Who we are
Hirikatiya Ocean House (“we”, “us”) is a family-run guest house in Hiriketiya, Dikwella, Sri Lanka. This policy explains what personal information we collect when you use hirikatiyaoceanhouse.com, book a stay or contact us, and how we look after it. We handle personal data in line with Sri Lanka’s Personal Data Protection Act No. 9 of 2022 and, for visitors from the European Union and United Kingdom, the principles of the GDPR.
What we collect
Information you give us when you book or contact us:
- Your name, email address, phone / WhatsApp number and country
- Your stay details: dates, room, number of guests and estimated arrival time
- Anything you choose to tell us in special requests or messages (for example dietary needs or airport pickup details)
- At check-in, we may ask to see a passport or ID and record its details where required by Sri Lankan regulations for guest accommodation
Information collected automatically when you browse our website:
- Pages you visit, how long you stay, the website or search that brought you here, and actions such as searching for dates or starting a booking
- Approximate location (country / city), device type, browser and language
We do not collect or store your card number, expiry date or security code; see “Payments” below.
How we use it
- To manage your booking: confirming, changing or cancelling it, preparing for your arrival and contacting you about your stay (necessary to perform our contract with you).
- To take payments and issue refunds (contract and legal obligation).
- To answer your questions by email, phone or WhatsApp (legitimate interest / your request).
- To keep records required for tax, accounting and guest registration (legal obligation).
- To understand and improve our website using anonymous statistics (legitimate interest / consent where required).
We do not sell your personal data, and we do not send marketing emails unless you ask us to.
Payments
Online payments are processed by OnePay (onepay.lk), a licensed payment gateway in Sri Lanka. When you pay, you enter your card details directly on OnePay’s secure payment page; they never pass through or get stored on our website. OnePay tells us whether the payment succeeded, the amount and a transaction reference. OnePay handles your card data under its own privacy policy and card-industry security standards (PCI DSS).
Cookies & analytics
We use Google Analytics to understand how visitors use our website, for example which pages are popular and which countries our guests come from. Google Analytics sets cookies in your browser and collects the browsing information described above. The reports we see are aggregated and do not identify you by name. You can block these cookies in your browser settings or install Google’sopt-out browser add-on, and the website will still work normally.
Our pages also load an embedded Google Map and fonts from Google Fonts, which may receive your IP address. We do not use advertising or social-media tracking cookies.
Who we share it with
We only share personal information with trusted service providers who help us run our business:
| Provider | What for |
|---|---|
| Supabase | Secure database that stores bookings |
| Netlify | Hosts our website |
| OnePay | Processes card payments and refunds |
| Google (Analytics, Maps, Fonts) | Website statistics, map and fonts |
| WhatsApp (Meta) | If you choose to message us on WhatsApp |
We may also share information with Sri Lankan authorities where the law requires it (for example guest registration or tax records), or with transport and tour providers you ask us to book for you (only the details they need, such as your name, pickup time and phone number).
Where it’s stored & for how long
Some of our providers store data on servers outside Sri Lanka (for example in Asia, Europe or the United States). They are required to protect it with appropriate security measures, including encryption in transit. Access to booking information is limited to the owners of Hirikatiya Ocean House through a password-protected system.
We keep booking records for as long as needed for accounting, tax and legal purposes (normally up to 7 years), then delete or anonymise them. Messages and special requests that aren’t needed for those purposes are deleted sooner. Google Analytics data is kept for up to 14 months.
Your rights
You can ask us at any time to:
- see a copy of the personal data we hold about you
- correct information that is wrong or incomplete
- delete your data, where we are not legally required to keep it
- stop or limit how we use it, or object to a particular use
- withdraw any consent you have given
Contact us using the details below; we will reply within 30 days. If you are not happy with our response, you may complain to Sri Lanka’s Data Protection Authority or, if you live in the EU/UK, to your local data protection authority.
Children
Bookings must be made by an adult aged 18 or over. We do not knowingly collect personal information from children through this website, other than names and ages of children travelling with an adult who has made the booking.
Changes to this policy
We may update this policy from time to time, for example when we add a new service. The latest version is always on this page, with the date it was last updated at the top.
Questions about this policy? Contact us at hello@hirikatiyaoceanhouse.com, onWhatsApp +94 77 825 7989, or by post atHirikatiya Ocean House, Hiriketiya Road, Hiriketiya, Dikwella, Sri Lanka.