Kurumba Garden

Privacy Policy

Last updated: August 2026

1. Who We Are

Kurumba Garden is a boutique hotel on the southern coast of Sri Lanka. This policy explains what personal data we collect through the website kurumbagarden.com, how we use it, and how we protect it.

2. Personal Data Controller

The controller of personal data collected through kurumbagarden.com is Alexander Grigoriev. The controller has submitted a personal data processing notification to Roskomnadzor (the Russian data protection authority) in accordance with Article 22 of Federal Law No. 152-FZ "On Personal Data" (notification No. 100320759).

Controller's contact details for personal-data-related enquiries: email , phone .

3. What Data We Collect

We only collect data you voluntarily provide to us. No account registration is required.

  • When making a booking (villa or excursion): your name, contact detail (phone or messenger), country, dates, and selected property.
  • When submitting the contact form: name, email, phone (optional), subject, and message text.
  • When building a custom trip: name, email, phone, and your trip preferences.
  • When publishing a review: name, email or phone, country, rating and review text, stay dates, the villa/excursions/services you select, and any photos you upload.
  • Technical: IP address and browser headers are recorded in server logs for security purposes.
  • Cookies: your language preference and cookie consent status. See our Cookie Policy for details.

4. How We Use Your Data

  • To process and confirm your booking via WhatsApp or Telegram.
  • To respond to your enquiry submitted via the contact form or custom trip request.
  • To publish your review on the site — your name, rating, text, selected villa/excursions/services, dates, and photos are shown publicly; your email and phone are never published.
  • To notify our team of new bookings and messages by email.
  • To ensure the website functions correctly.

5. What We Do Not Do

  • We do not sell or share your data with third parties for commercial purposes.
  • We do not use third-party analytics or advertising trackers.
  • We do not process online payments or store payment data — payment is cash on arrival.
  • We do not require account registration to make a booking or publish a review.

6. Data Retention

Booking and review data is stored in our database for record-keeping and guest service purposes. Contact form messages are retained until processed. You may request deletion of your data by contacting us.

7. Security

Data is stored on a secured server. We use HTTPS/TLS to encrypt all connections to the website, passwords are stored hashed, and database access is restricted.

8. Your Rights

You have the right to request access to, correction of, or deletion of your personal data, and to withdraw previously given consent to its processing. To do so, please contact us using the details below.

9. Consent to Processing

Personal data is processed only with your consent. Before submitting any form on the site (booking, contact form, custom trip request, review submission) you must tick a consent checkbox confirming you accept this policy — the submit button stays disabled until you do. By starting to enter your details into such a form, you confirm you have read and accepted the terms of personal data processing described in this policy.

10. Contact

For any privacy-related questions, please contact us via the form on our Contact page.