Cookie Policy

1. Summary of our privacy-first approach

• **Default Deny:** Non-essential cookies, scripts, and measurement pixels are blocked by default before your consent.
• **Google Consent Mode v2:** Signals for analytics storage, ad storage, ad user data, and ad personalization start in the denied state.
• **Equal Choice:** Declining optional cookies is a single click and is just as easy as accepting all.
• **Granular Control:** You can choose to allow performance analytics without enabling marketing trackers.
• **Withdraw Anytime:** You can change your preferences or withdraw consent at any time using the persistent "Cookie Settings" link in our footer.
• **Full Site Usability:** Declining optional cookies does not limit your ability to browse Sri Lanka itineraries, submit booking inquiries, message our concierge on WhatsApp, or finalize travel arrangements.
• **No Selling of Personal Data:** We never sell, rent, or trade your personal information or browsing records.

2. What cookies and similar technologies are

A cookie is a small text file placed on your device by a website server. Similar technologies include: - **Local Storage:** Browser storage that persists until cleared and allows settings such as your privacy choices and selected currency to be remembered without sending data in every HTTP header. - **Session Storage:** Temporary browser storage cleared when your browser tab or window closes. - **Tracking Pixels & SDKs:** Small code snippets (such as Meta Pixel) that measure whether an advertisement led to an inquiry or website visit. - **Privacy-Enhanced Embeds:** Facade players (such as YouTube-nocookie) that load third-party scripts only when you choose to play an itinerary video.

Technologies may be **first-party** (set directly by Zelenso Travel) or **third-party** (set by an external service whose functionality is integrated into the page).

3. Complete and verified technology inventory

4. How consent is managed on our domains

When you visit `zelenso.com`, `zelenso.de`, or `zelenso.co.uk`, our consent system evaluates whether a valid consent record exists for your browser on that domain:

1. **Initial Visit (Pending Choice):** - All optional tracking scripts are blocked. - Google Consent Mode v2 parameters start in the denied state (`analytics_storage='denied'`, `ad_storage='denied'`, `ad_user_data='denied'`, `ad_personalization='denied'`). - A clear, non-intrusive banner appears offering three equal options: "Accept all", "Reject optional", and "Customise preferences".

2. **Accept All:** - Enables Strictly Necessary, Performance & Analytics, and Marketing & Attribution categories. - Updates Google Consent Mode signals to granted and initializes permitted measurement tools.

3. **Reject Optional:** - Keeps optional tracking disabled. - Only strictly necessary functional cookies and local storage remain active. - Any previously existing optional measurement cookies are purged from your browser.

4. **Customise Preferences:** - Opens our accessible preference panel allowing you to toggle Analytics and Marketing independently. - Your choice is saved only when you click "Save Preferences". Closing the panel without saving does not constitute consent.

5. How to change or withdraw your consent

You can change your consent preferences or withdraw consent entirely at any time: - **Persistent Footer Trigger:** Click the "Cookie Settings" link located in the footer of every page on our website. - **Direct Control:** Click the "Customize Cookie Settings" button on this page. - **Browser Controls:** You can delete or block cookies directly through your browser settings (Chrome, Safari, Firefox, Edge). Clearing your browser cookies will cause the preference banner to reappear on your next visit.

When you withdraw consent or deselect an optional category: - Future tracking calls are immediately halted. - The corresponding Google Consent Mode v2 signals are switched back to denied. - Applicable client-accessible tracking cookies (including `_ga`, `_clck`, `_fbp`) are cleared from your browser storage.

6. Protection of sensitive customer information

We take rigorous technical precautions to protect your personal data during your visit: - **Session Recording Masking:** Microsoft Clarity is configured with strict field-level masking (`data-clarity-mask="true"`) on all inquiry and contact forms. Your name, email, telephone number, and bespoke travel notes are never recorded in session playback or heatmaps. - **Content Security Policy (CSP):** A strict CSP header ensures that only authorized, verified domains can execute scripts or establish network connections. - **Transport Security:** All traffic is encrypted using modern TLS 1.3 over HTTPS with HTTP Strict Transport Security (HSTS) and preloading. - **No Third-Party CMP Tracking:** Our consent management system is fully self-hosted, adding zero third-party advertising cookies or render-blocking script dependencies.

7. Legal and regulatory frameworks

This Cookie Policy and our consent architecture have been developed to comply with applicable data protection and telecommunications privacy laws, including: - **European Union:** General Data Protection Regulation (EU GDPR) and the ePrivacy Directive (2002/58/EC as amended), including guidance from the European Data Protection Board (EDPB) and French CNIL. - **United Kingdom:** UK GDPR, the Privacy and Electronic Communications Regulations (PECR), and applicable provisions of the UK Data (Use and Access) Act 2025. - **Germany:** Telecommunications Telemedia Data Protection Act (TTDSG / TDDDG § 25). - **Switzerland:** Revised Federal Act on Data Protection (FADP). - **Sri Lanka:** Personal Data Protection Act No. 9 of 2022 (PDPA).

8. Inquiries and data protection contact

For questions regarding this Cookie Policy or our data protection practices, please contact:

**Zelenso (Pvt) Ltd** Trading as Zelenso Travel (Registration: PV 00359958) 4/1, Wewagedara, Kurunegala 60000, North Western Province, Sri Lanka - Email: contact@zelenso.com - Concierge Hotline: +94 70 552 2299