Privacy & Data Retention Policy

01Heritage & Privacy Commitment

The Tea Bungalow (Circa 1890), situated on Galaha Estate, Sri Lanka, values the trust placed in us by our guests, visitors, and partners. Operating as part of the Old Ceylon Heritage Collection, we treat all personal information with the utmost discretion, confidentiality, and security.

This policy outlines how we collect, handle, store, and protect your information when you interact with our website, request reservations, or communicate with our estate team.

02Statutory Compliance (Sri Lanka PDPA)

This policy is formulated in strict compliance with the Personal Data Protection Act, No. 09 of 2022 of Sri Lanka (PDPA) and aligns with international data protection standards (including the EU General Data Protection Regulation / GDPR where applicable to international travelers).

Under the PDPA, you are recognized as a "Data Subject", and The Tea Bungalow operates as the "Data Controller" for all information processed in connection with your stay or enquiry.

03Information We Collect

We collect only the personal information strictly necessary to fulfill your enquiries and provide tailored hospitality services:

• Enquiry & Reservation Details: Full name, email address, telephone/WhatsApp contact number, intended dates of stay, number of guests, and chamber preferences.
• How Website Enquiries Reach Us: Messages sent through our enquiry and waitlist forms are delivered to the estate's inbox by Brevo, an email delivery provider based in France, acting on our behalf as a data processor solely to deliver your message.
• Concierge Communications: Dietary requirements, Pekoe Trail hiking support requests, airport transfer logistics, and bespoke dining preferences communicated via WhatsApp or email.
• Technical & Analytics Data: Minimal anonymized technical information (such as browser type, approximate country-level location, and page interaction events) gathered via Google Analytics only where explicit consent has been granted.

04Payment Security & Card Data

Your card data never touches our web servers. In adherence to Payment Card Industry Data Security Standards (PCI-DSS):

• All electronic payments and deposit transactions are conducted exclusively via hosted payment fields or secure redirects provided by licensed Sri Lankan payment gateways (such as PayHere) and approved acquiring banks.
• The Tea Bungalow does not store, process, or transmit full Primary Account Numbers (PAN), PINs, or CVV security codes.

05Data Retention Schedules

We retain guest data only for as long as is necessary to satisfy operational, concierge, and statutory legal requirements:

• General Enquiries: Retained for up to 12 months following initial contact to assist with re-booking requests, after which they are securely purged.
• Completed Guest Stays & Invoices: Retained for a minimum of 5 years to comply with Sri Lankan Inland Revenue Act requirements and hospitality accounting standards.
• Chairman's Bungalow Waitlist: Retained until the 2027 opening invitations are dispatched, or until the guest requests removal.
• Analytics Data: Retained for 14 months within Google Analytics before automated deletion.

06Cookies & Tracking Consent

Our website utilizes essential cookies to ensure rapid, secure page delivery and remember your privacy choices. Optional analytics cookies (Google Tag Manager / GA4) are deployed solely to understand guest traffic patterns.

Under our Consent-First Architecture, optional analytics cookies remain disabled until you click "Accept All" on our privacy banner. You may adjust your preferences at any time by clearing your browser's local storage.

07Guest Rights & Data Subject Requests

Under Part II of the Sri Lanka Personal Data Protection Act, you possess the following rights regarding your personal information:

• Right of Access: You may request a copy of the personal data held about you.
• Right to Rectification: You may request correction of any inaccurate or incomplete details.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data where retention is no longer mandated by statutory tax or lodging regulations.
• Right to Withdraw Consent: You may withdraw consent for marketing or concierge communications at any time.

08Contact the Estate Data Officer

For inquiries regarding this policy, to exercise your data subject rights, or to update your preferences, please contact our estate management team: