Privacy Policy

1. Who we are

This privacy policy applies to the website rajaratahotel.lk and to bookings, enquiries, and stays at Rajarata Hotel, a 4-star property at 77 Rowing Club Road, Anuradhapura, Sri Lanka. The data controller is Rajarata Hotels Ltd, registered in Sri Lanka.

We're committed to protecting your privacy and to handling your information transparently — whether you're booking a room, sending an enquiry, or just browsing.

2. What information we collect

We collect only the information we genuinely need to look after you as a guest.

You give us this directly:

• Booking and reservation details: your name, contact number, email address, address, dates of stay, room preferences, payment details (handled by our booking partner Axis Rooms — see below).
• Enquiry form submissions: name, phone, email, the subject of your enquiry, and any message text.
• WhatsApp messages you send to our reservations line.
• Special requests you share with us — dietary needs, mobility requirements, anniversary notes, etc.
• Marketing preferences if you opt into our newsletter.

We collect this automatically when you visit the website:

• Visitor analytics: approximate location (city level), browser type, device type, pages visited, time on page — collected via Google Analytics 4 once you accept cookies.
• Cookies: small text files used for site functionality and analytics. See our Cookies Policy.

3. Why we collect it

We use your information for these purposes only:

• To honour your booking — confirming reservations, preparing your room, billing, providing the services you've asked for.
• To answer your enquiries — replying to questions, providing quotes for weddings or events, arranging excursions.
• To improve the hotel experience — understanding which pages and offers visitors find useful.
• To send you updates — only if you've explicitly opted in to our newsletter. You can unsubscribe at any time.
• To meet our legal obligations — Sri Lankan tax law, the Inland Revenue Department's records requirements, hotel-registration laws.

4. Who we share it with

We share your information only with these parties, and only as needed:

• Axis Rooms — our booking-engine partner who processes reservations and payments on our behalf. Their privacy practices are governed by their own policy.
• Google Analytics — for anonymous visitor analytics. You can opt out via the cookie banner.
• Online Travel Agencies (Booking.com, Agoda, Expedia, etc.) — only when you have made your booking through them, in which case they have already shared your details with us.
• Sri Lankan authorities — when required by law (police hotel-registration records, tax authorities).

We never sell your data to anyone, ever. We do not share marketing lists with third parties.

5. How long we keep it

• Reservation records: 7 years (Sri Lankan tax-record requirement).
• Enquiry messages: up to 2 years from your last contact.
• Newsletter subscribers: until you unsubscribe.
• Website analytics: 14 months (Google Analytics default).

6. Your rights

Under the Sri Lankan Personal Data Protection Act 2022 (and the EU GDPR if you're an EU resident), you have these rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete data we no longer have a legal need for.
• Objection — opt out of marketing or analytics.
• Portability — receive your data in a portable format.
• Withdraw consent — at any time, for anything based on consent.

To exercise any of these, email reservations@rajaratahotel.lk. We aim to respond within 14 days.

7. How we protect your data

We take reasonable technical and organisational measures to protect your data:

• The website is served over HTTPS.
• Payment data is handled directly by our booking partner Axis Rooms — we never see or store credit-card numbers ourselves.
• Internal access to guest records is restricted to authorised staff.
• Paper records are stored securely.

No method of transmission over the internet is 100% secure, but we follow industry standard practices and respond promptly to any incident.

8. How to contact us

If you're not satisfied with our response, you may contact the Data Protection Authority of Sri Lanka.

Changes to this policy

If we materially change this policy, we'll update the date at the top and — if the change affects how we use your data — give a notice on the website.