Your trust matters as much as your comfort. This policy explains what personal data we collect when you visit our website, contact us or stay with us, why we use it, and the choices and rights you have.
1. Who we are
Living Heritage Koslanda (“we”, “us”, “our”), Egodawatte Estate, Naulla, Koslanda, Sri Lanka, is the controller of the personal data described in this policy. For any privacy question or request, contact our Data Protection Officer at info@koslanda.com (subject line: “Data Protection”) or call +94 77 935 5785.
2. The data we collect
- Enquiries — name, email, phone/WhatsApp number and anything you choose to tell us.
- Reservations — names of guests, contact details, dates, room and rate, special requests (e.g. dietary preferences or celebrations) and payment details.
- Your stay — information required by Sri Lankan law for guest registration (such as passport or national ID details and nationality), and records of services you use.
- Website use — technical data such as browser type, device and pages visited; with your consent, analytics cookies (see our Cookie Policy).
We do not knowingly collect data from children except as part of a family booking made by a parent or guardian.
3. Card payments
Online bookings and payments are processed by our secure, PCI DSS–compliant booking and payment providers. Your full card details are never stored on this website or seen by our web servers.
4. Why we use your data, and our legal basis
- To take and manage your booking and stay — necessary to perform our contract with you.
- To meet legal duties — e.g. guest registration, tax and accounting records.
- To answer your enquiries and personalise your stay — our legitimate interest in providing great hospitality.
- To send offers and news — only with your consent, which you can withdraw at any time.
- To keep our website secure and improve it — legitimate interest, and consent for non-essential cookies.
5. Who we share data with
We never sell your personal data. We share it only with trusted service providers who act on our instructions and protect it — such as our booking engine, payment gateway, property-management system, email provider and website host — with authorities where the law requires it, and with professional advisers. Some providers may process data outside Sri Lanka; where they do, we use appropriate safeguards as required by the PDPA and GDPR (such as standard contractual clauses).
6. How long we keep it
We keep personal data only as long as needed for the purposes above: booking and stay records for the period required by Sri Lankan tax and registration law, enquiries for up to 24 months, and marketing data until you unsubscribe. Then it is securely deleted or anonymised.
7. How we protect it
We use encrypted (HTTPS) connections, access controls, strong authentication, regular updates and security monitoring, and we train our team in handling guest data with care. If a data breach ever affected you, we would notify you and the relevant authority as the law requires.
8. Your rights
Under the Sri Lanka Personal Data Protection Act No. 9 of 2022 and, where applicable, the EU/UK GDPR, you may ask us to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Erase your data where we no longer need it
- Restrict or object to certain processing
- Withdraw consent at any time
- Receive your data in a portable format
Email info@koslanda.com and we will respond within the time required by law. You also have the right to complain to the Data Protection Authority of Sri Lanka, or to your local supervisory authority if you live in the EU/UK.
9. Changes
We may update this policy from time to time. The latest version will always be on this page.
Last updated: 13 November 2026