Privacy Policy

Who we are and the scope of this policy

NamiOS is a hospitality operating platform developed and operated by DesignNetrix in Colombo, Sri Lanka. This policy applies when you visit the NamiOS public website, contact us, request a demonstration or trial, subscribe to NamiOS, or use an account supplied by a subscribing property.

For guest, employee, and property records entered by a subscribing hotel or business, that customer normally decides why and how the information is used. In that context, the customer is responsible for its instructions and DesignNetrix provides NamiOS as its service provider, subject to the applicable subscription agreement and data-processing terms.

Personal data we may collect

• Contact and enquiry data: name, business email, telephone number, property name, role, and enquiry content.
• Account and subscription data: login identity, role, property configuration, plan, invoices, support requests, and account activity.
• Hospitality records supplied by customers: guest identity and contact information, reservation details, identification references, preferences, payment status, folios, staff records, attendance, and payroll data where the relevant application is used.
• Technical data: device, browser, IP address, security events, timestamps, diagnostic logs, and essential cookie information.
• Payment information: transaction references and payment status. Card or bank credentials may be processed directly by an independent payment provider and are not necessarily stored by NamiOS.

Why we use personal data

We use personal data to respond to enquiries; prepare demos and trials; create and secure accounts; deliver, maintain, support, and improve NamiOS; process subscriptions and payments; prevent abuse; troubleshoot problems; communicate service information; and comply with lawful obligations.

We process personal data only where an appropriate legal basis or customer instruction applies. We do not sell personal data. We do not use hotel guest or employee records for unrelated advertising.

Cookies and communications

The public website uses essential technologies needed for security, navigation, and performance. If non-essential analytics or advertising cookies are introduced, we will provide appropriate notice and choices before using them where required.

You can opt out of marketing communications through the method provided in the message or by contacting us. Operational, billing, security, and account messages may still be sent when needed to deliver the service.

When information may be shared

We may share limited information with infrastructure, communications, support, payment, professional-advisory, and security providers that help us operate NamiOS; with a customer that administers your NamiOS account; when required by a valid legal process; or during a legitimate business reorganisation subject to suitable safeguards.

Where personal data is processed outside Sri Lanka, DesignNetrix will use the instruments, contractual arrangements, and safeguards required by applicable Sri Lankan law and regulatory directions.

Retention and security

We retain information only for as long as reasonably required for the purpose collected, the customer agreement, security, dispute resolution, accounting, or applicable law. Customer data is returned or deleted in line with the service agreement, subject to lawful retention and backup cycles.

We use administrative, technical, and organisational safeguards designed to protect confidentiality, integrity, and availability. No internet service can guarantee absolute security, so customers and users must also protect credentials and promptly report suspected misuse.

Your choices and rights

Depending on the applicable law and context, you may have rights to request access to personal data, correction of inaccurate information, erasure where permitted, withdrawal of consent, or review of certain processing decisions. When a property controls the relevant data, requests should usually be directed to that property first; we will assist it where required.

You may also contact Sri Lanka’s Data Protection Authority. Rights and procedures remain subject to the Personal Data Protection Act No. 9 of 2022, as amended, applicable commencement orders, and regulatory guidance.

Children, changes, and other websites

NamiOS is a business service and is not directed to children. Hospitality customers are responsible for ensuring they have an appropriate basis for any child or guardian information required for a booking or legal record.

Links to third-party services are governed by their own policies. We may update this policy as the product, service providers, or law changes. Material changes will be highlighted through the website, account, or direct notice where appropriate.