Last updated: 13 October 2026
This Privacy Policy explains how Salt House Srilanka (“Salt House”, “we”, “us”) collects, uses, shares and protects your personal information when you visit salthousesrilanka.net, contact us, book a stay, a table, a yoga class or a retreat, or otherwise deal with us. Please read it together with the terms of any booking platform you use.
1. Who we are
Salt House is a boutique guesthouse, restaurant, and yoga and surf retreat venue in Hiriketiya Bay. We are the data controller for the personal information described in this policy.
2. Information we collect
Information you give us
- Contact form and messages. Your name, email address, phone or WhatsApp number, subject and message when you use the form on our Contact page, or when you email, call, message us on WhatsApp or contact us through social media.
- Bookings. Your name, contact details, travel dates, number of guests, room or retreat choice, arrival details and any requests (for example dietary needs or accessibility needs). Bookings are made through our booking engine provided by Cloudbeds, or through third-party platforms such as Booking.com. Payment card details are handled by the booking or payment provider and are not stored on this website.
- During your stay. Where required by law or for guest registration, we may ask for identification details such as your passport number and nationality. If you take part in yoga, surf or other activities, you may choose to tell us about injuries or health conditions so that we can look after you safely. We only use this to keep you safe and to run the activity.
- Blog comments. If you leave a comment on a blog post, we collect your name, email address, website (if given), your comment and your IP address.
Information collected automatically
- Technical information. Your IP address, browser type and version, device type, operating system, language, the pages you view, the page that referred you, and the date and time of your visit. This is recorded in our server logs and by our analytics tools.
- Cookies and similar technologies. See section 4.
Information from others
If you book through Booking.com, Tripadvisor or another platform, we receive your booking details from that platform. Reviews that you post publicly on Google or Tripadvisor may be displayed on our website.
3. How we use your information and why
- To reply to your enquiry and manage your booking – so that we can take steps at your request before a contract and carry out the contract once you book.
- To provide our services – accommodation, food and drink, yoga classes, retreats, surf lessons and activities, including your safety and wellbeing while you stay.
- To meet legal obligations – for example guest registration, tax and accounting records, and responding to lawful requests from authorities.
- To run, secure and improve our website – understanding how the site is used, fixing problems, blocking spam and preventing misuse. This is in our legitimate interest in running a safe and effective business.
- To measure advertising and marketing – understanding which campaigns lead to enquiries and bookings.
- To contact you with offers or news – only if you have asked for this or otherwise agreed. Every such message will include a simple way to opt out.
Where we rely on your consent, you can withdraw it at any time by contacting us. Withdrawing consent does not affect processing carried out before you withdrew it.
We do not sell your personal information, and we do not use it to make automated decisions that have a legal or similarly significant effect on you.
4. Cookies and similar technologies
Cookies are small files stored on your device. Our website uses the following kinds:
- Necessary. These keep the site working and secure, and remember settings such as the language you pick.
- Analytics and advertising measurement. We use the Google tag (including Google Analytics and Google Ads conversion measurement) to understand how visitors use the site and how our advertising performs. Google may set cookies and receive your IP address and information about your visit. You can opt out of Google Analytics with the Google Analytics opt-out browser add-on.
- Embedded and third-party content. Some content is loaded from other companies, which may receive your IP address and set their own cookies: our booking engine (Cloudbeds), review and social feed widgets (Trustindex and Elfsight), Google Maps and Google reviews, and the website translation tool (GTranslate, which uses Google Translate).
You can block or delete cookies in your browser settings. If you block them, some parts of the site, such as booking or language translation, may not work properly. For more about how Google uses information from sites that use its services, see Google’s Privacy Policy.
5. Who we share your information with
We share personal information only where needed and only with:
- Service providers that help us run Salt House, including website hosting and email providers, our booking and property management system (Cloudbeds), Google (email, analytics, advertising measurement, maps and translation), and the providers of our review and social widgets (Trustindex and Elfsight).
- Booking and review platforms such as Booking.com and Tripadvisor, if you book or review through them.
- Payment providers that process your payment for a booking.
- Authorities and advisers where the law requires it, or where we need advice from accountants or lawyers.
- A buyer or successor, if the business is ever sold or reorganised, who will be bound to protect your information in line with this policy.
These providers may only use your information to provide their services to us or as their own policies describe.
6. Transfers outside your country
Some of our providers store or process information outside Sri Lanka, for example on servers in the United States or Europe. Where we transfer personal information abroad, we take reasonable steps to make sure it stays protected, such as choosing reputable providers and using appropriate contractual safeguards.
7. How long we keep your information
- Contact form messages and enquiries: as long as needed to answer you and for a reasonable period afterwards, generally no longer than 24 months.
- Booking, guest registration and accounting records: for as long as the law requires.
- Blog comments: until you ask us to remove them or the post is removed.
- Analytics data: for the period set in our analytics account.
When we no longer need information, we delete it or make it anonymous.
8. Your rights
Under Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, as it comes into force, and under the GDPR or UK GDPR where those laws apply to you (for example if you are in the European Economic Area or the United Kingdom), you may have the right to:
- ask for access to the personal information we hold about you and receive a copy;
- ask us to correct information that is inaccurate or incomplete;
- ask us to erase your information in certain cases;
- ask us to restrict how we use your information, or object to certain uses;
- withdraw your consent at any time, where we rely on consent;
- ask to receive your information in a portable format, where that right applies; and
- make a complaint to the Data Protection Authority of Sri Lanka (dpa.gov.lk) or to the data protection authority in the country where you live.
To use any of these rights, email us at salthousesrilanka@gmail.com. We may need to confirm your identity first. We aim to reply within one month.
9. Keeping your information secure
We use reasonable technical and organisational measures to protect personal information, including encrypted (HTTPS) connections on our website, restricted administrator access, regular software updates and secure backups. No method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee absolute security. If a breach affecting your information occurs, we will notify you and the authorities where the law requires.
10. Children
Our website is not aimed at children. If you book for a stay with children, please provide their details on their behalf. If you believe a child has sent us personal information directly, please contact us and we will delete it.
11. Links to other websites
Our website links to other sites, such as Facebook, Instagram, Tripadvisor, Booking.com and Google. We are not responsible for their content or privacy practices, so please read their privacy policies.
12. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top shows when it was last changed. Please check back occasionally.
13. Contact us
If you have any questions about this policy or how we handle your information, please contact us:
