Privacy Notice & Cookie Statement

About Lily Lanka

Lily Lanka (Pvt) Ltd is a Sri Lankan-based company incorporated for the purpose of setting up a digital booking platform aimed at facilitating the travelers to connect with many travel destinations in Sri Lanka also allowing many options for accommodation, comparison of rates, digital Payments and booking service with related service providers.

We are committed to protecting your privacy and handling your personal data in compliance with the laws of Sri Lanka and applicable international data protection standards.

Scope of This Notice

This Privacy Notice applies to:

• Users and travelers using our website or mobile app,
• Accommodation providers and business partners using our partner platforms, and
• Any person whose data is collected through our Platform, services, or communications.

Personal Data We Collect

We collect the following types of personal data depending on how you interact with us:

Data you provide to us

• Name, contact details (email address, phone number), and postal address;
• Booking and payment details;
• Account login credentials (if you create an account);
• Preferences (e.g., accommodation type, travel dates, special requests);
• Reviews or feedback you submit;
• Communication content when you contact our support or business teams.

Data we collect automatically

• Device information (IP address, operating system, browser type, etc.);
• Platform activity, including pages visited and actions taken;
• Location data (when permitted by your device settings);
• Cookies and similar tracking data.

Data we receive from third parties

• Accommodation providers or travel partners with whom you have made bookings;
• Payment processors or service providers who handle transactions;
• Marketing and analytics partners who help improve our services.

How We Use Your Personal Data

We use your personal data to:

1. Process and confirm your reservations;
2. Provide customer service and support;
3. Manage your account and preferences;
4. Improve our Platform, services, and user experience;
5. Send booking confirmations, updates, and relevant offers;
6. Conduct analytics, performance monitoring, and fraud prevention;
7. Comply with legal obligations under any applicable Sri Lankan law, regulation or direction

We will only process your personal data for legitimate business purposes, in accordance with the consent you provide and applicable legal bases.

Legal Bases for Processing

We process your personal data under one or more of the following legal grounds:

• To perform our contract with you (e.g., completing bookings or payments);
• To comply with legal obligations;
• For our legitimate business interests (e.g., improving services, preventing fraud);
• Based on your consent (e.g., marketing communications).

How We Share Personal Data

We may share your data only as necessary with:

• Accommodation providers and service partners to process your reservations;
• Payment processors to handle secure transactions;
• Technology and support service providers that help us maintain the Platform;
• Marketing and analytics partners, only as permitted by law;
• Government or regulatory authorities, when required by law.

All third parties handling personal data on our behalf are required to maintain confidentiality and use the data solely for authorised purposes.

International Data Transfers

If your personal data is transferred outside Sri Lanka (for example, to cloud servers or global service providers), Lily Lanka ensures appropriate safeguards are in place, such as contractual protections and compliance with international privacy standards.

Data Retention

We retain your personal data only for as long as necessary to:

• Fulfil the purposes stated in this Privacy Notice;
• Comply with applicable legal or tax obligations;
• Resolve disputes or enforce our agreements.

After the retention period, your data will be securely deleted or anonymised.

How We Protect Your Data

We use appropriate technical and organizational measures to protect your data, including:

• Data encryption and secure storage;
• Restricted access to authorised personnel only;
• Continuous monitoring for potential security breaches;
• Regular system updates and staff training.

If we become aware of a data breach that may affect your rights or privacy, we will notify you and the relevant authorities as required by law.

Use of Cookies and Tracking Technologies

What are cookies?

Cookies are small text files placed on your device when you visit our website or use our mobile app. They help us recognise your device, store preferences, and improve your browsing experience.

Types of cookies we use

• Essential cookies: Enable basic site functionality such as login and navigation.
• Analytical cookies: Help us understand how users interact with our Platform.
• Marketing cookies: Allow us to provide personalised offers and measure campaign effectiveness.

Managing cookies

You can manage or disable cookies through your browser settings. However, disabling essential cookies may affect the proper functioning of our Platform.

Artificial Intelligence and Automated Processing

Lily Lanka may use artificial intelligence (AI) and automated tools to:

• Detect and prevent fraudulent or suspicious activity;
• Provide personalised recommendations;
• Analyse user preferences and improve services.

These systems are designed to assist our human staff and do not make legally binding decisions about you without human oversight.

Children's Privacy

Our services are not directed toward children under the age of 18.

If we learn that personal data has been collected from a minor without parental consent, we will delete it promptly.

Your Rights

Under applicable law, you may have the right to:

• Access the personal data we hold about you;
• Request correction or deletion of your data;
• Object to or restrict the processing of your data;
• Withdraw your consent at any time (for consent-based processing);
• Request a copy of your data (data portability).

To exercise these rights, please contact us as described below.

We may need to verify your identity before fulfilling your request.

Updates to This Privacy Notice

Lily Lanka may update this Privacy Notice periodically to reflect changes in law, technology, or our business operations. Updated versions will be posted on our website with the date of revision.