Global Privacy Policy

Version 1 (Effective date: 1 September 2024)

1. Scope

This Fortude Global Privacy Policy (“Privacy Policy”) is issued on behalf of Fortude (Private) Limited and its affiliates (jointly the “Fortude Group”). All references to “Fortude”, “we”, “us” or “our” in this Policy is a reference to the relevant entity in the Fortude Group, responsible for processing your personal data.

Fortude takes your privacy seriously, and we are committed to protecting your personal data. This Policy explains who we are, how we collect, share and use your personal data and how you can exercise your privacy rights.

How this Policy applies to you
  1. Interactions with you via our website and other products and services we offer, and where we otherwise display or link to this Privacy Policy.

    This Policy applies to interactions we have with you via our website and other products and services, and where we otherwise display or link to this Privacy Policy. If you have entered into a specific agreement with Fortude regarding any matters covered under this Privacy Policy, that specific agreement prevails over this Privacy Policy, in the case of any inconsistencies with regard to the processing of your personal data.

  2. Rights guaranteed to you under the data protection laws of your country.

    You may also have certain rights with respect to your personal data under applicable data protection laws of your country. We have included supplemental information in this Privacy Policy, in the form of a ”Local Country Addendum” for each of our group entities, which are located in;

    1. Sri Lanka
    2. Australia
    3. USA
    4. Canada
    5. United Kingdom
    6. Netherlands

Click on the Country that may apply to you to see the Local Country Addendum applicable to you.

This Privacy Policy and the Local Country Addendum for your relevant jurisdiction, will be applicable to you. In the case of any inconsistencies between this Privacy Policy and the Local Country Addendum applicable to you, the Local Country Addendum will prevail, with regard to the processing of your personal data.

2. What Does Fortude Do?

Fortude is a global enterprise and digital solutions company, that delivers digital solutions that matter to its customers around the world. The company’s enterprise digital services capability spans across ERP, integrations, application development, data analytics, managed services, automation, and digital advisory.

Fortude has offices in the US, Canada, UK, Netherlands, Sri Lanka, Singapore and Australia and partners with several large global technology, cloud, and automation product companies.

For more information about Fortude, please see the “About” section of our website.

3. What Personal Information Does Fortude Collect And Why?

The term personal data means any information about an individual from which that individual may be identified. It does not, therefore, include data where the identity has been removed (anonymised data).

We may collect, store and use some or all of the following categories of data about you:

  • Identity Data includes first name, maiden name, last name, user name or any other similar identifier, marital status, title, date of birth and gender.
  • Contact Data includes addresses, email addresses and telephone numbers.
  • Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
  • Profile Data includes your interests, preferences, feedback and survey responses.
  • Usage Data includes information about how you use our website, products and services.
  • Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

This personal data is needed so that we can provide our services and supply our products to you or your business or your company. If you do not provide the personal data asked for, we may be delayed or prevented from providing those products and services to you, but we will notify you if this is the case at the time. Please keep us informed if your personal data changes during your relationship with us.

Unless it is necessary to do so, we will not seek to obtain any Special Categories of Personal Data about you ( which includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation or practices, political opinions or associations, trade union membership, information about your health, and genetic and biometric data). We will also not seek to obtain any information about criminal convictions and offences. Where it is necessary to obtain Special Categories of Personal Data, we will abide by the Local Country Addendum applicable to you.

4. How Does Fortude Collect Your Personal Data?

We will collect most of your personal data directly from you, whether in person, by telephone, text or email and/or via our website. This might be when you:

  • Apply for our services;
  • Complete an online form;
  • Subscribe to our services or one of our publications/newsletters;
  • Request that information be sent to you;
  • Take part in a survey;
  • Write to us with information;
  • Send a postal form to us;
  • Telephone, fax, text or email us;
  • Send information to us using social media, any digital/online applications or through our website;
  • Provide feedback on our products and services; or
  • Make a complaint or contact us to request correction of your personal data, as set out in this Privacy Policy.

However, we may also collect information indirectly about you:

  • From publicly-accessible sources (for example the internet, LinkedIn or Companies House); and/or
  • Directly from a third party (for example from providers of technical, payment and delivery services and data brokers or aggregators); and/or
  • From businesses who are our customers for the supply of our services under contractual obligations to them.
  • From automated technologies or interactions with our website through the use of cookies and similar; and/or
  • Via our systems (for example door entry systems and reception logs, CCTV and access control systems, communications systems, email and instant messaging).
  • When we enter into agreements with our customers to deliver services.
  • For statistical and other research purposes in which case we will use Aggregated Data.

Where we process your personal data under instructions of our customers or any third party (the data controller), we rely on such instruction as a basis for the processing of your personal data, and such customer or third party will remain responsible for ensuring primary legal bases for such processing are compliant with the applicable data protection laws of your country.

We will collect most of your personal data directly from you, whether in person, by telephone, text or email and/or via our website. This might be when you:

  • Apply for our services;
  • Complete an online form;
  • Subscribe to our services or one of our publications/newsletters;
  • Request that information be sent to you;
  • Take part in a survey;
  • Write to us with information;
  • Send a postal form to us;
  • Telephone, fax, text or email us;
  • Send information to us using social media, any digital/online applications or through our website;
  • Provide feedback on our products and services; or
  • Make a complaint or contact us to request correction of your personal data, as set out in this Privacy Policy.

However, we may also collect information indirectly about you:

  • From publicly-accessible sources (for example the internet, LinkedIn or Companies House); and/or
  • Directly from a third party (for example from providers of technical, payment and delivery services and from data brokers or aggregators); and/or
  • From businesses who are our customers for the supply of our services under contractual obligations to them.
  • From automated technologies or interactions with our website through the use of cookies and similar; and/or
  • Via our systems (for example door entry systems and reception logs, CCTV and access control systems, communications systems, email and instant messaging).
  • When we enter into agreements with our customers to deliver services.
  • For statistical and other research purposes in which case we will use Aggregated Data.

Where we process your personal data under instructions of our customers or any third party (data controller), we rely on such instruction as a basis for the processing of your personal data, and such customer or third party will remain responsible to ensure primary legal bases for such processing are compliant with the applicable data protection laws of your country.

5. How Does Fortude Use Your Personal Data?

We will only use your personal data when the law allows us to do so, and where we have a proper reason for doing so. We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another related reason, and that related reason is compatible with the original purpose. If we need to use your data for an unrelated purpose, we will seek your consent, via telephone, email or text message to use it for that new purpose. Please note that we may process your personal data without your knowledge or consent, where this is required or permitted by law.

If you would like to know more about the specific instances we use your data, please click here for more information.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your personal data. Please contact our Data Protection Officer (see Section 15) if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in Table 1.

6. What is Fortude’s Marketing and Opt-out Policy?

In addition to the purposes set out in Table 1, where permitted by law, we may use your name and contact details for promotional and marketing purposes, including sending you promotional material and conducting direct marketing in relation to our products and services. For direct marketing, we may, where permitted by law, provide your personal data  to providers (whether within the Fortude Group or otherwise) and call centers, marketing or research services so that they can send you promotional material and conduct direct marketing in relation to the products and services we offer (these materials may be sent by postal mail, text, email or other means).

Before using or providing your personal data for the purposes and the transferees set out in this section, we may be required by law to obtain your written consent, and in such cases, only after having obtained such written consent, will we use and provide your personal data for any promotional or marketing purpose.

The type of personal data that Fortude would use and provide for direct marketing purposes as described above are your name and relevant contact details, although we may possess additional personal data.

If you have given your consent to being sent marketing communication or marketing materials (where such consent needs to be expressly obtained by law), you may at any time ask us to stop sending these to you simply by: contacting our Data Protection Officer; or, where provided, by logging into the website and checking or unchecking relevant boxes to adjust your preferences; or by following the opt-out links on any marketing communication or marketing message sent to you.

Before using or providing your personal data for the purposes and the transferees set out in this section, we may be required by law to obtain your written consent, and in such cases, only after having obtained such written consent, will we use and provide your personal data for any promotional or marketing purpose.

The type of personal data that Fortude would use and provide for direct marketing purposes as described above are your name and relevant contact details, although we may possess additional personal data.

If you have given your consent to being sent marketing communication or marketing materials (where such consent needs to be expressly obtained by law), you may at any time ask us to stop sending these to you simply by:

  1. Contacting our Data Protection Officer;
  2. or, where provided, by logging into the website and checking or unchecking relevant boxes to adjust your preferences;
  3. or by following the opt-out links on any marketing communication or marketing message sent to you.

7. How Does Fortude Share Your Personal Data?

We may be required to share your personal data within the Fortude Group for the purposes set out in the table above. Our group entities are currently located in Sri Lanka, Singapore, Australia, the USA, Canada, the Netherlands and the United Kingdom (it is understood however that there may be further entities incorporated in the future). If it is necessary for a group entity outside your jurisdiction to transfer and process your personal data, such group entity will act as joint controller and processor and we will notify you by text or email.

We shall use appropriate safeguards to ensure that:

  • We only transfer your personal data to jurisdictions that can guarantee the provision of appropriate technical and organizational measures to ensure the protection of your personal data in accordance with this Policy; and
  • The service provider is bound by a contract which gives your personal data the same protection it has in the controller’s jurisdiction.

Please contact our Data Protection Officer if you require any additional information regarding the mechanism used for the transfer of your personal data outside the jurisdiction in which you reside.

If we do need to share your personal data with any external third parties (other than the situations permitted in this Policy), we will contact you via text or email to obtain your express consent before doing so (unless statutorily not required to do so). We will, however, ensure that sharing of your data is kept to a minimum. We do not permit your personal data to be used by those third parties for their own purposes, and they may only process your data for specified purposes, and in accordance with our instructions.

Please click here to see the specific instances we may share your personal data.

We will not share your personal data with any external third parties, except in the following instances:

  • Where the external third party provides services on our behalf (for example delivery companies or service providers acting as processors); and/or
  • If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, to enforce or apply our website terms of use or to protect the rights, property or safety of our website, our users and others; and/or
  • If we are required to disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations (for example, lawyers, bankers, auditors, insurers, HM Revenue & Customs, regulators, courts and other authorities acting as processors or joint controllers).
  • We may also need to share your data with third parties to whom we may choose to sell, transfer or merge parts of our organization. If this occurs, the new owners may use your personal data in the same way as set out in this Policy.
  • We use Google Analytics to collect information about those who use our website, including IP addresses, unique identifiers, device and software details, mobile phone carrier and geo-location data. This helps us to understand the use that is made of our website. Google is prohibited from using our data for any other purposes. Refer Google Analytics Privacy Policy.

8. How Does Fortude Store And Retain Your Personal Data?

Personal data is stored on our secure servers and/or at our premises. We will keep your personal data only for as long as we have an ongoing legitimate business need to do so. In working out how long we need to keep your personal data we take into account the amount, nature and sensitivity of the personal data, contractual obligations,  the potential for harm to arise from its unauthorized use or disclosure, the purposes for which we process it, and as to whether those purposes may be achieved by other means, and the applicable legal requirements (for example, to provide you with a product or service that you have requested for or to comply with applicable legal, tax or accounting requirements).

Since retention periods will differ for different types of personal data, please contact our Data Protection Officer for further details.

9. How Does Fortude Keep Your Personal Data Secure?

In order to ensure that your personal data is kept secure, and to prevent there being any breach of confidentiality or unauthorized use, we have put in place reasonable technical and organizational measures that are designed to prevent your personal data from being accidentally lost or used or accessed unlawfully. Access to your personal data is restricted to those with a need to access it, and regard will be given to the need for confidentiality when that personal data is processed.

If there is a suspected data security breach you will be notified. Where relevant, we will also inform the appropriate regulator of a suspected data security breach, where we are legally required to do so.

Please bear in mind that the transmission of information via the internet is not completely secure, and whilst we will do our best to protect your personal data, we cannot guarantee the security of data transmitted via our website, or by email, and any such transmission is at your own risk.

10. What Are Your Data Protection Rights?

You may have the following data protection rights, depending on inter alia the nature of the data shared and the applicable jurisdictional legislation. These include the right to:

This right allows you to receive, from us, confirmation as to whether or not your personal data is being processed, and if so to gain access to that personal data and various other information about it, including the purpose for the processing, with whom your personal data is shared, how long your personal data will be retained, and the existence of various other rights.

This is a right to obtain from us, without undue delay, the putting right of inaccurate personal data concerning you.

This is the right for you to request that, in certain circumstances, we delete data relating to you.

This is the right to request that, in certain circumstances, we restrict the processing of your personal data.

This is, a right, in certain circumstances, to object to your personal data being processed by us where it is in relation to direct marketing, or in relation to processing supported by the argument of legitimate interest.

This is the right in certain circumstances, to receive that personal data which you have provided to us, in a structured, commonly used and machine-readable format, and the right to have that personal data transmitted to another controller.

This is the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you, or similarly significantly affects you.

If we collect and process your personal data with your consent, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to withdrawal, nor will it affect the processing of your personal data conducted in reliance on lawful processing grounds other than consent. If you withdraw consent, we may not be able to provide certain products or services to you.

In some circumstances however, we may not be able to do what you have asked; for example, where there is a statutory or contractual requirement for us to process your personal data and it would not be possible to fulfil our legal obligations if we were to stop.

Enforcement of your Rights

Please refer the Local Country Addendum applicable to you, for details regarding the enforcement of your data protection rights.

11. What is Fortude’s Cookie Policy?

Cookies are small text containing small amounts of information which are downloaded and may be stored on any of your web browsers or internet enabled devices (e.g., your computer, smart phone or tablet) that can later be read by the server-like memory from a web page.

We may use cookies and other tools on the website. By continuing to use the website, you are agreeing to us placing cookies on your internet enabled device. The information collected (including but not limited to: your IP addresses (and domain names), browser software, types and configurations of your browser, language settings, geo-locations, operating systems, referring website, pages and content view, and durations of visit) will be used to ensure operation of the website and enable you to log in securely, for compiling aggregate statistics on how our visitors reach and browse our website for web enhancement and optimization purposes, and help us understand how we can improve your experience on it.

The cookies also enable our website to remember you and your preferences and tailor the website to your needs. Advertising cookies will allow us to provide advertisements on our websites that are as relevant to you as possible or prevent the same advertisement from constantly reappearing to you. You can find more information on the types of cookies we collect, what we use these for, and how to manage your cookie settings in our cookie policy.

12. Links to Third-Party Websites?

If any part of this website contains links to other websites, those sites may not operate under this Privacy Policy. You are advised to check the privacy statements on those websites to understand their policies on the collection, usage, transferal and disclosure of personal data.

13. How Can Our Website Be Accessed by Minors?

We do not sell our products or provide our services to children, nor do we market to children.

If you are under 18, you may use our website only with consent from a parent or guardian. We collect data about all users of and visitors to these areas regardless of age, and we anticipate that some of those users and visitors will be children. Such child users and visitors will inevitably visit other parts of the website and will be subject to whatever on-site marketing they find, wherever they visit.

14. What Happens If This Privacy Policy is Updated?

We review and update this Privacy Policy from time to time. When we do, we will note the “effective date” and “version” at the top of this Privacy Policy. Any changes, updates or modifications will be effective immediately upon posting. If we make material changes to this Privacy Policy, we may also let you know via a prominent notice on the website.

15. Contact Details

Fortude (Pvt) Ltd, a company incorporated in Sri Lanka, bearing Company Registration No. PV 85081 and having its registered office at 25, Rheinland Place, Colombo 03, Sri Lanka (“Fortude Sri Lanka“) is the controller for the purposes of this Privacy Policy, and is responsible for your personal data.

If you have any queries about this privacy policy or our privacy practices or wish to exercise your legal rights, you may address your queries to our Data Protection Officer at:

The Data Protection Officer,
Legal & Compliance,
Natashiya Noordeen
DPO@fortude.co

Any such request should clearly state the details of the Personal Data in respect of which your request is being made. Please refer to the Local Country Addendum applicable to you, for country specific details regarding your legal rights.