Privacy Policy

The Villa Verner website lets you send an accommodation inquiry and get in touch with us. To do that we need a few of your personal details. Below is an overview of what we collect, what we use it for, who we share it with and how long we keep it.

Data controller

Your data is the responsibility of TERE LANKA (PRIVATE) LIMITED, 113/2 Beach Rd, Matara 81000, Sri Lanka. Our contact details are at the bottom of this page.

What we collect

What you enter yourself. When you send the booking or contact form, we collect:

• your name;
• your email address;
• your phone number with country code;
• arrival and departure dates;
• number of guests (adults, children, infants);
• the room or rooms you selected;
• your message (up to 2,000 characters);
• the language you filled the form in.

On the contact form the dates and guest numbers are optional — name, email, phone and message are required.

Technical data. With every inquiry we also store:

• the address of the page the form was sent from (it may contain your search dates and guest numbers);
• your browser type (user agent);
• a hash of your IP address — a one-way transformation that helps us tell repeat senders apart;
• the reCAPTCHA risk score returned by Google (see below).

We use your IP address to keep the website secure and to show prices in the right currency; the legal basis is our legitimate interest (see below).

We do not collect payment or identity document data — no payments are made on this website and there are no user accounts.

What we use it for

• Answering your inquiry and agreeing the stay. This is the main and usually the only reason.
• Arranging the stay once a booking is confirmed (arrival time, meals, transport).
• Blocking spam and automated bots — this is what reCAPTCHA and the IP hash are for.
• Finding and fixing technical faults.
• Meeting legal obligations, such as bookkeeping.

We do not use your data to build marketing profiles or for automated decision-making. There is no newsletter. We do not sell or rent your data to anyone.

Legal basis

We process inquiries to take steps prior to entering into a contract and, later, to perform the accommodation contract. Spam protection and website security rest on our legitimate interest. Retaining accounting records follows from the law.

Who we share it with

Your data is seen by the villa staff handling your inquiry and stay. In addition we use the following service providers:

• Email service provider — your inquiry reaches us by email and a copy goes to your address. The message passes through our mail server.
• Google reCAPTCHA — protects the form against bots. It runs only on the booking and contact pages. In doing so Google receives your IP address, browser data and the page address. We do not send your name, email or phone number to Google. The Google Privacy Policy and Terms of Service apply.
• Typefaces — the website’s fonts are served from our own server. Opening a page sends no request to Google Fonts or any other third party for them.
• Google Maps — the location and contact pages embed a map served by Google.
• Sentry (European Union servers) — collects technical error reports so we can fix faults. Sending user information and form contents is deliberately switched off; your name, email and message never reach it.

The website has no Google Analytics, Meta pixel or any other analytics or advertising tracker.

We may also disclose data where the law requires it or where it is necessary to protect our rights.

Where the data is kept

Inquiries are stored in a database running on our own server, which is not reachable from the public internet. The connection to the website is encrypted (HTTPS). Because the villa is in Sri Lanka, data may travel outside the European Economic Area; where it does, we limit this to what is needed to answer your inquiry and arrange your stay.

The inquiry link

Every inquiry gets a link with a random identifier, which we send both to you and to ourselves. Anyone who knows the link can see the contents of that inquiry, so please do not pass it on. The link closes 30 days after the inquiry was sent. The page is not available to search engines.

Cookies

The website sets three functional cookies of its own:

• vv_country — whether your visit comes from Sri Lanka or from elsewhere (the value is only “Sri Lanka” or “other”); it is used once, to choose the default currency. Kept for 30 days.
• vv_currency — the currency you chose for prices, euro or Sri Lankan rupee. Kept for one year.
• vv_lang — the language you last viewed the website in, Estonian or English, so that your next visit opens in the same language. Kept for one year.

None of these cookies track you, identify you or contain personal data. We do not ask for consent for them, because they are needed to remember your choice. Nothing else is stored in your browser. Cookies may also be set by Google services (reCAPTCHA on the form pages and the map on the location page) on their own domain — we cannot read those. You can delete or block cookies in your browser settings; the website then cannot remember your currency or language choice and returns to the default currency and to the language of the link you opened.

Location detection

On your first visit the website checks whether your connection comes from Sri Lanka, so that prices can be shown in rupees by default. To do this, your IP address is compared against the public list of Sri Lankan network ranges maintained by the regional internet registry APNIC. The comparison happens in the server’s memory and no external service is consulted about your location. The result is kept in the vv_country cookie described above. You can always switch the currency yourself.

How long we keep it

We keep inquiries for as long as they are needed for our correspondence, a possible booking and the protection of our rights. Accounting records are kept for the period required by law. If you would like your inquiry deleted sooner, write to us — we will do so unless the law requires us to keep it.

Your rights

You have the right to:

• find out what data we hold about you and receive a copy of it;
• have inaccurate data corrected;
• request deletion where the data is no longer needed and the law does not require it;
• restrict processing or object to it;
• receive your data in a machine-readable format.

To do any of this, write to the address at the bottom of this page. We will reply within a reasonable time. If you believe we have handled your data wrongly, you may contact the data protection supervisory authority in your country — in Estonia this is the Data Protection Inspectorate (Andmekaitse Inspektsioon).

Children’s data

This website is not directed at children and we do not knowingly collect data about anyone under 16. A child’s stay is booked by an adult, and about the child we ask only the age group, not a name.

Security

We use an encrypted connection, keep the database off the public internet and limit access to those who need it for their work. No internet service is entirely free of risk, however, and we cannot promise absolute security.

Changes

We may update this policy over time. The version in force is always on this page, together with the date it was updated.