Last updated: 8 June 2026
This Privacy Policy explains how Girin Route Ateliers (“Girin”, “we”, “us”) collects, uses, and protects personal data when you use this website and the services offered through it. We have written it to be read, not endured.
We are a travel-planning atelier registered in Sri Lanka, serving travellers planning routes in Sri Lanka and Halkidiki, Greece. Because of who we serve, this policy is written to meet the Sri Lanka Personal Data Protection Act No. 9 of 2022 (PDPA), the EU General Data Protection Regulation (GDPR), and the UK GDPR.
1. Who is responsible for your data
The data controller is Girin Route Ateliers, 97/A, Kadawatha Road, Kalubowila, Sri Lanka (registered in Sri Lanka). Our Legal Officer and Data Protection Contact is Sankha Karunaratne — skarunaratne@girin-routes.com, +94 77 772 0056. Write to us with any question about this policy or your personal data and we will respond.
2. What we collect, and when
We only collect what we need to help you plan and arrange a route, plus — with your consent — optional analytics that help us improve it. We do not sell your data.
- Saving a route draft (Route Studio / The Drafting Room) — your email address and name, so we can email you a link to your draft.
- Sending a route enquiry — your name, email, approximate travel dates (optional), and any notes you choose to share. We do not ask for health or dietary details; if you choose to include sensitive information in a free-text note, we treat it as sensitive personal data and use it only to plan your trip.
- Posting or joining a trip on The Forum — display name, email, travel dates, group size (optional), and any note for travellers.
- Technical data — your browser sends standard data (IP address, browser type) when loading pages and embedded media.
- Optional analytics (consent only) — if you accept optional cookies, we use Google Analytics 4, Google Ads conversion measurement, and Microsoft Clarity to understand, in aggregate, how the site is used. Clarity is configured to mask all text and form inputs, so it does not record what you type. These do not load unless you opt in, and you can change your choice at any time. See our Cookie & Storage Policy.
We do not collect payment-card details through the website.
3. Why we use it, and our lawful basis
- Email you a saved draft — consent / steps to enter a contract.
- Respond to a route enquiry — steps to enter a contract.
- List or manage a Forum trip — consent.
- Use any sensitive details you choose to share in a note — your explicit consent (sensitive data).
- Keep records of enquiries — our legitimate interests in business administration.
- Optional analytics and advertising measurement — your consent (you can withdraw it at any time via the footer “Cookie preferences” link).
Where we rely on consent, you can withdraw it at any time; this does not affect processing already carried out.
4. Who we share it with
We share personal data only where necessary to run the service, with parties that process it on our instructions: hosting and infrastructure (Netlify, Railway), media delivery (Cloudinary, Bunny CDN, Vimeo), our email-delivery provider, and the local hosts, guides, and accommodation partners needed to arrange your specific trip. If you accept optional cookies, aggregate usage data is also processed by Google (Analytics 4 and Ads) and Microsoft (Clarity) on our behalf. We do not sell your data.
5. International transfers
We operate between Sri Lanka, the United Kingdom, and the EU. Where personal data moves to a country without an adequacy decision, we rely on appropriate safeguards — such as the European Commission’s Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum.
6. How long we keep it
Saved drafts and Forum trips are kept while the feature is active for you and deleted on request or after inactivity. Route enquiries are kept for as long as needed to plan your trip and a reasonable period afterwards for business records, then deleted.
7. Your rights
Under the GDPR, UK GDPR, and the Sri Lanka PDPA you have the right to access, rectify, and erase your data; to object to or restrict processing; to withdraw consent; and to data portability. To exercise any of these, email skarunaratne@girin-routes.com. We respond within 30 days (GDPR/UK GDPR) and within the timeframes set by the Sri Lanka PDPA, at no charge for a reasonable request.
If you are in the EU or UK and believe we have mishandled your data, you may complain to your local supervisory authority (in the UK, the Information Commissioner’s Office). In Sri Lanka, you may contact the Data Protection Authority of Sri Lanka.
8. How we protect your data
We use appropriate technical and organisational measures — including encrypted connections (HTTPS) and access controls on our content management system — to protect personal data against loss, misuse, and unauthorised access.
9. Children
Our services are intended for adults planning travel. We do not knowingly collect personal data from children; if you believe a child has provided us data, contact us and we will delete it.
10. Changes to this policy
We may update this policy as our service evolves or the law changes. The “Last updated” date above shows the current version.
11. Contact
Girin Route Ateliers — Legal Officer, Sankha Karunaratne. 97/A, Kadawatha Road, Kalubowila, Sri Lanka. skarunaratne@girin-routes.com · +94 77 772 0056.