Effective Date: 18 March 2025 | Last Updated: 10 August 2025

​

1. Introduction

The Planters House, Monarakanda Estate, Sri Lanka ("we", "our", or "us") is committed to protecting your privacy in accordance with Sri Lanka's Personal Data Protection Act No. 9 of 2022 (PDPA) and international best practices. This Privacy Policy explains how we collect, use, share, and protect your personal information when you make a reservation, stay at our hotel, or interact with our services.

​

2. Information We Collect

​

2.1 Information Required by Law
As mandated by the Sri Lanka Tourism Development Authority (SLTDA), we must collect:

• Address

• Nationality

• Passport number or National Identity Card (NIC) number

• Date and time of arrival and departure

• Room name/number

• Next destination

• Guest signature

​

2.2 Additional Information for Services

Email address and contact number

 

• Payment information (credit card details processed securely via Stripe)

• Special requirements (dietary needs, accessibility requirements)

• Preferences for personalised service

• Communications and feedback

​

2.3 Information We Collect Automatically

Website Data: IP address, browser type, pages visited (through cookies)

 

• Property Security: CCTV footage in public areas for safety and security (system to be implemented)

​

2.4 Information from Booking Platforms

• Reservation details from Booking.com, Expedia, Airbnb, Tripadvisor, and other online travel agents we may partner with from time to time. A full list of current partners is available upon request.

​

3. Lawful Basis and Purpose of Data Collection

We process your personal data based on the following legal grounds under the PDPA:

​

3.1 Contract Performance

Processing reservations and providing accommodation services

 

• Managing your stay and fulfilling special requests

• Processing payments and security deposits

​

3.2 Legal Obligations

Maintaining guest registers as required by SLTDA

Tax and accounting record-keeping

 

• Responding to lawful requests from authorities

​

3.3 Legitimate Interests

• Ensuring property security and guest safety

• Preventing fraud and unauthorised transactions

• Improving our services and guest experience

• Managing complaints and disputes

​

3.4 Consent

Sending marketing communications about offers and events (through separate explicit opt-in)

 

• Processing special category data, such as health information, for dietary or accessibility requirements (explicit consent required)

• Sharing updates about The Planters House

• Personalising future stays based on preferences

​

4. Information Sharing

We may share your information with:

​

4.1 Service Providers
We share information with trusted third-party service providers who assist us in operating our business, including:

Payment processors (including Stripe for secure payment handling)

 

• Customer relationship management systems

• Email marketing platforms

• Cloud storage and IT services

• Accounting and financial software

• Professional advisers (lawyers, accountants, auditors)

All service providers are required to maintain appropriate data protection standards. A detailed list of current service providers is available upon request.

​

4.2 Other Third Parties

• Booking Platforms: For reservations made through third parties

• Government Authorities: SLTDA, law enforcement (when legally required)

• Emergency Services: When necessary for health and safety

We do not sell or rent your personal information to third parties.

​

5. Data Storage and International Processing

Your information may be stored and processed in:

 

• Sri Lanka: Local servers, office computers, and physical guest registers

• International Locations: Through our cloud service providers

We ensure all service providers maintain appropriate security measures and comply with data protection standards through legally binding agreements, including Standard Contractual Clauses where applicable.

​

6. Data Security Measures

We implement technical and organisational measures to protect your personal data:

• Encryption of payment data through Stripe

 

• Password-protected systems with access controls

• Secure cloud storage with encryption

• Physical security for paper records

• Regular security assessments

• Staff training on data protection and PDPA compliance

• Incident response procedures

​

7. Data Retention Period

We retain your information based on legal and business requirements:

Guest records, financial and security data: As required by legal and insurance obligations (up to 7 years)

 

• Marketing Lists: Until you withdraw consent or unsubscribe

• Guest Feedback: 3 years from submission

• Dispute Resolution: Data may be retained longer if involved in legal proceedings

Our retention periods are based on Sri Lankan legal requirements and legitimate business needs. We document our rationale for these periods as required by the PDPA's storage limitation principle.

​

8. Your Rights Under the PDPA

As a data subject, you have the following rights under Sri Lankan law:

• Right to Access: Request a copy of your personal data we hold

• Right to Rectification: Correct inaccurate or incomplete data

• Right to Erasure: Request deletion of your data (subject to legal retention requirements)

• Right to Withdraw Consent: Withdraw consent for consent-based processing

• Right to Object: Object to the processing of your data for certain purposes

• Right to Data Portability: Receive your data in a structured format

• Right to Lodge a Complaint: File a complaint with the relevant authorities

How to Exercise Your Rights
Please contact us at privacy@theplantershouse.com with your request. We will respond within 21 working days as required by law and may request identity verification for security purposes.

​

9. Cookies

Our website uses cookies to:

 

• Remember your preferences

• Analyse website usage

• Enable booking functionality

• Improve user experience

We will display a cookie consent notice on our website, allowing you to accept or manage cookie preferences. You can also control cookies through your browser settings, though this may affect website functionality.

​

10. Marketing Communications

Consent
We will only send marketing communications with your explicit consent, obtained through a clear opt-in mechanism separate from our Terms and Conditions. You will be presented with an unticked checkbox to actively choose to receive marketing messages.

What We Send

 

• Special offers and promotions

• Updates about The Planters House and Monarakanda Estate

• Event notifications

• Seasonal greetings and newsletters

Unsubscribing
You can withdraw your consent and unsubscribe at any time:

 

• Using the unsubscribe link in our emails

• Emailing privacy@theplantershouse.com

We plan to implement segmented communications to better tailor messages to your interests.

​

11. Data Breach Response

In the unlikely event of a data breach:

 

• We will assess the risk to affected individuals

• Take immediate steps to contain and secure our systems

• Notify the Data Protection Authority and affected individuals without undue delay and in accordance with PDPA requirements

• Document the incident and remedial actions taken

• Review and strengthen our security measures

​

12. Children's Privacy

We welcome families with children. Parents/guardians are responsible for:

 

• Providing information about their children during bookings

• Consenting to data processing on behalf of minors

• Ensuring appropriate supervision during their stay

​

13. Third-Party Links

Our website may contain links to other sites. We are not responsible for their privacy practices and encourage you to review their policies.

​

14. International Guests

We welcome guests from around the world. By providing your information, you consent to its processing in Sri Lanka in accordance with this policy and the PDPA.

​

15. Changes to This Policy

We reserve the right to update this policy to reflect changes in law or our practices. Significant changes will be notified via:

• Email to our mailing list

 

• Notice on our website

• Information at check-in for upcoming guests

Check the "Last Updated" date for the latest version.

​

16. Contact Us

For questions about this Privacy Policy, to exercise your rights, or for data protection concerns:

 

Data Controller
The Planters House
Nandimale, Monarakanda Estate
Koslanda, 90190
Sri Lanka

Email: privacy@theplantershouse.com
Website: www.theplantershouse.com

​

Response Time: We aim to respond to all data protection queries within 21 working days as required by law.

​

This Privacy Policy complies with the Personal Data Protection Act No. 9 of 2022 of Sri Lanka, effective from 18 March 2025.

By making a reservation or using our services, you acknowledge that you have read and understood this Privacy Policy.