Compliance and Trust Policy

1. Scope and relationship to other documents

This Policy applies to cloudhub.lk and CloudHub products and related implementation, development, cloud subscription and support services that link to it. It supports a common approach for existing and future products while requiring product-specific disclosures and evidence.

Read it with the Terms of Service, Privacy Policy, Security Policy, product notices and your written agreement. A signed agreement or data processing addendum controls the matters it specifically addresses. This Policy is a public description of our approach, not an audit opinion, certification, legal assurance or additional service-level guarantee.

2. Applicable legal framework

Our Sri Lankan data-protection framework includes the Personal Data Protection Act No. 9 of 2022, as amended by Act No. 22 of 2025. Obligations apply according to the Act's legal scope and commencement orders. The July 2026 Gazette No. 2498/16 appoints 1 January 2027 for sections 2 and 3 and Parts I and III; this does not establish that every provision or implementing rule has the same commencement date.

Other relevant Sri Lankan legislation includes the Computer Crimes Act No. 24 of 2007 and the Electronic Transactions Act No. 19 of 2006, as amended. Employment, financial, tax and sector-specific requirements depend on the customer's activities. We avoid representing a criminal statute as a prescriptive security standard.

GDPR and California privacy requirements apply where their territorial, organisational and other applicability conditions are met. They do not apply in full merely because a record concerns an overseas resident. Specific international or sectoral obligations require assessment for the particular service and customer.

3. Roles and governance

Cloud Partners determines purposes for its own business, service administration and relevant controller activities. For customer operational records, the customer normally determines purposes, access and instructions, and Cloud Partners processes information on its behalf. Actual roles, including any processing on behalf of another controller, must be identified in the agreement.

Customers are responsible for lawful collection, relevant notices, staff permissions, retention instructions and operational decisions. Cloud Partners remains responsible for its own applicable legal and contractual duties. Infrastructure providers are responsible within the scope of their services and agreements.

For attendance, background location, HR, health information, payroll and any biometric processing, customers must assess necessity, proportionality, lawful grounds and any additional safeguards. Device permission and a software subscription do not replace an employee privacy notice or other legal requirements.

4. Data processing agreements and assistance

Where personal data is processed on behalf of a customer, the relevant agreement and any required data processing addendum must record the purposes, duration, data categories, affected individuals and instructions. Appropriate terms should address confidentiality, security, service providers, international processing, incident assistance, rights requests, return or deletion and legally required assurance.

Contact hello@cloudpartners.biz to discuss the processing arrangements required for your service. A data processing addendum is a separate agreement; this Policy does not claim that a complete addendum has already been executed for every customer.

Access, correction, export and deletion support depends on the product, record type and agreed responsibilities. A request may need coordination with the customer and may be subject to legal retention. We do not assert that every existing application has automated self-service controls for every privacy right.

5. Providers international processing and certifications

Providers must be identified for the actual service and function, including hosting, storage, authentication, communications, maps, payments, AI and other integrations where used. Customers should obtain the relevant processing schedule, locations and contractual terms. A future integration requires review before introducing a new data use.

International processing must be assessed against applicable law and supported by any required legal mechanism. Hosting in the United States, Europe, India or Singapore does not by itself establish a lawful transfer. Do not infer an adequacy decision or a signed transfer instrument from a provider's reputation.

Provider certifications and assurance reports belong to the named provider and their stated services, regions and audit periods. They do not establish certification of Cloud Partners, a custom application or a customer. Consult current Google Cloud and Zoho compliance resources and verify scope before relying on a particular assurance.

GDPR and HIPAA are legal frameworks, not interchangeable general product certificates. PCI DSS scope depends on the payment activities and system boundary. Independent certification of Cloud Partners will be described only when supported by current evidence.

6. Product assurance and future releases

Procurement products process business approvals and commercial records; lawful operation also depends on customer access controls and financial processes. Cloudyy processes templates and document-generation content and must accurately describe storage, usage records and integrations. Muster requires clear disclosures for workplace data, location, Google services, mobile permissions and optional AI.

Before a new product or material feature is released, the responsible team should confirm its data inventory, roles, purposes, providers, locations, access restrictions, retention, rights-request route and relevant security evidence. Product notices and agreements must be updated for the resulting processing.

Future-product coverage is a common legal framework, not advance authorisation for undisclosed tracking, sensitive data, AI training or additional Google permissions. New uses require the applicable notice, processing grounds, provider terms and any required consent before they begin.

7. Evidence and customer due diligence

Customers may request relevant information about architecture, service providers, security controls, retention, recovery arrangements and processing terms. Availability, confidentiality and the scope of any audit or assistance are governed by law and the applicable agreement. Do not request credentials or other customers' information as assurance evidence.

Claims about mandatory MFA, data encryption, immutable logs, continuous monitoring, independent testing, staff screening, backup frequency, recovery objectives and deletion times must be supported for the deployment concerned. A public policy is not evidence that a claimed control has been implemented or tested.

Customers should maintain their own governance, staff guidance, access reviews, retention rules and any required impact assessments or audits. Cloud Partners can provide agreed technical assistance, but use of our services does not automatically satisfy every regulatory or industry requirement.

8. Incidents requests and updates

Use hello@cloudpartners.biz for compliance questions, privacy requests or security concerns and identify the affected product and organisation. Rights requests and incidents are handled according to the relevant role, applicable deadlines and the customer agreement. The Security Policy describes reporting and notification principles.

This Policy may be revised to reflect product, legal and operational changes. Material changes are communicated through an appropriate channel, with contractual commitments remaining subject to the agreement and applicable law.

9. Contact