This is an info Alert.
Last updated on 24 September 2026
This Privacy and Data Protection Policy applies for all Customers who access the website www.reservations.lk and the services provided therein (hereinafter referred to as “Platform”), to seek the availability, details of accommodations and book resorts, holiday homes, hotels of the Hotel Partners (“ Hotel Partners”) via this Platform. This sets out the practices that Reservations LK (Pvt) Ltd (“Company”, “we”, “our”, “us”) follow with respect to the collection, use maintenance, transfer and disclosure of information collected when each person (“Customer”, “you”, “your”) access our Platform.
We respect and value the privacy of each of you who enter our Platform, and we commit towards maintaining the highest standards required in order to protect any personal information you consent to share with us in accordance with the Sri Lanka’s Personal Data Protection Act 2022 (the “PDPA”).
We reserve the right to revise this Privacy Policy at anytime, without prior notice, and the changes will be effective subsequent to posting the changes to the Platform. Please check the Platform frequently to be updated on the changes. By accessing the content and services made available on the Platform and by providing your personal data to us, you acknowledge and agree that you have fully read and understood this policy, and consent to the collection, use, processing, and disclosure of your personal data as described in this policy. If you do not want the Company to collect, use, store, transmit or display collected data, please do not use the Platform.
We collect contact information from our Customers, which may include your full name, date of birth, physical addresses, email addresses, telephone numbers. Additionally, during telephone calls, emails, and other communications with us, we may collect information such as the identity of the caller or sender of the email, the date and time of the call or email, and the subject and resolution of such communication. All interactions and related data are treated with the utmost respect for privacy and are used solely for the purpose of providing excellent service and support.
We may collect “usage information” anytime you visit, view and/or interact with our Platform. We may collect your computer’s IP address, browser type, operating system version, geolocation information, cookies, IP address, information regarding your browsing activities (e.g., parts of the website visited, items clicked on) and any other server log information, URL requested, the type of data viewed, user agent, time of usage. We may associate this information with your personally identifiable information.
Payments made through the Platform are processed through a third-party payment processor. Information to administer, manage, and fulfill the bookings you make, may be collected by us or on our behalf. Such information may include transaction identifiers, payment information credit card number, account authentication information, and contact information including your full name, billing and shipping address and email address and any other information necessary to process the payment.
If you disclose personal data relating to other individuals, you confirm that these individuals have been duly informed about the processing of their personal data by us, in accordance with this Privacy Policy. Furthermore, you affirm that you have obtained all necessary consents or authorizations, as required under the applicable laws and regulations governing your activities.
The Company collects personal data for some or all of the following reasons.
We use the information collected to; improve and personalize your experience, perform data analysis and testing, collect feedback to help improve our programs, features or/and services, produce certification, enhance the online experience of using our Platform as further described in the section ‘Use of Cookies’.
To alert you about service upgrades, technical alerts and revisions, respond to you when you contact us, and promote new features or services that we feel may be of interest you to assist in addressing your inquiries and troubleshooting, about our services. To notify you about changes to our services and provide you with information that is relevant to your use of the service.
We do not sell, trade or otherwise transfer to third parties your personally identifiable information. Any information provided to the Platform will be protected from loss, misuse, unauthorized access or disclosure, alteration or destruction.
However, we share your personal information with authorized third parties who assist us in operating the Platform, conducting our business or servicing you including but not limited to selected third party service providers for the purpose of delivering our services, preventing and detecting fraud, storing data, supporting our business operations, or enabling them to perform services on our behalf, to payment service providers for the processing of credit card transactions and to providers of online support services, as long as these parties are compliant with applicable data protection laws.
The Platform may also use “cookies” and other technologies enabling us to recognize users and customize their experience and obtain information regarding the use of it. A cookie which is a small text file that a website’s server places on a user’s computer, enables to transmit information back to the website’s server regarding the browsing activities of the computer user on the Platform. This may also include information such as pages and content viewed, the time and duration of visits and whether the user clicked on an advertisement. Cookies are also used to recognize users and maintain data related to a particular individual. If you prefer not to accept cookies from the Platform, you can modify the settings on your web browser.
Third-Party cookies we use include but are not limited to Google Analytics, Facebook Inc., HotJar, Mix Panel, and Pendo.
For the performance cookies and targeting cookies when starting a new session on our Platform, you can choose to opt-out of these. It is possible that any advertising you receive will be less targeted as a result, but the Platform should function correctly.
If you wish to disable the strictly necessary cookies, then within your browser you can choose whether you want to accept cookies or not. Different browsers make different controls available to you. Generally, your browser will offer you the choice to accept, refuse or delete all cookies, third-party cookies, or specific website cookies. Each browser’s website should contain instructions on how you can do this.
If you block these cookies on our Platform, certain features and services may not function properly.
We continuously invest in the latest technologies and best practices to maintain the confidentiality, integrity, and availability of your information. We have standardized enterprise-wide analysis of software-related threats within the organization and have prioritized the proactive improvement of threat coverage throughout the organization to ensure that there are no leaks of the data we collect.
We are committed to ensuring that your information is secure. In order to prevent unauthorized access or disclosure we have put in place the following suitable physical, electronic and managerial procedures to secure the information.
a. The Company uses multi-factor authentication, and role-based access permissions to make sure that only authorized people can access our systems and data.
b. The Company uses secure protocols to transmit data over the internet. This helps to protect our data from being intercepted by unauthorized people.
c. The Company has clear data retention policies that define how long we keep different types of data. This helps us to ensure that we only keep data for as long as necessary and that we dispose of it securely when it is no longer needed. The Company encrypts the offline data stored on our devices using strong encryption algorithms. This helps to protect our data from being accessed by unauthorized people if our devices are lost or stolen.
d. The Company keeps systems and software up to date with the latest security patches. This helps to protect our systems from known vulnerabilities.
e. The Company conducts regular security audits and assessments to identify and address any security vulnerabilities. This helps us to keep our systems secure.
f. The Company uses secure key management techniques to store and handle encryption keys. This helps to protect our keys from being compromised.
g. The Company monitors systems for unauthorized or illegal access attempts. We also record specific activities, such as who accesses personal data and with whom the data is being shared.
h. The Company encrypt, pseudonymize, and anonymize data whenever possible to protect it from unauthorized access.
i. The Company design systems with privacy in mind. We also implement data protection measures by default, so that we don't have to add them on later.
j. The Company has a process in place to notify the authorities and our data subjects in the event of a data breach.
k. The Company uses data-minimizing mechanisms to collect and process only the data that we need. This helps to protect user privacy.
l. The Company continuously monitor privacy protection measures to make sure that they are effective.
m. The Company has implemented procedures for dealing with requests and the satisfaction of data subjects' rights, such as the right to be forgotten and the right to data portability.
n. The Company assesses the potential risks for the personal data that we collect and process. This helps us to identify and address any potential privacy risks.
We may keep information and content in our systems, backup files and archives as follows.
i. The Company use encryption to protect your data both when it is stored on our servers and when it is transmitted between our servers and your devices. This means that your data is scrambled so that it cannot be read by unauthorized people.
ii. The Company is regularly taking backup data so that we can restore it in case of a disaster. We also test our backup procedures to make sure that they work properly.
iii. The Company monitors systems for security incidents. This includes monitoring access to our systems, network traffic, and system activities. We also have a Security Operation Centre (SOC) that monitors our systems 24/7.
iv. The Company has classified data based on its sensitivity. This means that we apply different security controls to different types of data. For example, we use stronger encryption for more sensitive data.
v. The Company will dispose of your data when the business relationship ends. We will either anonymize the data or destroy it.
We may choose to retain your personal information to the full extent of any period provided by law and statute. We may also choose to delete your personal information from our databases after a required number of years and/or if the intended purposes for which we have collected your information is completed or is no longer relevant. We may release your information when we are required to comply with the law, enforce our policies, or protect the Company and other third-party rights, property or safety. However, the Company may share aggregated, anonymized, or de-identified information that does not identify any individual with third parties for purposes such as analytics, research, marketing performance measurement, advertising optimization, and service improvement.
i. Right of access- You may have the right to obtain from us confirmation as to whether personal data concerning you is processed, and, where that is the case, to request access to the personal data.
ii. Right to rectification- You may have the right to obtain from us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
iii. Right to object- If the processing of your personal data is based on legitimate interests, you may have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by us and we can be required to no longer process your personal data. Moreover, if your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. In this case, your personal data will no longer be processed for such purposes by us.
iv. Right to fair treatment- We will not discriminate against you for exercising any of your privacy rights. Irrespective of your standing on your privacy preferences, we will provide the services.
v. To restrict the use of your information- You can request to restrict the use of your information.
vi. To complain to a supervisory authority – If you have any complaints regarding the data collected and the usage of it, you have the right to lodge a complaint to a superior authority.
If you have any questions or concerns regarding the Privacy Policy, please feel free to contact us at the following email or telephone number;
Email: support@reservations.lk
Phone: +94762983509