Privacy
policy

What we collect

We only collect what we need to answer you and to look after your stay.

• When you book — your name, email address, telephone number, country, arrival and departure dates, the room and board you chose, and any request you make (a late arrival, a dietary need, an airport pickup).
• When you pay — the amount, the date, and a reference number from the bank. We never see or store your full card number. Card details are entered on Sampath Bank's own secure page, not ours.
• When you message us — the messages themselves, and any photograph or document you choose to send us, such as a bank transfer slip.
• When you check in — the identity details Sri Lankan law requires a hotel to record for every guest, including passport details for visitors from abroad.
• When you use this website — ordinary technical information such as the pages you visited, so we can keep the site working.

Messages you send us

This section is here because we want to be plain about it: if you write to us on WhatsApp, Facebook Messenger, Instagram Direct, or the chat box on this website, we keep that conversation.

• We keep it so we can answer you, so a colleague picking the conversation up later knows what you already asked, and so we do not ask you the same question twice.
• Our Facebook Page is ZEN Koggala by Sugar Coliving & Coworking and our Instagram account is @zenkoggala. Messages sent to either reach the same team.
• You will often be answered by an automated assistant called Zara. Zara is software, not a person. A member of our staff can take over the conversation at any time, and you can ask for a person whenever you like — just say so and we will pass you to one.
• We reply only to people who have written to us first. We do not send marketing broadcasts on these channels and we do not add you to any list because you messaged us.
• We do not read, and have no access to, anything on your Facebook or Instagram profile beyond the name and profile picture the platform shows us alongside your message.
• Who operates the messaging system. The assistant and the shared inbox our staff answer from are run for us by Sugar Coliving (Pvt) Ltd, which operates the guest-messaging system for both Sugar properties, and the Meta application connecting our Facebook Page and Instagram account to it is registered to that company. It processes your messages only to answer you on our behalf, under this policy.

Why we are allowed to hold it

• To perform our contract with you — making, changing and honouring your booking.
• To meet a legal obligation — guest registration and tax records required in Sri Lanka.
• Our legitimate interest in running the hotel — answering enquiries, preventing fraudulent bookings, and keeping our own accounts.
• Your consent, where you have given it — for example if you ask us to keep a preference for a future stay.

Who else sees it

We do not sell your information, we do not rent it, and we do not share it for anyone else's advertising. We use a small number of service providers who process data on our behalf:

• Sugar Coliving (Pvt) Ltd — operates the guest-messaging system and the staff inbox for both Sugar properties.
• Beds24 — our reservation system, which holds the booking itself.
• Meta Platforms — WhatsApp, Facebook Messenger and Instagram carry the messages you send us, under their own privacy terms.
• Anthropic — our assistant Zara is built on an AI model operated by Anthropic, so the text of your message is sent to Anthropic to produce a reply. It is not used to train their models.
• Sampath Bank — card payments, on their own secure gateway.
• Our accounting system — the invoice and payment record, kept for tax.

We will also disclose information where the law requires it, for example to the police or to a tax authority.

How long we keep it

• Booking and payment records — for as long as Sri Lankan tax and company law requires us to keep them.
• Conversations — while they are useful for looking after you, and then no longer than we need them.
• Identity documents taken at check-in — only for as long as the law requires.

Asking us to delete your data

You can ask us to delete the information we hold about you at any time.Email [email protected] from the address you booked with, or send us a message on the same channel you wrote to us on, and say that you want your data deleted.

• Tell us your name and, if you have one, your booking reference. If you are asking about a Facebook or Instagram conversation, sending the request as a message in that same conversation is the easiest way for us to find it.
• We will confirm within 7 days and complete the deletion within 30 days.
• What we may have to keep: if you have stayed with us or paid us, Sri Lankan tax and guest-registration law requires us to retain the booking, invoice and registration record. We will delete everything else, including the conversation, and we will tell you exactly what was kept and why.

Your other rights

You can ask us for a copy of what we hold about you, ask us to correct anything that is wrong, or object to how we are using it. Write to [email protected] and we will answer within 30 days.

Keeping it safe

• Our systems are reached over encrypted connections only.
• Access is limited to the staff who need it to do their job.
• Card numbers never reach our systems at all — they are handled by Sampath Bank.
• If a breach ever affects your information, we will tell you.

Children

Our booking service is not intended for children, and we do not knowingly collect information from a child except as part of a family booking made by an adult.

Changes to this policy

If we change this policy we will update the date at the top of the page. If the change is significant we will say so on our website.

Contact

Zen By Sugar (Pvt) Ltd
Duwa Road, Harumalgoda, Koggala, Sri Lanka
[email protected]