Privacy Policy

Effective Date: 27 August 2026

Last Updated: 27 August 2026

Vacation.lk (“Vacation.lk”, “we”, “us”, or “our”) respects your privacy and is committed to protecting the personal information of our customers, accommodation providers, property owners, partners, and website visitors.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when you access or use Vacation.lk, including our website, booking services, owner services, customer accounts, communication services, and related services.

By using Vacation.lk, you acknowledge that you have read and understood this Privacy Policy.

1. About Vacation.lk

Vacation.lk is an online accommodation and travel platform that connects customers with accommodation providers and property owners in Sri Lanka.

Vacation.lk may facilitate accommodation searches, reservations, communications, payments, notifications, reviews, and related services between customers and accommodation providers.

2. Personal Data We Collect

Depending on how you use our services, we may collect the following categories of information:

2.1 Customer Information

When you create an account, make a booking, contact a property, or use our services, we may collect:

• Full name
• Email address
• Telephone/mobile number
• Account login information
• Booking information
• Check-in and check-out dates
• Number of guests
• Accommodation preferences
• Communication history
• Reviews and ratings
• Customer support information

2.2 Property Owner Information

If you register an accommodation or business with Vacation.lk, we may collect:

• Owner or representative name
• Business/property name
• Email address
• Telephone/mobile number
• Business address
• Property address
• Accommodation details
• Property photographs and descriptions
• Bank/payment information required for payouts
• Business registration or verification information where applicable
• Subscription and transaction information
• Communications with Vacation.lk

2.3 Payment Information

Where payments are made through Vacation.lk or through a third-party payment provider, payment information may be processed by the relevant payment service provider.

Where possible, Vacation.lk does not directly store complete payment-card information such as full card numbers or security codes.

Payment providers may process information according to their own privacy policies and security requirements.

2.4 Technical and Usage Information

When you visit or use Vacation.lk, certain information may be collected automatically, including:

• IP address
• Browser type and version
• Device type
• Operating system
• Pages visited
• Date and time of access
• Referring website
• Approximate location information derived from technical data
• Website activity and interaction information
• Cookies and similar technologies

This information may be used for security, analytics, troubleshooting, performance monitoring, and improving our services.

3. How We Use Personal Data

We may use personal data for legitimate business and service-related purposes, including:

• Creating and managing user accounts
• Processing accommodation bookings
• Connecting customers with accommodation providers
• Communicating booking information
• Sending booking confirmations and updates
• Providing customer support
• Processing payments and payouts
• Managing subscriptions and services
• Verifying accounts and properties
• Preventing fraud, abuse, and unauthorized activity
• Maintaining website and system security
• Improving website functionality and user experience
• Analysing website usage and performance
• Managing reviews and ratings
• Sending service-related notifications
• Sending promotional communications where permitted
• Complying with applicable legal and regulatory obligations
• Protecting the rights, property, and safety of Vacation.lk, users, and other parties

4. Legal Basis for Processing

Where applicable, Vacation.lk processes personal data on lawful grounds permitted under applicable data-protection laws, including:

• Where processing is necessary to provide a service requested by you
• Where processing is necessary to perform or manage a booking or other agreement
• Where you have provided consent
• Where processing is necessary for legitimate business purposes
• Where processing is required by law or a lawful authority
• Where processing is necessary to protect the rights, safety, or security of individuals or our services

Vacation.lk will seek consent where consent is required by applicable law.

5. Sharing of Personal Data

We do not sell your personal data as a commodity.

However, personal data may be shared where reasonably necessary to provide our services.

This may include sharing information with:

Accommodation Providers

When a customer makes or requests a booking, relevant information may be shared with the accommodation provider to facilitate and manage the reservation.

Customers

Where necessary to facilitate a booking, relevant property and accommodation-provider information may be displayed to customers.

Payment Service Providers

Payment and transaction information may be processed by third-party payment providers.

Technology and Service Providers

We may use third-party providers for services such as:

• Website hosting
• Cloud infrastructure
• Database services
• Email delivery
• SMS notifications
• Analytics
• Payment processing
• Security and fraud prevention
• Customer support
• Website performance monitoring

These providers may process personal data only to the extent reasonably necessary to provide their services to us.

Legal and Regulatory Authorities

We may disclose information where required by applicable law, court order, regulatory requirement, or lawful government request.

Business Transactions

If Vacation.lk or its assets are involved in a merger, acquisition, restructuring, sale, or similar transaction, relevant personal data may be transferred as part of that transaction, subject to applicable law.

6. Accommodation Provider Responsibilities

Accommodation providers using Vacation.lk may receive customer information necessary to manage bookings and provide accommodation services.

Accommodation providers are responsible for handling customer information appropriately and in accordance with applicable laws.

Accommodation providers must not use customer information obtained through Vacation.lk for unrelated purposes, unauthorized marketing, or activities that violate applicable law or Vacation.lk's terms.

7. Cookies and Similar Technologies

Vacation.lk may use cookies and similar technologies to:

• Keep users signed in
• Remember preferences
• Maintain website functionality
• Understand website traffic
• Improve website performance
• Detect suspicious activity
• Analyse how users interact with our services
• Support relevant advertising or marketing activities where applicable

You may manage cookies through your browser settings. Disabling certain cookies may affect some website functionality.

8. Marketing Communications

We may send service-related communications such as:

• Booking confirmations
• Booking updates
• Account notifications
• Security alerts
• Payment notifications
• Important service announcements

Where permitted by applicable law, we may also send promotional communications about Vacation.lk, accommodation offers, services, or other relevant information.

You may unsubscribe from promotional communications using the available unsubscribe mechanism or by contacting us.

Service-related communications may continue where they are necessary to provide the requested service.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including:

• Providing and maintaining our services
• Managing accounts and bookings
• Maintaining business and financial records
• Resolving disputes
• Preventing fraud and abuse
• Meeting legal and regulatory requirements
• Enforcing agreements and protecting our legal rights

When personal data is no longer required, we may securely delete, anonymize, or otherwise dispose of it in accordance with applicable requirements.

10. Data Security

Vacation.lk takes reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, disclosure, or destruction.

Security measures may include:

• Access controls
• Authentication mechanisms
• Secure server infrastructure
• Encryption where appropriate
• Security monitoring
• Regular software and system maintenance
• Backup and recovery procedures

However, no internet-based system can be guaranteed to be completely secure.

Users are responsible for keeping their account credentials confidential and should immediately notify Vacation.lk if they believe their account has been compromised.

11. International Data Transfers

Some of our technology, hosting, payment, communication, analytics, or other service providers may process information outside Sri Lanka.

Where personal data is transferred or processed outside Sri Lanka, Vacation.lk will take appropriate steps required by applicable law and applicable data-protection requirements.

12. Your Privacy Rights

Subject to applicable law and any relevant limitations, you may have rights concerning your personal data, including rights relating to:

• Accessing personal data held about you
• Requesting correction of inaccurate or incomplete information
• Requesting deletion or erasure where legally applicable
• Objecting to or restricting certain processing
• Withdrawing consent where processing is based on consent
• Requesting information about how your personal data is processed
• Exercising other rights provided under applicable data-protection legislation

Requests should be submitted using the contact information provided below.

We may need to verify your identity before processing certain requests.

13. Children's Privacy

Vacation.lk is intended for use by individuals who are legally permitted to enter into accommodation-related transactions.

We do not knowingly collect personal data from children for independent account creation or booking purposes where such collection is prohibited by applicable law.

If you believe that a child has provided personal data to us in circumstances where such collection is not permitted, please contact us so that we can review and take appropriate action.

14. Third-Party Websites

Vacation.lk may contain links to third-party websites, payment services, social-media platforms, maps, or other external services.

We are not responsible for the privacy practices, security, content, or policies of third-party services.

We encourage users to review the privacy policies of third-party services before providing personal information to them.

15. Reviews, Photos, and Public Information

If you submit reviews, ratings, photographs, comments, or other content to Vacation.lk, certain information may be displayed publicly or shared with other users as part of the service.

Users should avoid publishing sensitive personal information in public reviews, comments, photographs, or other content.

Vacation.lk may moderate, remove, or restrict content that violates our Terms & Conditions or applicable law.

16. Fraud Prevention and Security

We may process information to detect, investigate, and prevent:

• Fraudulent bookings
• Payment abuse
• Account misuse
• Fake listings
• Unauthorized access
• Spam
• Security threats
• Other unlawful or harmful activities

Where appropriate, information may be shared with payment providers, security providers, law-enforcement authorities, or other relevant parties.

17. Data Breaches

If a personal-data breach occurs, Vacation.lk will assess the incident and take appropriate steps in accordance with applicable laws and regulatory requirements, including notification requirements where applicable.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in:

• Our services
• Technology
• Business practices
• Legal requirements
• Regulatory requirements

The updated Privacy Policy will be published on Vacation.lk with a revised “Last Updated” date.

Where required, we may provide additional notice or obtain consent for material changes.

19. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us.

Vacation.lk

Operated by The Booking International (Private) Limited

Website: Vacation.lk

Email: info@vacation.lk

Telephone: +94779669923

Business Address: Isuru Mw, Hapugala, Wkella, Galle, Sri Lanka.

For privacy-related requests, please include sufficient information to allow us to identify your account or request.

20. Governing Law

This Privacy Policy shall be interpreted in accordance with the laws of Sri Lanka, subject to any applicable mandatory data-protection rights and requirements.

Last Updated: 27 August 2026