Privacy Policy

Gimanhal (Pvt) Ltd ("Gimanhal", "we", "our", or "us") operates the website https://app.gimanhal.lk and associated travel reservation services. This Privacy Policy describes how we collect, store, process, and disclose personal data when you explore, reserve, or purchase hotel rooms, day out packages, buffet vouchers, tour experiences, or partner accommodations through our platform.

By using the Gimanhal platform, you acknowledge and agree to the practices described in this policy. If you do not agree with any terms within this document, please refrain from submitting personal data or accessing our services.

To process reservations, ensure guest security, and deliver seamless booking management, we collect specific categories of personal information:

• Account Information: If you register a customer or hotel owner account, we store your username, hashed credentials, contact profile, and preference settings.
• Social Logins: If you opt to sign in using Google Sign-In, we collect your verified name, email address, and avatar image as permitted by your Google profile permissions.

We collect and utilize your personal information solely for legitimate operational and business purposes, including:

• Reservation Fulfillment: Generating official booking vouchers, notifying accommodation and tour partners, and coordinating your arrival check-in.
• Customer Support: Addressing inquiries, modifications, cancellations, refund requests, and support tickets submitted through our contact channels.
• Security & Fraud Prevention: Detecting fraudulent booking attempts, verifying customer phone/email OTPs, preventing malicious bot activities, and enforcing platform integrity.
• Transactional Communications: Sending booking confirmations, invoice statements, critical policy updates, and arrival reminders.
• Platform Improvement: Aggregating non-identifying telemetry to evaluate page load speeds, search usability, and popular destinations.

Protecting your payment details is our highest priority. Gimanhal implements end-to-end tokenization and bank-level security protocols:

• No Card Storage: Gimanhal does not store full 16-digit credit/debit card numbers or CVV/CVC security codes on its servers.
• Certified Payment Gateways: All online transactions are processed through certified, PCI-DSS Level 1 compliant gateways including GenieBiz, Koko Buy Now Pay Later, and official banking merchant services.
• Bank Transfers & Pay-at-Hotel: For manual bank deposit slips or pay-at-property reservations, slips are retained strictly for auditing and payout verification before being archived.

We never sell, rent, or monetize your personal data. We disclose your data strictly under the following controlled circumstances:

• Hotel & Experience Partners: When you complete a reservation, necessary guest details (name, contact number, arrival schedule, guest counts, and special requests) are shared with the host hotel, buffet provider, or tour operator to secure your booking.
• Service Providers: Verified technological infrastructure partners that host our servers, deliver transactional emails/SMS notifications, and manage transactional databases under strict non-disclosure obligations.
• Legal Mandates: Where compelled by valid legal processes, law enforcement orders, or regulatory bodies in accordance with applicable laws.

Cookies are small data files stored on your device to enrich your browsing experience and remember preferences:

• Essential Cookies: Required for user session management, authentication, security tokens (CSRF protection), and shopping/booking cart persistence.
• Preference Cookies: Remember your selected display theme (Light or Dark mode), preferred currency, and recent search filters.
• Analytics Cookies: Help us anonymously monitor site traffic patterns and popular destinations to improve platform performance.

You can manage or disable cookie preferences at any time through your browser settings. Please note that disabling essential cookies may impact certain booking functions.

We retain personal data only for as long as necessary to fulfill the purposes for which it was gathered, satisfy legal accounting/auditing obligations, and resolve potential disputes.

• Encryption in Transit: All HTTP traffic is forced over HTTPS using modern SHA-256 TLS certificates.
• Database Hardening: Restricted administrative access with multi-factor authentication (2FA), encrypted password hashing (bcrypt), and scheduled automated offsite backups.
• Booking Archives: Financial and reservation invoices are retained for the statutory period required by Sri Lankan tax authorities.

Subject to local data protection laws, you possess significant control and legal rights over your personal data:

To exercise any of these rights, please submit a request via our Contact Form or email our compliance officer. We process verified requests within 30 days without fee.

Gimanhal services are directed to individuals of legal age (18 years or older) capable of entering legally binding travel contracts. We do not knowingly collect personal data from minors without parental or legal guardian consent. If we become aware that personal information of a child was submitted without appropriate consent, we will promptly purge the data from our records.

If you have questions, comments, or complaints regarding this Privacy Policy or our data management procedures, please contact our Data Protection Team:

• Privacy Inquiries Email: contact@gimanhal.lk
• Support Hotline: 0716009751
• Registered Office:
• Direct Contact Form: gimanhal.lk/contact