Privacy Policy

Last updated 9 September 2026

Galis Lingerie Limited ("Gali's Lingerie", "we", "us", or "our") operates www.galis.lk (the "Website"). This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when you visit the Website, create an account, place an order, subscribe to marketing communications, or contact us. We process personal data in accordance with applicable laws of Sri Lanka.

1 Scope

This Privacy Policy applies to personal data collected through the Website and through related customer-service communications. It does not apply to third-party websites or services that have their own privacy policies.

2 Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

  • Identity and contact information, including your name, email address, telephone number, billing address, delivery address, and delivery instructions.
  • Account information, including login details, account settings, saved addresses, and communication preferences.
  • Order and transaction information, including the products, sizes, and colours selected, order history, payment method, transaction amount, payment status, returns, exchanges, refunds, and related reference numbers.
  • Payment information needed to complete a transaction. Payment card and other payment details may be collected and processed directly by the relevant payment service provider.
  • Customer-service information, including messages, inquiries, sizing questions, complaints, reviews, feedback, and any other information you choose to share with us.
  • Technical and usage information, including your IP address, device and browser type, operating system, time zone, pages viewed, links clicked, referring website, session information, and website diagnostics.
  • Marketing information, including whether you have subscribed to promotions, your communication preferences, and your interaction with our emails or advertisements.

We collect personal data directly from you, automatically through cookies and similar technologies, and from service providers involved in payment, delivery, fraud prevention, analytics, advertising, or customer communications.

You may choose not to provide certain information. However, if you do not provide information required to process payment, confirm an order, or arrange delivery, we may be unable to accept or complete your order. Providing information for marketing is optional.

3 How We Use Personal Data

We may use personal data to:

  • create and manage your customer account;
  • confirm, process, fulfil, deliver, and track orders;
  • process payments and manage returns, exchanges, refunds, and customer requests;
  • provide customer support, product information, and sizing assistance;
  • send service messages, including order confirmations, payment updates, delivery notifications, and important account notices;
  • operate, maintain, analyse, and improve the Website, products, services, and customer experience;
  • detect and prevent fraud, misuse, security incidents, and other unlawful activity;
  • send marketing communications where you have consented or where otherwise permitted by applicable law;
  • maintain accounting, tax, legal, and business records; and
  • comply with legal obligations, enforce our terms, and protect our rights and the rights of customers and others.

4 Legal Grounds for Processing

Depending on the purpose, we process personal data on one or more of the following grounds:

  • Contractual necessity, where the processing is required to take steps at your request or to fulfil an order or another agreement with you.
  • Legal obligation, where we must process information to comply with applicable accounting, tax, regulatory, court, or other legal requirements.
  • Consent, including for marketing communications and non-essential cookies where consent is required. You may withdraw consent at any time, without affecting processing that took place before the withdrawal.
  • Legitimate interests permitted by law, including operating and improving our business, supporting customers, securing the Website, preventing fraud, and protecting our legal rights, provided those interests are not overridden by your rights.

5 Marketing Communications

If you subscribe to marketing, we may send offers, new-arrival updates, and other promotional messages by email, SMS, or another channel you select. You may unsubscribe at any time by using the unsubscribe option in the message or by contacting info@galis.lk. Opting out of marketing will not stop essential messages relating to an active order, payment, delivery, return, or account.

6 Cookies and Similar Technologies

The Website uses cookies and similar technologies to operate correctly, remember your choices, understand how visitors use the Website, and support relevant advertising. The cookies used may include:

  • Strictly necessary cookies for functions such as shopping-cart management, account login, security, and checkout.
  • Functional cookies that remember preferences and improve convenience.
  • Analytics cookies that help us understand website traffic and performance.
  • Advertising cookies that help measure campaigns and show more relevant advertisements.

Where required, we will ask for your permission before using non-essential cookies. You can manage cookies through any cookie controls available on the Website or through your browser settings. Blocking some cookies may affect the shopping cart, login, checkout, or other Website features. Third parties that place cookies may process information according to their own privacy policies.

7 How We Share Personal Data

We do not sell or rent your personal data. We may share only the information reasonably necessary with the following recipients:

  • e-commerce platforms, website hosting, cloud storage, information technology, and security providers;
  • payment gateways, banks, and payment service providers;
  • courier, logistics, and delivery providers;
  • email, SMS, customer-support, and communications providers;
  • analytics and advertising providers, subject to applicable consent requirements;
  • professional advisers, including accountants, auditors, lawyers, insurers, and consultants;
  • government authorities, regulators, courts, or law-enforcement bodies where disclosure is required or permitted by law; and
  • a buyer, successor, or relevant adviser in connection with a proposed or completed sale, restructuring, or transfer of all or part of our business, subject to appropriate confidentiality requirements.

Our employees and authorised contractors may access personal data only where reasonably necessary for their work. We require service providers to handle personal data for agreed purposes and to apply appropriate safeguards.

8 International Data Transfers

Some service providers may process or store personal data on servers outside Sri Lanka. When personal data is transferred outside Sri Lanka, we take reasonable steps to ensure that the transfer is handled with appropriate safeguards and in accordance with applicable law.

9 Data Security

We use reasonable administrative, technical, and organisational measures designed to protect personal data against unauthorised access, use, alteration, disclosure, loss, or destruction. Access is limited to people and service providers who need the information for an authorised purpose. No website, network, or storage system can be guaranteed to be completely secure. You are responsible for keeping your account password confidential and for notifying us if you suspect unauthorised access to your account.

10 How Long We Retain Personal Data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected. In deciding how long to retain information, we consider the duration of your account or customer relationship, order and customer-service requirements, fraud and security needs, applicable limitation periods, and accounting, tax, regulatory, and other legal obligations. When personal data is no longer required, we will delete, anonymise, or securely dispose of it, subject to lawful retention requirements and routine backup cycles.

11 Your Rights and Choices

Subject to applicable law, you may have the right to:

  • ask whether we process your personal data and request access to it;
  • request correction or completion of inaccurate or incomplete personal data;
  • request erasure of personal data in circumstances recognised by law;
  • withdraw consent where processing is based on consent;
  • object to, or ask us to stop, certain processing where the law gives you that right;
  • request review of a qualifying decision based solely on automated processing, if applicable; and
  • make a complaint to the Data Protection Authority of Sri Lanka.

To exercise a right or update your information, email info@galis.lk. Please describe your request clearly. We may ask for information needed to verify your identity and protect your privacy before acting on the request. A request may be limited or refused where permitted by law, including when information must be retained to complete a pending order, comply with a legal obligation, establish or defend a legal claim, or protect the rights of another person.

12 Children's Personal Data

If you are under 16, please use the Website with the involvement of a parent or legal guardian. Where applicable law requires consent for processing a child's personal data, we will seek consent from a parent or legal guardian. If you believe a child has provided personal data without appropriate involvement or consent, please contact us.

13 Third Party Links

The Website may contain links to websites, payment pages, social-media platforms, or services operated by third parties. We are not responsible for the privacy practices of those third parties. Please review their privacy policies before providing personal data.

14 Updates to This Policy

We may update this Privacy Policy to reflect changes in our services, technology, business practices, or legal requirements. The revised policy will be published on this page with an updated revision date. Where appropriate, we may provide an additional notice of material changes.

15 Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or our handling of personal data, please contact us:

Galis Lingerie Limited

773, Pannipitiya Road

Pelawatta, Battaramulla, Sri Lanka

Email: info@galis.lk

Phone: +94 11 444 7 444

Website: www.galis.lk