Privacy Policy & Data Protection.
Ensoftics operates on rigorous data minimization, military-grade encryption, and strict bilateral non-disclosure protocols. We treat your proprietary information with the same uncompromising standards we apply to our engineering.
Zero Data Monetization
We never sell, rent, or trade client inquiries, candidate resumes, or proprietary details to data brokers or advertising networks.
Cryptographic Protection
All database stores, communication channels, and telemetry pipelines are secured via TLS 1.3 in transit and AES-256 at rest.
Bilateral NDA & Code Sovereignty
100% of custom software, algorithms, and design systems engineered for clients belong entirely to the client under binding NDAs.
GDPR & International Compliance
Full adherence to European GDPR, UK Data Protection Act 2018, and California Consumer Privacy Act standards.
Corporate Identity & Applicability
This Privacy Policy applies to all digital properties, software portals, and engagement channels operated by Ensoftics Technologies Inc. (“Ensoftics”, “we”, “our”, or “us”). Ensoftics is a registered technology engineering and digital brand architecture studio headquartered at:
Ensoftics Technologies Inc.
Rambaikkulam, Vavuniya, Sri Lanka
Direct: +94 77 031 6548 • Email: info.ensoftics@gmail.com
We design and deliver mission-critical software architectures, web applications, mobile platforms, and rebrandings for enterprise clients across Sri Lanka, the United Kingdom, Europe, North America, Australia, Singapore, and worldwide. By accessing our website (ensoftics.com) or utilizing our client portals, you acknowledge the terms established in this policy.
Information We Collect & Purpose
We adhere strictly to the principle of data minimization. We only collect information that is strictly necessary to conduct client discovery, evaluate talent applications, and protect our infrastructure:
Client Discovery & Inquiries (/contact)
When prospective enterprise partners initiate contact through our discovery portal, we collect: client representative name, work email, organization name, chosen engineering disciplines, estimated budget brackets, and high-level architectural briefs.
Purpose: Facilitating discovery consultations, executing feasibility analyses, and preparing tailored technical proposals.Careers & Talent Applications (/careers)
When engineering, design, or leadership candidates apply for open roles, we collect: full name, contact email address, target position, portfolio/GitHub/LinkedIn hyperlinks, years of professional experience, and motivation statements.
Purpose: Evaluating technical craftsmanship, conducting interview rounds, and extending employment agreements.Engineering Dispatches Newsletter
When subscribers opt in to receive architectural whitepapers and engineering case studies, we store the validated email address.
Purpose: Delivering high-signal technical publications. Can be cancelled at any time via single-click unsubscribe.Automated Security Telemetry
To safeguard against automated DDoS, brute-force intrusions, and web application attacks (OWASP Top 10), our edge network records client IP addresses, browser user-agents, request timestamps, and rate-limiting metrics.
Purpose: Cyber-defense, rate limiting enforcement, and infrastructure health monitoring.Legal Basis for Processing (GDPR Article 6)
Under international data protection regulations, including the European Union General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018, we process your information under the following lawful bases:
- Contractual Performance (Art. 6(1)(b)): Processing necessary to fulfill or enter into commercial software development agreements, client discovery scopes, and employment contracts.
- Legitimate Interests (Art. 6(1)(f)): Protecting our cloud infrastructure from cyber-attacks, enforcing API rate limits, verifying administrative session tokens, and ensuring uninterrupted uptime.
- Explicit Consent (Art. 6(1)(a)): Given freely by subscribers to our engineering newsletter or candidates submitting optional portfolio links.
- Legal Compliance (Art. 6(1)(c)): Fulfilling accounting, taxation, and statutory record-keeping obligations required by law.
Code Sovereignty, NDAs & Intellectual Property
At Ensoftics, software engineering is an institutional partnership. We enforce rigorous non-disclosure protocols designed to protect enterprise trade secrets:
100% Client Intellectual Property
All source code, database architectures, APIs, custom algorithms, workflows, and brand identity assets crafted by Ensoftics for a client become 100% the exclusive property of that client upon final delivery.
Zero Public AI Training on Client Codebases
Ensoftics enforces an absolute policy against feeding client source code, database schemas, or proprietary business intelligence into public generative AI models or public datasets. Your competitive advantage remains strictly air-gapped.
Isolated Environments & Least-Privilege Access
Client repositories are hosted in isolated private organizations. Secret environment variables, API credentials, and production tokens are strictly segregated using zero-trust identity management.
Cryptographic Controls & OWASP Hardening
We treat security as a first-class architectural pillar. Our web platform implements state-of-the-art protections against the OWASP Top 10 vulnerabilities:
- Transport Encryption (HSTS): Strict HTTP Transport Security enforced for 2 years (
max-age=63072000; includeSubDomains; preload) ensuring zero protocol downgrade attacks. - Content Security Policy (CSP): Hardened origin isolation restricting script, style, and media sources to authorized CDNs and preventing reflected/DOM cross-site scripting (XSS).
- Clickjacking Defense:
X-Frame-Options: DENYandframe-ancestors 'none'headers disallowing malicious embedding in third-party iframes. - NoSQL & SQL Injection Immunity: Comprehensive deep-sanitization recursive filters stripping MongoDB operator keys (
$gt,$where,$regex) and validating inputs via strict Zod schemas. - Constant-Time Cryptography: Authentication token hashes and API secret verifications utilize
crypto.timingSafeEqualto disarm timing side-channel attacks. - Redacted Cloud Logging: Automatic sanitization strips database connection URIs, passwords, and bearer tokens from all application logs before dispatch to monitoring aggregators.
- Sliding-Window Rate Limiting: In-memory and edge token bucket rate limiters protect all public endpoints against brute-force attacks and bot flooding.
Your Legal Data Rights
Regardless of your geographic location, Ensoftics extends the world-standard privacy rights codified under the GDPR, UK DPA, and CCPA/CPRA:
Right to Access
Request a full export of any personal records or inquiries stored in our systems.
Right to Erasure ("Right to be Forgotten")
Request complete expungement of your contact records, candidate data, or email subscriptions.
Right to Rectification
Update inaccurate or incomplete contact or candidate information at any time.
Right to Data Portability
Receive your data in a structured, commonly used, machine-readable JSON format.
To exercise any of these statutory rights or ask any questions regarding your personal data, please contact us directly at info.ensoftics@gmail.com. We respond to all verified inquiries promptly without administrative fees.
Data Retention Schedules
Personal and organizational records are retained only for as long as necessary to accomplish the designated purpose:
- Client Discovery Inquiries: Retained throughout the duration of active commercial negotiations or active project execution. Dormant inquiries without active commercial engagement are securely deleted after 12 months.
- Candidate Submissions: Retained for 6 months to evaluate future engineering openings unless the candidate requests immediate deletion.
- Newsletter Subscriptions: Retained until the subscriber triggers an unsubscribe action. Upon unsubscribe, records are promptly flagged and deleted.