Privacy
policy

What we collect

We only collect what we need to answer you and to look after your stay.

• When you book — your name, email address, telephone number, country, arrival and departure dates, the room and board you chose, and any request you make (a late arrival, a dietary need, an airport pickup).
• When you pay — the amount, the date, and a reference number from the bank. We never see or store your full card number. Card details are entered on Sampath Bank's own secure page, not ours.
• When you message us — the messages themselves, and any photograph or document you choose to send us, such as a bank transfer slip.
• When you check in — the identity details Sri Lankan law requires a hotel to record for every guest, including passport details for visitors from abroad.
• When you use this website — ordinary technical information such as the pages you visited, so we can keep the site working. Cookies are explained below.

Messages you send us

This section is here because we want to be plain about it: if you write to us on WhatsApp, Facebook Messenger, Instagram Direct, or the chat box on this website, we keep that conversation.

• We keep it so we can answer you, so a colleague picking the conversation up later knows what you already asked, and so we do not ask you the same question twice.
• Our Facebook Page is ZEN Koggala by Sugar Coliving & Coworking and our Instagram account is @zenkoggala. Messages sent to either reach the same team.
• You will often be answered by an automated assistant called Zara. Zara is software, not a person. A member of our staff can take over the conversation at any time, and you can ask for a person whenever you like — just say so and we will pass you to one.
• We reply only to people who have written to us first. We do not send marketing broadcasts on these channels and we do not add you to any list because you messaged us.
• We do not read, and have no access to, anything on your Facebook or Instagram profile beyond the name and profile picture the platform shows us alongside your message.
• Who operates the messaging system. The assistant and the shared inbox our staff answer from are run for us by Sugar Coliving (Pvt) Ltd, which operates the guest-messaging system for both Sugar properties, and the Meta application connecting our Facebook Page and Instagram account to it is registered to that company. It processes your messages only to answer you on our behalf, under this policy.

Cookies

This website uses three kinds. You can change your choice at any time with Cookie settings, also at the foot of every page.

• Necessary — your cookie choice, saved in your browser under sugar-consent, and a few short-lived settings the booking pages keep in your browser tab. They are never sent to anyone and cannot be switched off.
• Measurement — Google Analytics, loaded through Google Tag Manager, sets _ga and _ga_G1J5M9CP25 to show us which pages are visited and how a room search goes. Google keeps them for up to two years.
• Offers — Google Ads cookies, whose names begin _gcl, and the Meta pixel, which sets _fbp (and _fbc when you arrive from a Facebook or Instagram ad), let our rates and experiences reach you in Google, Facebook and Instagram ads and count what those ads bring: a look at the villa price, a request for dates, a tap on WhatsApp, the steps of a booking (dates checked, meals and extras chosen, the amount to pay). Meta keeps _fbp for up to three months. If you book the whole villa online with Offers on, our booking system also tells Meta once the payment is approved: the amount, with the pixel's own identifiers and your browser's internet address and type. We never send Meta your name, email, phone number or stay dates.

In the European Economic Area, the United Kingdom and Switzerland, nothing but the necessary kind is set until you say yes. If you choose "Only necessary" or close the banner, Google receives only signals without cookies, which do not identify your browser, and the Meta pixel does not load at all. If you switch Offers off later, it stops on that page. Everywhere else measurement and offers are on by default, and you can switch them off in Cookie settings.

Why we are allowed to hold it

• To perform our contract with you — making, changing and honouring your booking.
• To meet a legal obligation — guest registration and tax records required in Sri Lanka.
• Our legitimate interest in running the hotel — answering enquiries, preventing fraudulent bookings, and keeping our own accounts.
• Your consent, where you have given it — for example if you ask us to keep a preference for a future stay.

Who else sees it

We do not sell your information, we do not rent it, and we do not share it for anyone else's advertising. We use a small number of service providers who process data on our behalf:

• Sugar Coliving (Pvt) Ltd — operates the guest-messaging system and the staff inbox for both Sugar properties.
• Beds24 — our reservation system, which holds the booking itself.
• Meta Platforms — WhatsApp, Facebook Messenger and Instagram carry the messages you send us, under their own privacy terms; with the Offers cookies on, the Meta pixel measures our Facebook and Instagram ads.
• Anthropic — our assistant Zara is built on an AI model operated by Anthropic, so the text of your message is sent to Anthropic to produce a reply. It is not used to train their models.
• Sampath Bank — card payments, on their own secure gateway.
• Google — Google Analytics and Google Ads measure how this website is used, under the cookie choices above.
• Our accounting system — the invoice and payment record, kept for tax.

We will also disclose information where the law requires it, for example to the police or to a tax authority.

How long we keep it

• Booking and payment records — for as long as Sri Lankan tax and company law requires us to keep them.
• Conversations — while they are useful for looking after you, and then no longer than we need them.
• Identity documents taken at check-in — only for as long as the law requires.

Asking us to delete your data

You can ask us to delete the information we hold about you at any time.Email zen@sugarcoliving.com from the address you booked with, or send us a message on the same channel you wrote to us on, and say that you want your data deleted.

• Tell us your name and, if you have one, your booking reference. If you are asking about a Facebook or Instagram conversation, sending the request as a message in that same conversation is the easiest way for us to find it.
• We will confirm within 7 days and complete the deletion within 30 days.
• What we may have to keep: if you have stayed with us or paid us, Sri Lankan tax and guest-registration law requires us to retain the booking, invoice and registration record. We will delete everything else, including the conversation, and we will tell you exactly what was kept and why.

Your other rights

You can ask us for a copy of what we hold about you, ask us to correct anything that is wrong, or object to how we are using it. Write to zen@sugarcoliving.com and we will answer within 30 days.

Keeping it safe

• Our systems are reached over encrypted connections only.
• Access is limited to the staff who need it to do their job.
• Card numbers never reach our systems at all — they are handled by Sampath Bank.
• If a breach ever affects your information, we will tell you.

Children

Our booking service is not intended for children, and we do not knowingly collect information from a child except as part of a family booking made by an adult.

Changes to this policy

If we change this policy we will update the date at the top of the page. If the change is significant we will say so on our website.

Contact

Zen By Sugar (Pvt) Ltd
Duwa Road, Harumalgoda, Koggala, Sri Lanka
zen@sugarcoliving.com