This site collects what you send us through its two forms, and nothing else.

What we collect

When you use the contact form, we receive your name, your email address, your company name if you give one, and your message. We ask for nothing else.

When you apply for a position, we receive your name, your email address, your CV as a PDF, and your phone number, links and note if you give them. Do not include identity numbers, a photograph or anything else we have not asked for.

Our hosting provider keeps standard server logs, which include IP addresses and the pages requested. We do not combine those logs with contact form messages.

To stop a script filling our inbox, the site remembers the address a form was sent from for up to an hour, counts how many came from it, and then forgets it. That count is not kept with your message and is lost whenever the site is updated.

Why we collect it

We use your details to reply to you and, if we work together, to prepare a proposal. We do not add you to a mailing list. We do not use your message for anything you did not ask for.

Who sees it

What you send is kept in our own system, not only in an inbox. A message or an application becomes a record there, and the people at Stack9 who handle enquiries and hiring open it, note what was decided, reply to it and can export it as a spreadsheet. Nobody outside Stack9 is given access.

Three companies handle it on our behalf so the site and the system can work: the email delivery service that carries the message, the provider that hosts our database and the private file store your CV goes into, and our hosting provider. All three are bound to process it only for us.

We do not sell personal data, and we do not share it for marketing.

How long we keep it

We keep a message for up to 24 months from the day it arrives, and a job application for up to 12 months, to consider you for the role you applied for and for later ones. Your CV goes sooner: once we have made a decision on your application we keep the file for a short while and then delete it, while the rest of the record stays for its full period. If we want to consider you again after that, we will ask you for a current CV rather than use an old one. A daily job carries all of this out, in the database and in the file store, and nothing is left behind for us to read. If you become a client, the contract sets the retention period for project records.

Only the people at Stack9 who handle enquiries and hiring open these records. When someone here removes one before its time is up, it leaves every list at once and can be brought back for a while by whoever removed it; ask us to delete yours and we take it out for good, along with your CV and everything written on the record. That cannot be undone, and we do not keep a copy.

Your choices

You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Write to us through the contact page and we reply within 2 working days.

Sri Lanka's Personal Data Protection Act, No. 9 of 2022 sets out rights over personal data. If you believe we have handled your data wrongly, tell us first so we can put it right.