This policy explains how Cozy Homestay Kandy ("we", "us") handles personal information when you use this website or contact us. We aim to collect only what we need to answer you and look after your stay, in line with Sri Lanka's Personal Data Protection Act, No. 9 of 2022, and, for visitors from the UK and EU, the principles of the UK GDPR and EU GDPR.
Who we are
Cozy Homestay Kandy, 34/1 Reservoir Road, Kandy 20000, Sri Lanka. Phone and WhatsApp: +94 77 657 0762. You can also reach us through our contact form.
What we collect
- Booking requests: your name, email, phone number, country, dates, number of guests and children's ages, room and transfer preferences, arrival time and anything you choose to tell us in your message.
- Contact messages: your name, email, phone number (optional) and your message.
- Job applications: your name, contact details, area of work, availability, languages, a link to your CV if you give one, and what you tell us about yourself.
- Technical data: our hosting provider keeps short-lived server logs (such as IP address and browser type) to keep the site secure and working. We do not use analytics or advertising trackers.
How we use it and why
- To reply to your request, confirm availability and rates, and arrange your stay, transfers or tours (to take steps at your request before a contract, and to perform it).
- To send you an automatic confirmation that we received your request.
- To consider job applications (with your consent).
- To protect the website against spam and abuse (our legitimate interest).
We never sell your information or use it for marketing without asking you first.
Who we share it with
- Cloudflare, which hosts this website and runs the small server functions that handle our forms.
- Our email delivery provider, which sends the form contents to us and the confirmation to you.
- Drivers or tour partners, only the details needed to arrange a transfer or tour you have asked for.
- WhatsApp (Meta), if you choose to contact us by WhatsApp; their own privacy policy then applies.
- Google, when the embedded map loads on our pages; see our cookie notice.
Some of these providers process data outside Sri Lanka. They are well-established companies that protect data with contractual and technical safeguards.
How long we keep it
We keep booking requests and messages for as long as we need them to deal with your enquiry and stay, and then for up to two years for our records, unless the law requires longer. Job applications are kept for up to twelve months, then deleted.
Your rights
You can ask to see the personal information we hold about you, to correct it, to delete it, or to withdraw consent you have given. Contact us by phone, WhatsApp or the contact form and we will respond as soon as we can. If you are unhappy with how we have handled your information, you can complain to the Data Protection Authority of Sri Lanka, or to your local data protection authority.
Booking platforms
If you book through Booking.com or Agoda, those platforms handle your booking data under their own privacy policies, and share with us what we need for your stay.
Changes
We may update this policy from time to time. The date at the top shows when it last changed.