Privacy Policy

1. Introduction

This privacy notice for Sen Sutra Ltd (company number 16922312), registered in England and Wales, trading as Sen Wellness Sanctuary, describes how and why we collect, store, use, and share your personal information when you use our services — including when you visit our website, make an enquiry or booking, attend our sanctuary in Sri Lanka, or receive health consultations and wellness programmes from us.

Why UK GDPR and EU GDPR apply to us

Sen Sutra Ltd is incorporated in England and Wales. UK GDPR (Data Protection Act 2018) applies directly to us. EU GDPR (Regulation 2016/679) also applies under its extraterritorial scope (Article 3(2)) because we actively offer services to guests based in the European Economic Area (EEA). Our website servers are located in the United Kingdom, which holds EU adequacy status (EC Decision 2021/1772).

Governing law

This policy is governed by the laws of England and Wales. UK GDPR (Data Protection Act 2018) and EU GDPR (Regulation 2016/679) apply to their respective scopes. Our Sri Lankan operations are additionally subject to the Sri Lanka Personal Data Protection Act No. 9 of 2022 (PDPA).

Questions? Contact us at [email protected] or +94 77 390 4800.

1. What information do we collect?

1.1  Information you give us directly

• Full name, email address, phone number, and postal address
• Billing address and payment details (settled by direct bank transfer or on-site cash/card payment — we do not store payment card details)
• Retreat booking details, dietary preferences, and special requirements
• Passport or identity document details where required
• Emergency contact name and telephone number
• Records of communications — emails, enquiry forms, and call notes
• Feedback, reviews, or survey responses you choose to provide

1.2  Health and special category data

Important:  We process health data. Your explicit written consent is required before any health information is collected.

Because we provide Ayurvedic medical consultations, Panchakarma programmes, and personalised treatment plans, we collect health information about guests. Health data is special category data under Article 9 of both UK GDPR and EU GDPR and is subject to stricter rules. We only process health data with your explicit written consent, obtained before or at your first consultation. You may withdraw consent at any time by emailing [email protected]. Withdrawal must be recorded on your intake file and communicated to your treating doctor.

• Medical history, current health conditions, and medications
• Dietary requirements, food allergies, and intolerances with health implications
• Physical limitations or contraindications relevant to treatment or yoga practice
• Treatment notes, progress records, and clinical observations during your stay
• Any other health information you share with our doctors or therapists

1.3  Who handles your data — access by role

All staff with access to personal data receive data protection and confidentiality training, reviewed annually.

1.4  Information collected automatically

When you visit our website, we automatically collect technical data including IP address, browser type, device type, pages visited, and visit timestamps. We also collect data through cookies — see Section 5.

1.5  What happens if you choose not to provide information?

• Without contact or booking details, we cannot process your reservation.
• Without health information, our doctors may be unable to design a safe treatment plan. Some programmes — particularly Panchakarma — cannot be safely delivered without this information.
• Without dietary or allergy information, we may be unable to accommodate your needs safely.

We will always tell you at the point of collection whether information is required or optional.

2. How do we process your information?

• To respond to enquiries and provide customer support
• To process bookings, administer your retreat, and arrange payment
• To safely deliver health consultations, Ayurvedic treatments, and wellness programmes
• To send important administrative information about your booking or our policies
• To send marketing communications — only where you have given prior consent
• To improve our services through analysis of website and programme usage
• To protect our website and services from fraud and security threats
• To comply with applicable legal and regulatory obligations under UK, EU, and Sri Lankan law

3. What legal bases do we rely on?

3.1  For ordinary personal data (Article 6)

• Consent (Art. 6(1)(a)) — Email marketing, non-essential cookies. You may withdraw at any time.
• Performance of a contract (Art. 6(1)(b)) — Managing your booking and delivering your stay.
• Legitimate interests (Art. 6(1)(f)) — Website security, service improvement, guest communications.
• Legal obligation (Art. 6(1)(c)) — Financial records, healthcare records, employment law compliance.

3.2  For health and special category data (Article 9)

• Explicit consent (Art. 9(2)(a)) — Written consent obtained before or at first consultation.
• Healthcare provision (Art. 9(2)(h)) — Processing necessary for the provision of healthcare and treatment.
• Vital interests (Art. 9(2)(c)) — In a genuine medical emergency to protect your life.

3.3  Withdrawing consent

You may withdraw any consent at any time, without penalty, by emailing [email protected]. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Withdrawal of health data consent will be recorded on your clinical file.

4. With whom do we share your information?

Health data:  Special category health data is handled exclusively within the Sen Wellness Sanctuary team and is never shared with any external third party, except in a genuine medical emergency.

4.1  Breath of Life Lanka Ltd — Sri Lankan processor

Breath of Life Lanka Ltd (PV 87421), our Sri Lankan operational entity, employs all doctors, sanctuary managers, therapists, yoga teachers, and administrative staff who deliver your retreat. They process personal data on behalf of Sen Sutra Ltd under a formal Data Processing Agreement. Breath of Life Lanka Ltd acts solely as a data processor and does not determine the purposes or means of processing independently. Website analytics, payroll processing, and internal administration are all handled within Breath of Life Lanka Ltd as part of this arrangement.

4.2  Third-party service providers

For general personal data (not health data), we use the following external providers under written Data Processing Agreements:

Internally managed:  Website analytics (Google Analytics), payroll processing, and general administrative data processing are handled internally by Breath of Life Lanka Ltd staff as part of their role as data processor — no external third-party provider is used for these functions.

4.3  Business transfers and legal requirements

In the event of a merger, acquisition, or restructuring of Sen Sutra Ltd, personal data may be transferred as part of that transaction and you will be notified in advance. We may also disclose data to law enforcement or regulatory authorities where required by law.

5. Cookies and tracking technologies

We use cookies and similar technologies on our website. A consent banner appears on your first visit, allowing you to accept or decline non-essential cookies. Essential cookies required for the website to function do not require consent. Website analytics are managed internally using Google Analytics, accessed by Breath of Life Lanka Ltd staff. Full details are in our Cookie Policy at senwellnesssanctuary.com/cookie-policy.

6. Where is your data stored and transferred?

6.1  Data storage — United Kingdom servers

Personal data collected through our website and booking systems is stored on servers provided by Hostinger, located in the United Kingdom. The UK holds EU adequacy status (EC Decision 2021/1772), so transfers of EU personal data to our UK servers are lawful without additional safeguards.

6.2  Data processed in Sri Lanka by Breath of Life Lanka Ltd

Breath of Life Lanka Ltd, our Sri Lankan processor, employs the staff who deliver your retreat and access personal data to do so. Sri Lanka does not currently hold a UK or EU adequacy decision. Accordingly:

• EU guests: Data access by Breath of Life Lanka Ltd is governed by the European Commission’s Standard Contractual Clauses (SCCs, Decision 2021/914). A copy is available on request.
• UK guests: Data access by Breath of Life Lanka Ltd is governed by the UK International Data Transfer Agreement (IDTA). A copy is available on request.

Breath of Life Lanka Ltd also complies with the Sri Lanka Personal Data Protection Act No. 9 of 2022 (PDPA) in respect of its processing operations within Sri Lanka.

6.3  Third-party providers outside the EEA/UK

Zoho CRM and Mailchimp may store data on servers outside the EEA or UK. Both providers maintain EU GDPR-compliant data transfer mechanisms (including SCCs). To request copies of applicable transfer documents, email [email protected].

7. How long do we keep your information?

When data is no longer required, we securely delete or anonymise it.

8. How do we keep your information safe?

• SSL/TLS encryption for all data transmitted via our website (Hostinger)
• Encrypted storage for health and sensitive personal data
• Role-based access controls — staff access only the data needed for their role
• Regular data protection and confidentiality training for all staff with data access
• Secure disposal procedures for paper records containing personal information
• Written Data Processing Agreements with all third-party processors
• A Record of Processing Activities (ROPA) documenting all internal data flows, reviewed annually
• No card or payment data is stored — payments are made by direct bank transfer or on-site

No electronic transmission or storage is 100% secure. While we take all reasonable precautions, we cannot guarantee absolute security.

9. Data breaches

In the event of a personal data breach, we will:

• Assess the likely risk to the rights and freedoms of affected individuals
• Notify the ICO within 72 hours where required — Article 33 UK GDPR
• Notify the relevant EU supervisory authority within 72 hours where required — Article 33 EU GDPR
• Notify affected individuals directly and without undue delay where there is high risk — Article 34 UK/EU GDPR
• Document all breaches in our internal breach register, retained for 5 years

Note: Sen Sutra Ltd has had no reportable data breaches in the last three years. Any breach involving health data is treated as the highest priority. Contact [email protected] immediately if you believe your data has been compromised.

10. Minors

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that we have done so, we will delete the data promptly. Contact [email protected] with any concerns.

11. Your privacy rights

Under UK GDPR and EU GDPR you have the following rights. We will respond within one calendar month (extendable by two months for complex requests, with notice). There is no charge in most circumstances.

To exercise any right, email [email protected]. We may ask you to verify your identity before fulfilling a request.

12. Automated decision-making and profiling

We do not use any automated decision-making or profiling in relation to your personal data. All decisions relating to your health treatment plan, retreat programme, and personal care are made by our qualified doctors and sanctuary staff. If this changes in future, we will notify you before changes take effect, in accordance with Article 22 UK/EU GDPR.

13. Intellectual property

All content on the Sen Wellness Sanctuary website — including text, images, photographs, videos, logos, brand names, and design elements — is the intellectual property of Sen Sutra Ltd or its licensors and is protected by UK copyright law (Copyright, Designs and Patents Act 1988), EU copyright directives, and international intellectual property conventions.

The Sen Wellness Sanctuary name, logo, and brand identity are the property of Sen Sutra Ltd. Nothing in your use of this website or our services transfers any intellectual property rights to you.

• You may view and print content from this website for personal, non-commercial use only.
• You may not reproduce, distribute, modify, create derivative works from, publicly display, or commercially exploit any content without the prior written consent of Sen Sutra Ltd.
• Guest-submitted content (reviews, feedback, photographs shared with us) may be used by Sen Sutra Ltd for marketing purposes, subject to your consent at the time of submission.
• Unauthorised use of our intellectual property may give rise to a claim for damages and/or be a criminal offence under the Copyright, Designs and Patents Act 1988.

To request permission to use our content, or to report an intellectual property concern, contact [email protected].

14. Do-Not-Track signals

Most web browsers include a Do-Not-Track (‘DNT’) setting. No legally binding uniform standard for recognising DNT signals currently exists. We do not currently respond to DNT signals. If such a standard is adopted, we will update this notice.

15. Contact, representatives & supervisory authorities

15.1  Data Controller — Sen Sutra Ltd

15.2  UK Contact Person

The UK contact for data protection matters is Sameera Kankanamge (Director), reachable at [email protected]. Per the DataRep questionnaire dated 05/06/2026, Sen Sutra Ltd has elected not to appoint DataRep as UK representative. UK residents and the ICO should contact Sen Sutra Ltd directly at the registered address above.

15.3  EU Representative (Article 27 EU GDPR)

Sen Sutra Ltd has appointed Data Protection Representative Limited (trading as DataRep) as its Data Protection Representative in the European Union for the purposes of EU GDPR (Regulation 2016/679). This appointment is effective as of June 2026 and covers all 27 EU member states plus Norway and Iceland in the European Economic Area.

EU residents who wish to raise a question with Sen Wellness Sanctuary, or exercise their data protection rights under GDPR, may contact DataRep directly:

EU Representative: Data Protection Representative Limited (trading as DataRep) Registered address: The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland Registered in Ireland: Company number 616588 Email: [email protected] Web form: www.datarep.com/data-request Website: www.datarep.com

Important – when contacting DataRep: Please quote “Sen Wellness Sanctuary” in the subject line of any email or written correspondence. If contacting by post, ensure your letter is addressed to DataRep and not to Sen Wellness Sanctuary, or your enquiry may not be directed to the correct team. Sen Wellness Sanctuary may request evidence of your identity before fulfilling any data subject request, to ensure your personal data is not disclosed to anyone other than you.

For further information on your rights under EU GDPR, please refer to the European Commission at https://ec.europa.eu/info/law/law-topic/data-protection or the national Data Protection Authority in your country.

15.4  Sri Lankan processor — Breath of Life Lanka Ltd

15.5  Supervisory authorities

16. Updates to this policy

We may update this notice from time to time. The ‘last updated’ date at the top always reflects the most recent revision. If we make material changes — particularly to how we process health data, who we share information with, or our legal bases — we will notify you by email or via a prominent notice on our website before changes take effect.

Please review this policy periodically at senwellnesssanctuary.com/privacy-policy.