unless we ask for them.

We use your application to consider you for a role. The period we keep it for is set out under how long we keep it, and you can ask us to delete it at any time (see your rights).

Emails, calls and WhatsApp messages

If you email, call or message us, we receive your contact details, such as your email address or phone number, and anything you choose to tell us or send us. On WhatsApp we also see your profile name.

Visits to this site

If analytics is allowed, Google Analytics collects information about your visit: the pages you view, how you reached the site (for example from a search engine), your approximate location (country or city), your device and browser type, and actions such as clicking a phone, WhatsApp or email link or sending a form. For forms, it records that a form was sent and the service or role chosen, never what you wrote. If analytics is not allowed, Google Analytics sets no cookies, but Google's tag may still send Google limited information that does not use cookies. Our cookie policy explains this and how to change your choice.

Our hosting provider, Vercel, also receives technical information each time your browser requests a page, such as your IP address, browser type, the page requested and the time. Vercel needs this to deliver the site, keep it secure and help us fix problems.

How we use it and why

We use personal data only where the law gives us a lawful basis. We use it to:

• Answer enquiries and prepare quotes. Lawful basis: our legitimate interest in replying to people who contact us, or steps you ask us to take before entering into a contract.
• Assess job applications and contact candidates. Lawful basis: steps you ask us to take before an employment contract, and our legitimate interest in recruiting the right people.
• Keep your CV for future roles after the period set out below. Lawful basis: your consent.
• See which pages and campaigns bring enquiries, using the visit details sent with the quote form. Lawful basis: our legitimate interest in knowing which of our marketing works.
• Understand how the site is used with Google Analytics. Lawful basis: your consent in the EEA, the UK and Switzerland. Elsewhere, our legitimate interest in improving the site, and you can turn analytics off at any time.
• Keep the site and our systems secure, for example by filtering spam sent through our forms. Lawful basis: our legitimate interest in protecting the site and the people who use it.
• Meet legal obligations and deal with legal claims, for example if a court or regulator asks us for information. Lawful basis: legal obligation, or our legitimate interest in establishing, exercising or defending legal claims.

We do not sell personal data, we do not add your enquiry details to marketing lists, and we do not make decisions about you using only automated means.

You do not have to give us personal data, but we need your contact details to reply to an enquiry or consider an application.

Who receives your data

Our staff read enquiries, and our HR team handles job applications. We also use these service providers:

• Vercel hosts this website and runs the form that sends your enquiry or application to us. See the Vercel privacy notice.
• Zoho provides our email (Zoho Mail). Form submissions reach us as emails in our Zoho mailbox, along with any emails and CVs you send us. See the Zoho privacy policy.
• Google provides Google Analytics, which measures how the site is used. See how Google uses information from sites that use its services.
• WhatsApp, part of Meta, carries your messages under its own terms if you choose to contact us on WhatsApp. See the WhatsApp privacy policy.

We may also share personal data with professional advisers, such as lawyers and accountants, who must keep it confidential, and with courts, regulators or law enforcement bodies when the law requires it.

International transfers

We are based in Sri Lanka, so if you contact us from another country, your personal data comes to Sri Lanka. Our service providers may also store or process it in other countries, including the United States.

The European Commission has not recognised Sri Lanka as providing an adequate level of data protection (see the list of EU adequacy decisions). Where the GDPR or UK GDPR applies to a transfer, we rely on safeguards the law recognises, such as standard contractual clauses approved by the European Commission and, for UK data, the UK addendum to them. You can ask us for details of the safeguards that apply.

When the PDPA's rules on transfers out of Sri Lanka take effect on 1 January 2027, we will follow them too.

How long we keep it

We keep personal data only for as long as we need it:

• Enquiries: 24 months after our last contact with you. If your enquiry leads to a contract, we keep the related business records for as long as the contract and the law require.
• Unsuccessful job applications: 6 months after our decision, unless you agree to us keeping your details for longer so we can consider you for future roles. If you join us, your application becomes part of your staff records.
• Google Analytics: detailed event data is kept for up to 14 months. After that, only totals in reports remain.
• Server logs: kept by Vercel for the period set in its own policies.

When a period ends, we delete the data or make sure it can no longer identify you.

How we protect it

We take reasonable steps to protect personal data:

• The site uses an encrypted (HTTPS) connection.
• Our forms send your details to our mailbox over encrypted connections, and the site does not save them in a database.
• Only the people who need enquiries or applications for their work can see them.

No website or email system is completely secure, so we cannot guarantee the security of data you send us. If a personal data breach puts your rights at risk, we will tell you and the relevant authority where the law requires it.

Your rights

Depending on where you live and which law applies, you have these rights:

• Access: ask for a copy of the personal data we hold about you.
• Correction: ask us to correct data that is wrong or incomplete.
• Deletion: ask us to delete your data.
• Objection: object to how we use your data, including where we rely on our legitimate interests.
• Withdrawing consent: where we rely on your consent, for example for analytics cookies or for keeping your CV, you can withdraw it at any time. This does not affect what we did before.

If the GDPR or UK GDPR applies, you can also ask us to restrict how we use your data, or to give you your data in a common digital format so you can pass it to another organisation.

To use any of these rights, email info@elevracorp.com with "Privacy request" in the subject line. We may ask you to confirm your identity. We will reply within one month. If your request is complex, we may need up to two more months, and we will tell you why. There is normally no charge.

Some rights have limits, for example where the law requires us to keep certain records. If we cannot do what you ask, we will explain why.

How to complain

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to a data protection authority:

• In Sri Lanka: the Data Protection Authority of Sri Lanka.
• In the UK: the Information Commissioner's Office (ICO).
• In the EEA: the data protection authority in the country where you live or work, or where you think the problem happened. The European Data Protection Board keeps a list of these authorities.

Children

This site is meant for businesses and for adults looking for work. We do not knowingly collect personal data from children under 18. If you think a child has sent us personal data, please contact us and we will delete it.

Changes to this policy

We may update this policy, for example when the law changes or we change how we work. We will post the new version on this page and change the date at the top. If we make important changes, we will say so clearly on this page.

Contact us

For questions about this policy or your personal data, contact us at: