Privacy Policy
At Kekulama Eco Cabana Galle, we value the trust you place in us when reserving your stay in our private tropical tea sanctuary. This Privacy Policy details our unwavering commitment to protecting personal guest records, handling data with cryptographic integrity, and strictly adhering to global data protection principles.
01.Operator & Contact Identity
This website and its associated reservation management systems are owned and operated by Kekulama Eco Cabana Galle (“we”, “our”, or “us”), a registered boutique eco-retreat located in Pinnaduwa, Galle, Southern Province, Sri Lanka.
02.Information We Collect
To process your reservation, provide personalized hospitality, and comply with Sri Lanka Tourism Development Authority (SLTDA) legal requirements, we collect:
- Guest Contact Details: Full name, email address, WhatsApp/mobile telephone number, and residential nationality.
- Booking & Stay Parameters: Check-in and check-out dates, selected packages (e.g., Honeymoon, Nature Day Out), special dietary requests, and payment confirmation receipts.
- Official Identification: National Identity Card (NIC) or Passport digital copies required for in-person check-in verification in accordance with national tourism safety regulations.
- Technical Metadata: Anonymized analytical metrics (browser type, device viewport, session performance) collected through privacy-focused analytics to improve web experience.
03. Google API Services & Limited Use Disclosure
Our production system integrates with Google Cloud APIs strictly for administrative resilience and guest communication:
We use the least-privilege drive.file scope exclusively to create and synchronize encrypted, compressed database backup archives into a dedicated folder in the verified owner account. We never view, read, index, or access any other files, folders, or personal documents in your Google Drive.
We use the gmail.send scope solely to dispatch transactional booking confirmations, arrival directions, and automated system alerts. We never read, store, or access your inbox messages.
Google user data is never shared with third parties, never used for advertising or marketing profiling, and never used to train machine learning models.
04.Data Encryption & Storage Security
We implement industry-grade technical safeguards to prevent unauthorized access, alteration, or disclosure:
- Encryption in Transit: All HTTP communications are strictly forced over TLS 1.3 / HTTPS with HSTS preloaded.
- Encryption at Rest: Cloud database backups and OAuth credentials are authenticated and encrypted using AES-256-GCM with cryptographically random initialization vectors and SHA-256 integrity checksums.
- Access Control: Administrative and database disaster recovery consoles are restricted exclusively to authenticated resort Owners via cryptographic role-based tokens.
- Retention & Deletion: Database backup archives in Google Drive are automatically rotated on a rolling 30-day lifecycle, ensuring personal records are not retained indefinitely.
05.Your Rights & Data Portability
Under applicable personal data protection laws (including the Sri Lankan Personal Data Protection Act No. 9 of 2022 and GDPR for international travelers), you have the right to:
- Request a copy of your personal guest records stored in our systems.
- Request correction or updating of any inaccurate contact or passport details.
- Request the complete deletion of your registration documents post-departure, subject to statutory tourism accounting obligations.
To exercise any of these rights, please contact our management team directly at kekulamaecocabana@gmail.com.
06.Policy Updates
We reserve the right to modify this Privacy Policy as our services and regulatory requirements evolve. Any modifications will be posted directly to this URL with an updated revision date.