GDPR compliance
and your rights.

Colombo Court Hotel (Pvt) Ltd, trading as Colombo Court Hotel & Spa, 32 Alfred House Avenue, Colombo 3, Sri Lanka, is the data controller for the personal information described here. That means we decide what is collected through this website and what happens to it.

The General Data Protection Regulation is European law. It applies to us because we offer rooms, tables and treatments to people in the European Union and the United Kingdom, and because some of you book from there. We apply the same standard to everyone, wherever they live.

We collect only the information we need to respond to your request.

We do not sell your personal information. It is handled only by the following parties, where they need it:

• SiteMinder, our reservation system, and our property system, to hold and honour a booking.
• Our email provider, to send the newsletter you asked for.
• Our measurement and advertising tools, but only after you have accepted them in the cookie banner.
• WhatsApp, when you choose to send us a message through it. That conversation is subject to WhatsApp’s own terms.

Some of these run on servers outside Sri Lanka and outside the European Economic Area. Where they do, the transfer is covered by the European Commission’s standard contractual clauses or an adequacy decision.

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as the law requires. Booking and billing records are kept for the period required by Sri Lankan tax, accounting and company law, and in line with the Personal Data Protection Act, No. 9 of 2022, as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025. Newsletter subscriptions are kept until you unsubscribe, and the record of the unsubscribe is kept so that we do not write to you again by mistake.

Under the GDPR you can ask us to do any of the following, and we will not charge you for it.

• See it. Ask for a copy of the personal information we hold about you.
• Correct it. Have anything inaccurate put right, or anything incomplete filled in.
• Delete it. Have it erased, where we have no overriding legal reason to keep it.
• Pause it. Have us stop using it while a dispute or an accuracy question is settled.
• Move it. Receive it in a machine-readable file, or have it sent to another provider.
• Object to it. Tell us to stop using it for our own legitimate interests, including marketing.
• Withdraw consent. Change your mind at any time, without affecting anything done before you did.
• Complain. Take it to the supervisory authority in the country where you live.

Write to info@colombocourthotel.com with the word GDPR in the subject line and tell us which of the rights above you want to use. Message us on WhatsApp if that is easier, or call +94 11 464 5333.

We will acknowledge the request within two working days and complete it within thirty days, which is the limit the regulation sets. If a request is unusually complicated we will tell you why, and how much longer it will take. We may ask you to confirm your identity first, so that we do not give your information to the wrong person.

Nothing that measures you or advertises to you runs before you accept it. The banner appears once, your answer is remembered, and you can change it at any time with the Cookie settings link at the foot of every page. The full list of what each cookie does is in our Cookie Policy.

The site is served only over an encrypted connection. Access to booking and guest records is limited to the people whose job needs it, and removed when it no longer does. If a breach ever occurs that puts your rights at risk, we will tell the relevant supervisory authority within seventy-two hours and tell you without undue delay.

If what we do with personal information changes, we will update this page and the review date at the top. If a change materially affects you, we will also tell you directly.