Privacy Policy | Wild Grass Nature Resort

Privacy Policy

Wild Grass Nature Resort | Sigiriya, Sri Lanka
Last updated: 6 November 2026
At Wild Grass Nature Resort, we respect your privacy and are committed to protecting the personal information you share with us.
Wild Grass Nature Resort is owned and operated by Easy Street Pvt. Ltd, a company established in Sri Lanka.
We collect and use personal information primarily to process reservations, communicate with guests and provide the services associated with their stay.
We do not sell, rent or trade personal information, nor do we use guest information for unsolicited marketing.
This Privacy Policy explains what information we collect, how we use it, when it may be shared, how long we retain it and how we protect it.
We are committed to complying with applicable data protection legislation, including Sri Lanka's Personal Data Protection Act, No. 9 of 2022, as amended, and the European Union's General Data Protection Regulation (GDPR), where applicable.

1. Information We Collect
When you make a reservation, contact us or use our website, we may collect personal information necessary to respond to your enquiry or provide our services.
This may include:

Your name and contact details, including email address and telephone number.
Reservation details, including travel dates, villa preferences and number of guests.
Information about accompanying guests, including children's ages where relevant to the reservation.
Payment and transaction details necessary to process or verify bookings.
Special requests or preferences voluntarily communicated to us.
Identification details where required by applicable law.
Correspondence relating to enquiries, reservations or guest services.

When you visit our website, certain technical information, such as your IP address, browser type, device information and website usage data, may also be processed automatically by our website platform and its service providers.
Some special requests, such as those concerning health, accessibility or dietary requirements, may contain sensitive personal information. Where such information is provided, we process it only where necessary, with an appropriate legal basis and any additional protections required by applicable law.
We aim to collect only information reasonably necessary for the purposes described in this policy.

2. How We Use Your Information
Personal information is used for legitimate operational purposes connected with your enquiry, reservation or stay.
These purposes include:

Processing, confirming and managing accommodation reservations.
Responding to enquiries and communicating with guests.
Processing payments, refunds and related transactions.
Arranging requested services, including meals, transfers and experiences.
Managing special requests and providing assistance during your stay.
Maintaining records required for accounting, taxation and legal compliance.
Protecting the security and proper operation of our website and reservation systems.
Improving the reliability and quality of our guest services.

Legal Basis for Processing

Where the GDPR applies, we process personal information on one or more of the following legal grounds:

Contractual necessity: To manage reservations, respond to booking requests, process payments and provide requested accommodation or services, including taking steps requested before entering into a contract.
Legal obligations: To maintain records and comply with applicable accounting, taxation and regulatory requirements.
Legitimate interests: To administer our operations, maintain website security, prevent fraud and improve our services, provided these interests do not override individuals' rights and freedoms.
Consent: Where required for optional cookies, marketing communications or other activities that depend on an individual's permission.

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out beforehand.

Marketing Communications

We do not use personal information collected through reservations for unsolicited promotional communications or unrelated commercial activities.
Should we offer optional marketing communications in the future, we will obtain consent where required by applicable law and provide a straightforward way to unsubscribe.
Automated Decision-Making
We do not use personal information for solely automated decision-making or profiling that produces legal or similarly significant effects on individuals.

3. Payment Information
Payments may be processed through secure third-party payment providers and booking systems authorised by Wild Grass Nature Resort.
These providers process payment information according to their own security standards and applicable privacy policies.
Wild Grass Nature Resort does not intentionally collect or retain complete payment card details in its own reservation records.
We may retain transaction confirmations, payment references and other information reasonably necessary for booking administration, refunds, accounting and legal compliance.
Guests should use only payment links and instructions provided through our authorised communication channels.

4. Sharing Personal Information
Wild Grass Nature Resort does not sell, rent or trade guests' personal information to third parties.
We share personal information only where reasonably necessary to provide our services, operate our systems or comply with legal obligations.
This may include sharing relevant information with:

Booking engine and reservation management providers, including STAAH.
Online travel agencies, such as Booking.com, Expedia and Agoda, where reservations are made through those platforms.
Payment processors and financial institutions.
Website hosting and technical service providers, including Wix.
Transport operators or excursion providers where guests have requested these services.
Government authorities or regulatory bodies where disclosure is legally required.

We seek to limit the information shared to what is necessary for the relevant purpose.

Where service providers process personal information on our behalf, we seek to maintain appropriate data protection arrangements in accordance with applicable law.
Some third-party booking platforms and service providers may also act as independent data controllers. Their processing of personal information is governed by their respective privacy policies.

5. Data Retention
We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected.
Our retention practices are guided by the following principles:

Enquiries: Information relating to enquiries that do not result in reservations is retained only for as long as reasonably necessary to respond, manage follow-up correspondence or address related matters.
Reservations and guest information: Information may be retained after departure where necessary for booking administration, guest enquiries, refunds, complaints, disputes or legitimate operational requirements.
Financial and transaction records: Information is retained for the periods required by applicable accounting, taxation and other legal obligations.
Marketing information: Where consent-based marketing activities are undertaken, information is retained only for as long as there is a valid purpose and legal basis for doing so.
Technical and website information: Information is retained according to operational requirements, applicable legal obligations and the relevant service providers' retention arrangements.

Where a specific retention period cannot be stated in advance, we determine the appropriate period by considering the purpose of processing, applicable legal requirements and whether continued retention is necessary.
When personal information is no longer required, we take reasonable steps to securely delete, anonymise or otherwise dispose of it.
We do not retain guest information indefinitely for marketing purposes.

6. Cookies and Website Information
Our website may use cookies and similar technologies to support its functionality, security and performance.
These technologies may be provided by our website platform, booking engine or other authorised technical service providers.
Cookies may be used to:

Enable essential website features and navigation.
Support reservation and booking functionality.
Maintain website security and reliability.
Remember website preferences where applicable.
Understand technical performance and resolve website errors.

Some cookies are necessary for the website to function correctly.
Where non-essential cookies or tracking technologies are used, we will provide appropriate information and obtain consent where required by applicable law.
Where consent is required, visitors must be able to decline non-essential cookies and withdraw their consent.
Visitors may also manage cookies through their browser settings. Disabling certain cookies may affect website functionality.

7. How We Protect Your Information
We take reasonable technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, loss or misuse.
These measures may include secure website connections, restricted access to reservation information and the use of reputable booking and payment service providers.
Access to guest information is limited to personnel and authorised service providers who require it for legitimate operational purposes.
We also seek to ensure that personal information is handled confidentially and used only for authorised purposes.
Although we take reasonable precautions, no method of electronic transmission or storage can be guaranteed to be completely secure.

8. International Data Processing
Wild Grass Nature Resort is located in Sri Lanka and welcomes guests from around the world.
As we use external booking, payment and website technology providers, personal information may be processed, accessed or stored in countries outside Sri Lanka, including countries outside the European Economic Area (EEA).

Where international transfers are subject to the GDPR, we will comply with the applicable requirements for transferring personal information to third countries.
Depending on the circumstances, these may include an applicable adequacy decision, approved Standard Contractual Clauses or another lawful transfer mechanism.
We take reasonable steps to ensure that personal information is protected in accordance with applicable data protection requirements.
Where applicable, individuals may contact us to request further information about the safeguards used for international transfers and how to obtain a copy of relevant safeguards.

9. Your Privacy Rights and Requests
We respect the privacy and data protection rights of our guests and website visitors.
Depending on applicable data protection laws, including the GDPR, individuals may have the right to:

Access: Request access to personal information we hold about them.
Correction: Request correction of inaccurate or incomplete information.
Erasure: Request deletion of personal information where there is no lawful reason to retain it.
Restriction: Request restriction of certain processing activities.
Objection: Object to processing based on legitimate interests, subject to applicable legal conditions.
Data portability: Request the transfer of eligible personal information to themselves or another service provider.
Withdrawal of consent: Withdraw consent at any time where processing is based on consent.
Automated decision-making: Exercise applicable rights relating to solely automated decisions that produce legal or similarly significant effects.

These rights are subject to applicable legal conditions and exceptions.
For example, certain financial or transaction records may need to be retained for accounting, taxation or other legal obligations, even following a deletion request.
Individuals protected by the GDPR also have the right to lodge a complaint with a competent European data protection supervisory authority.
To exercise your rights or raise a privacy concern, please contact reservations@wildgrass.lk.

Where the GDPR applies, we will normally respond to rights requests within one month of receipt, subject to any lawful extension.
We may request reasonable verification of identity before disclosing or modifying personal information.

10. Third-Party Websites and Services
Our website may contain links to external websites or services, including booking platforms, payment providers and excursion operators.
These third parties may have their own privacy policies and data handling practices.
We encourage guests to review the privacy policies of external services before providing personal information.
Wild Grass Nature Resort is not responsible for the independent privacy practices of third-party websites that are outside our control.

11. Children's Personal Information
We may collect limited information about children where necessary to manage family reservations, determine applicable accommodation rates or provide requested services.
Such information is generally provided by a parent, guardian or other responsible adult making the reservation.
We do not knowingly collect children's personal information for independent marketing purposes.
We seek to limit the collection of children's information to what is necessary for accommodation and related services, and apply appropriate safeguards in accordance with applicable law.

12. Changes to This Privacy Policy
Wild Grass Nature Resort may update this Privacy Policy periodically to reflect changes in our operations, website functionality, service providers or applicable legal requirements.
Any updates will be published on this page with a revised effective date.
We encourage visitors to review this policy when making a reservation or providing personal information.

13. Contact Us
Data Controller
Wild Grass Nature Resort is owned and operated by Easy Street Pvt. Ltd, the legal entity responsible for processing personal information collected through our website and reservation services.

Easy Street Pvt. Ltd
Kumbukkadanwala Farmhouse Road
(Govigammanaya Main Road)
Kumbukkadanwala
Sigiriya, Sri Lanka
Email: reservations@wildgrass.lk
Website: www.wildgrass.lk

For enquiries concerning personal information, privacy rights or data protection, please contact us using the email address above.
We will respond to privacy-related enquiries in accordance with applicable law and cooperate with competent data protection authorities where required.

14. Applicable Law
This Privacy Policy is governed by applicable Sri Lankan law, including the Personal Data Protection Act, No. 9 of 2022, as amended, to the extent its relevant provisions are in force.
Where the European Union's General Data Protection Regulation (GDPR) applies to particular processing activities, Easy Street Pvt. Ltd will respect the relevant requirements of that regulation.

Nothing in this Privacy Policy is intended to limit or exclude any mandatory rights or protections available to individuals under applicable data protection laws.