Ceylon Haven Privacy Policy

Your privacy matters to us. This Privacy Policy explains how Ceylon Haven Holidays (Private) Limited collects, uses, stores, and protects your personal information when you visit our website or make a booking. Please read this policy carefully. By using our website or services, you agree to the practices described here.

1. Who We Are

Ceylon Haven Holidays (Private) Limited (referred to as 'Ceylon Haven', 'we', 'us', or 'our') is a curated villa collection platform operating under the laws of Sri Lanka. We are the data controller responsible for the personal information collected through our website at ceylonhaven.com and through our booking and communication channels.

If you have any questions about this policy or how we handle your data, you can reach us at:

Ceylon Haven Holidays (Private) Limited

Email: [email protected]

Phone: +94 77 023 4851

Website: ceylonhaven.com

2. What Information We Collect

We collect personal information in order to provide our villa booking services, communicate with guests, and improve the experience we offer. The information we collect falls into the following categories.

2.1 Information You Provide to Us

When you make a booking, submit an enquiry, or contact our team, you may provide us with:

Full name and contact details, including email address, phone number, and WhatsApp number
Booking details such as travel dates, number of guests, villa preferences, and special requirements
Payment information, including billing details and transaction references (note: full payment card data is processed securely by our payment partners and is not stored by Ceylon Haven)
Communications sent to us via email, WhatsApp, contact forms, or the Find My Space enquiry form
Feedback, reviews, or testimonials submitted voluntarily

2.2 Information We Collect Automatically

When you visit ceylonhaven.com, we automatically collect certain technical and behavioural data, including:

IP address and approximate geographic location
Browser type, device type, and operating system
Pages visited, time spent on the site, and navigation patterns
Referring URLs and search terms used to find our website
Cookie identifiers and session data (see Section 7 for full details on cookies)

2.3 Information from Third Parties

We may also receive information about you from third-party platforms where you have interacted with Ceylon Haven, including:

Social media platforms such as Instagram and Facebook, where you may follow, tag, or message us
Google, where you may submit a review or interact with our business listing
Analytics and advertising platforms that provide aggregated audience insights

3. How We Use Your Information

Ceylon Haven uses your personal information only for legitimate and clearly defined purposes. We will never sell your data to third parties. Specifically, we use your information to:

3.1 Fulfil Your Booking

Process and confirm villa reservations
Communicate booking details, confirmations, and pre-arrival information
Coordinate additional services such as airport transfers, private chefs, and curated experiences
Manage payment processing through our banking and payment partners

3.2 Provide Customer Support

Respond to enquiries submitted via our website, email, or WhatsApp
Assist with modifications, cancellations, or disputes related to your booking
Follow up on your stay to ensure your experience met our standards

3.3 Marketing & Communications

Send you our newsletter, villa updates, travel inspiration, and promotional offers — with your consent
Deliver targeted advertising through Meta (Facebook and Instagram) and Google platforms, based on your browsing behaviour and interests
Personalise the content and recommendations you see on our website

You may opt out of marketing communications at any time. See Section 8 for your rights.

3.4 Improve Our Platform

Analyse website usage patterns to improve the design, content, and functionality of ceylonhaven.com
Conduct user research and gather behavioural insights through heatmapping and session recording tools
Monitor and maintain the security and performance of our platform

3.5 Legal & Compliance Obligations

Maintain booking and transaction records as required by Sri Lankan law and financial regulations
Respond to lawful requests from regulatory authorities or law enforcement where required
Enforce our Terms and Conditions and protect the rights of Ceylon Haven, our villa owners, and our guests

4. Legal Basis for Processing

Ceylon Haven processes your personal data on the following legal grounds:

Contractual necessity - to fulfil your booking and deliver the services you have requested
Legitimate interests - to improve our platform, prevent fraud, and maintain the security of our services
Consent - for marketing communications and the use of non-essential cookies. You may withdraw your consent at any time
Legal obligation - where we are required to process or retain data to comply with Sri Lankan law or financial regulations

5. How We Share Your Information

Ceylon Haven does not sell, rent, or trade your personal data. We share your information only in the limited circumstances described below.

5.1 Villa Owners & Property Managers

When you make a booking, we share the relevant guest details - including your name, contact information, number of guests, and travel dates - with the villa owner or property manager. This is necessary to facilitate your stay. Villa owners are required to handle your data with care and in accordance with applicable privacy laws.

5.2 Service Providers & Technology Partners

We work with trusted third-party service providers who assist us in operating our platform and delivering our services. These include:

Payment processing partners who handle transactions securely on our behalf
Email marketing and CRM platform (Brevo) for sending newsletters and booking communications
CRM system for managing guest relationships and booking records
Analytics providers including Google Analytics and Meta Pixel for website performance and advertising
Heatmapping and session recording tools for platform optimisation

All third-party partners are contractually required to process your data only for the purposes we specify and to maintain appropriate security standards.

5.3 Legal & Regulatory Disclosure

We may disclose your personal information to government authorities, law enforcement, or regulatory bodies where required to do so by law, or where we believe disclosure is necessary to protect the rights, property, or safety of Ceylon Haven, our guests, or the public.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of Ceylon Haven's business, your personal data may be transferred to the acquiring entity. We will notify you of any such change and ensure that your data continues to be protected in accordance with this Privacy Policy.

6. Data Retention

We retain your personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law.

Booking records and associated guest data are retained for a period of five years following the completion of a stay, in accordance with Sri Lankan financial and tax record-keeping requirements
Marketing data, including email subscription records, is retained until you unsubscribe or request deletion
Website analytics data is retained in accordance with the default retention settings of the relevant analytics platform, typically between 14 and 26 months
Enquiry and communication records are retained for up to two years from the date of last contact

Once data is no longer required, it is securely deleted or anonymised in a manner that prevents identification.

7. Cookies & Tracking Technologies

Ceylon Haven uses cookies and similar tracking technologies on our website to enhance your browsing experience, analyse site performance, and deliver relevant advertising.

7.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They allow the website to remember your preferences, recognise your device on return visits, and gather analytical data about how the site is used.

7.2 Types of Cookies We Use

Essential cookies - required for the website to function correctly, including session management and security. These cannot be disabled
Analytics cookies - used by Google Analytics to collect anonymised data about how visitors interact with our website, including pages visited, time on site, and navigation paths
Marketing cookies - used by Meta Pixel (Facebook and Instagram) to track visitors who have interacted with our ads, enable retargeting, and measure advertising effectiveness
Behavioural cookies - used by heatmapping and session recording tools to understand how users navigate and interact with our website, helping us improve the user experience
Preference cookies - used to remember your settings and personalise your experience on return visits

7.3 Managing Your Cookie Preferences

When you first visit ceylonhaven.com, you will be presented with a cookie consent banner allowing you to accept or decline non-essential cookies. You can update your preferences at any time via the cookie settings on our website.

You may also manage or delete cookies directly through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. For more information on managing cookies, visit www.allaboutcookies.org.

7.4 Third-Party Cookies

Some cookies on our website are placed by third-party services we use, including Google, Meta, and our analytics providers. These third parties have their own privacy policies governing how they use cookie data. We encourage you to review their policies for full details.

8. Your Rights

Ceylon Haven is committed to respecting your rights in relation to your personal data. You have the following rights, which you may exercise at any time by contacting us at [email protected].

8.1 Right to Access

You have the right to request a copy of the personal data we hold about you. We will respond to all access requests within 30 days. We may ask you to verify your identity before fulfilling the request.

8.2 Right to Correct Your Data

If any personal information we hold about you is inaccurate, incomplete, or out of date, you have the right to request that we correct it. We will update your records promptly upon receiving a valid correction request.

8.3 Right to Delete Your Data

You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent. Please note that we may be required to retain certain data for legal or regulatory reasons even following a deletion request. We will inform you if this applies.

8.4 Right to Opt Out of Marketing

You may withdraw your consent to receive marketing communications from Ceylon Haven at any time by:

Clicking the 'unsubscribe' link in any marketing email
Messaging us directly via WhatsApp or email at [email protected]
Contacting our team by phone

Opting out of marketing will not affect the delivery of transactional communications related to a confirmed booking.

8.5 Right to Withdraw Consent

Where we process your data based on your consent - such as for marketing communications or non-essential cookies - you have the right to withdraw that consent at any time without affecting the lawfulness of processing that took place prior to withdrawal.

9. Data Security

Ceylon Haven takes the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your information against unauthorised access, loss, alteration, or disclosure.

These measures include secure data transmission via HTTPS encryption, restricted access to personal data on a need-to-know basis, regular review of our data handling practices, and contractual security obligations placed on all third-party service providers.

While we take every reasonable precaution, no method of transmission over the internet is entirely secure. In the unlikely event of a data breach that poses a risk to your rights or privacy, we will notify you and the relevant authorities in accordance with applicable law.

10. International Data Transfers

Ceylon Haven is based in Sri Lanka. Some of the third-party tools and service providers we use - including Google Analytics, Meta Pixel, and Brevo - may store and process data in countries outside Sri Lanka, including within the European Union and the United States.

Where data is transferred internationally, we ensure that appropriate safeguards are in place, including the use of providers who operate under recognised data protection frameworks or who maintain contractual commitments to data security standards equivalent to those applied in Sri Lanka.

11. Children's Privacy

The Ceylon Haven website and services are not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe that a child has provided us with personal information without appropriate parental consent, please contact us at [email protected] and we will take prompt steps to delete that data.

12. Third-Party Links

Our website may contain links to third-party websites, partner pages, or social media platforms. This Privacy Policy applies solely to ceylonhaven.com and does not extend to any external websites. We encourage you to review the privacy policies of any third-party sites you visit, as we have no control over their content or data practices.

13. Updates to This Privacy Policy

Ceylon Haven reserves the right to update this Privacy Policy at any time to reflect changes in our practices, technology, or legal obligations. Any updates will be published on our website with a revised effective date.

Where changes are material, we will take reasonable steps to notify you - for example, by sending an email to guests on our mailing list or displaying a prominent notice on our website. Your continued use of ceylonhaven.com following any update constitutes your acceptance of the revised policy.

We encourage you to review this page periodically to stay informed about how we protect your information.

14. Contact Us & Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please get in touch with our team: