Privacy policy

Privacy policy – Kelani Retreat · Last updated: June 2026

1. Controller

The controller responsible for data processing on this website is:

KD Happy Retreats (Pvt) Limited
(Kelani Retreat)
Madhia RD 11, Polhena
81000 Matara, Sri Lanka
Represented by: Kevin Oberthür, Daniel Tuckermann
Email: kelaniretreats@gmail.com

Please note: The controller is established outside the European Union (Sri Lanka). As our services are also directed at individuals in the EU, we comply with the requirements of the EU General Data Protection Regulation (GDPR).

2. General Information

We treat your personal data confidentially and in accordance with applicable data protection laws and this privacy policy. Personal data means any information that can be used to identify you personally (e.g. name, email address, IP address).

This privacy policy explains what data we collect, how we use it, and what rights you have.

3. Hosting by Netlify

This website is hosted by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA (“Netlify”). When you visit our website, Netlify processes certain data, including your IP address, date and time of access, pages visited, browser type and operating system (server log files). This data is technically necessary to deliver the website and to ensure its stability and security.

Processing is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the technically reliable and secure presentation of our website.

Data is processed on servers that may be located in the USA. The transfer is based on appropriate safeguards, in particular the EU Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework, and on a data processing agreement (DPA) concluded with Netlify.

Further information: https://www.netlify.com/privacy/

4. Cookies and Consent

Our website uses cookies and similar technologies. Technically necessary cookies are set on the basis of our legitimate interest in the functionality of the website (Art. 6(1)(f) GDPR). All other cookies and tracking technologies — in particular for analytics and marketing (see the relevant sections below) — are only set with your explicit consent (Art. 6(1)(a) GDPR), which you can give via the cookie banner and withdraw at any time with effect for the future.

You can also manage or delete cookies via your browser settings. Disabling cookies may limit the functionality of the website.

5. Google Ads, Conversion Tracking and Remarketing

We use Google Ads, an online advertising service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to place advertisements in Google Search and across the Google advertising network.

As part of Google Ads, we use conversion tracking: if you reach our website via a Google ad, a cookie is set that allows Google and us to recognise whether you complete certain actions (e.g. a booking enquiry). We do not receive any information that allows us to identify you personally — only aggregated statistics on the performance of our ads.

We also use Google Remarketing to show interest-based advertising to visitors of our website on other websites and platforms within the Google network.

Processing takes place exclusively on the basis of your consent given via our cookie banner (Art. 6(1)(a) GDPR). You may withdraw your consent at any time with effect for the future.

Data may be transferred to servers of Google LLC in the USA. Google is certified under the EU-U.S. Data Privacy Framework; in addition, EU Standard Contractual Clauses apply.

You can additionally disable personalised advertising in your Google settings: https://adssettings.google.com
Further information: https://policies.google.com/privacy

6. Meta Pixel (Facebook and Instagram Ads)

We use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (“Meta”) to run advertisements on Facebook and Instagram, measure their performance and create audiences for our ads (Custom Audiences and Lookalike Audiences).

The Meta Pixel enables Meta to track your behaviour on our website after you have seen or clicked on a Facebook or Instagram ad (e.g. page views, booking enquiries). The data collected is anonymous to us; however, Meta may link it to your user account and use it for its own advertising purposes in accordance with Meta’s Data Policy. Where data is processed jointly with Meta (collection and transmission), this is based on a joint controllership agreement (Art. 26 GDPR).

Processing takes place exclusively on the basis of your consent given via our cookie banner (Art. 6(1)(a) GDPR). You may withdraw your consent at any time with effect for the future.

Data may be transferred to servers of Meta Platforms, Inc. in the USA. Meta is certified under the EU-U.S. Data Privacy Framework; in addition, EU Standard Contractual Clauses apply.

You can manage your ad preferences here: https://www.facebook.com/settings?tab=ads
Further information: https://www.facebook.com/privacy/policy

7. Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to understand how visitors use our website (e.g. pages viewed, time on site, approximate region). Google Analytics uses cookies and may transfer data to Google servers, including in the USA.

IP addresses are processed in truncated (anonymised) form. Processing takes place exclusively on the basis of your consent given via our cookie banner (Art. 6(1)(a) GDPR); you can withdraw it at any time with effect for the future via the “Cookie settings” link in the footer.

8. Contact

If you contact us via the contact form or by email, the information you provide (e.g. name, email address, content of your message) will be stored for the purpose of handling your enquiry.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the initiation or performance of a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

We delete this data once it is no longer required for processing your enquiry, unless statutory retention obligations apply.

9. Bookings via Bookinglayer

We use the booking platform Bookinglayer (Bookinglayer B.V., Netherlands) for booking our retreats. When you make a booking, you are redirected to the Bookinglayer booking page, where the data required for your booking is collected and processed — in particular your name, contact details, booking details and payment information.

Processing is carried out for the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR). Payment data is processed by the payment service providers integrated into the booking process.

Further information can be found in Bookinglayer’s privacy policy: https://www.bookinglayer.com/privacy-policy

10. Newsletter

If you subscribe to our newsletter, we use your email address to send you regular information about our retreats, offers and news. Subscription follows a double opt-in process: after signing up, you will receive an email asking you to confirm your subscription.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in each newsletter or by contacting us. The newsletter is sent via the infrastructure of our website provider Wix.

11. Social Media

Our website contains links to our profiles on Instagram, Facebook and TikTok. These are plain links — data is only transferred to the respective provider once you click on a link. The respective providers are responsible for data processing on the linked platforms:

• Instagram / Facebook: Meta Platforms Ireland Ltd., Ireland
• TikTok: TikTok Technology Ltd., Ireland

Please refer to the privacy policies of the respective providers.

12. Storage Period

Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose for processing no longer applies, you withdraw your consent, or you validly object to the processing. Statutory retention obligations (e.g. tax or commercial law retention periods for booking and invoice data) remain unaffected.

13. Your Rights

Within the scope of applicable law, you have the right at any time to:

• Access your stored personal data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing based on legitimate interests (Art. 21 GDPR)

You may withdraw any consent you have given at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

To exercise your rights, simply send an informal message to: kelaniretreats@gmail.com

14. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement.

15. SSL/TLS Encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” and the lock symbol in your browser bar. This prevents data you transmit to us from being read by third parties.

16. Changes to this Privacy Policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to reflect changes to our services (e.g. when introducing new services). The current version applies to your next visit.