Legal
Privacy Policy
Last updated 7 September 2026
This policy explains what personal data we collect when you visit our website, enquire about a retreat or book a place with us, how we use that data, who we share it with and what rights you have over it.
In this policy "we", "us" and "our" mean [Company legal name], trading as Wellness Retreat, [registered address], the controller of your personal data. You can reach us at any time at hello@[yourdomain].com.
1. The data we collect
Information you give us. Your name, email address, phone number, postal address, date of birth, the retreat date you are enquiring about, dietary requirements, emergency contact details, travel and arrival details, and any message you send us through a form or by email.
Health information. If you choose to tell us about injuries, pregnancy, allergies, medication or a medical condition so that we can adapt the practice or the food, we treat that as special category data and use it only for your safety and care during the retreat.
Payment information. Deposit and balance payments are processed by our payment provider. We receive confirmation of payment, the amount and the last four digits of the card. We never see or store full card numbers.
Technical information. IP address, browser and device type, pages visited, referring page and approximate location, collected through our website and analytics tools.
2. How we use it
To answer your enquiry, hold your place, take payment, send you joining instructions and run the retreat you have booked. To keep you safe, by giving your emergency contact and relevant medical details to the teacher, chef or a medical professional if the situation requires it. To meet our accounting, tax and insurance obligations. To improve the website and understand which pages people read. And, if you have asked for it, to send you occasional news about future retreat dates.
We do not sell your personal data, and we do not use it to make automated decisions about you.
3. Our legal bases
We rely on performance of a contract to take and deliver your booking; on your explicit consent for health information, marketing emails and non-essential cookies; on our legitimate interest in running and improving a small business for enquiries, analytics and service messages; and on legal obligation for records we are required to keep. Where we rely on consent, you can withdraw it at any time without affecting anything we did before you withdrew it.
4. Who we share it with
We share only what is necessary, and only with: the venue and its staff, so your room, diet and arrival are arranged; the teacher leading your retreat; our payment processor; our email, booking and website providers; our accountant and insurer; and a doctor, hospital or emergency service in a medical emergency. We may also disclose data where the law requires it. Each provider acts on our instructions under a written agreement and may not use your data for its own purposes.
5. International transfers and how long we keep data
Because our retreats run in Sri Lanka and some of our providers are based outside the European Economic Area, your data may be transferred abroad. Where that happens we rely on an adequacy decision or on standard contractual clauses approved by the European Commission.
We keep enquiry records for 24 months, booking and health records for the duration of the retreat and 12 months afterwards, financial records for 7 years as our tax rules require, and marketing consents until you unsubscribe. After that we delete or anonymise the data.
6. Your rights
You have the right to ask for a copy of the data we hold about you, to have it corrected, to have it deleted where we no longer need it, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent. Write to hello@[yourdomain].com and we will respond within one month. If you are not satisfied with our response you may complain to your national data protection authority.
7. Cookies and analytics
We use essential cookies that make the site work and, with your consent, analytics cookies that tell us anonymously which pages are read and where visitors arrive from. You can accept or decline non-essential cookies when you first visit, change your choice at any time, and block or delete cookies in your browser settings. Declining them does not stop you from booking.
8. Security
We keep your data on reputable hosted services protected by encryption in transit, access controls and two-factor authentication, and we limit access to the people who need it to run the retreat. No transmission over the internet is completely secure, so we cannot guarantee absolute security, but we will notify you and the relevant authority without undue delay if a breach is likely to affect your rights.
9. Children
Our retreats are for adults. We do not knowingly collect data from anyone under 18. If you believe a child has given us their data, contact us and we will delete it.
10. Changes and how to reach us
We may update this policy from time to time. The date at the top always shows the current version, and if a change materially affects you we will tell you by email before it takes effect.
Questions about this policy, or about the data we hold: [Company legal name], [registered address]. Email hello@[yourdomain].com. Company number [number].
Wellness Retreat
Rekawa Lagoon Road, Tangalle 82200, Southern Province, Sri Lanka
© 2026 Wellness Retreat.