privacy policies

Who we are

Flowground Pvt Ltd (“flowground”, “we”, “us”) operates the property at 46A1 Keraminiyawatta, Karandugoda, 80650 Ahangama, Sri Lanka, and is the controller of the personal data described in this policy.

Questions, or to exercise any of your rights: [email protected]

What we collect

From everyone who books: name, email address, telephone number, postal and billing address, booking dates and room preferences, payment and invoicing details, and our correspondence with you.

Before and during your stay: flight and arrival details where you ask us to arrange transport, emergency contact details, identity document details required for guest registration, and dietary requirements or allergies.

From retreat leaders: business and invoicing details, and the participant information you enter into the shared Retreat Planner. If you provide us with details about your participants, you are responsible for having told them so and for having a lawful basis to share it.

Automatically: limited technical data when you use our website and online check-in form.

Health and dietary information

Dietary requirements and allergies can reveal information about your health, which data protection law treats as a special category requiring extra protection. We collect it only so that our kitchen can cater for you safely, we ask for it on the basis of your explicit consent, and you may decline to provide it — though we may then be unable to guarantee suitable meals. It is shared only with our kitchen and hosting team.

Why we use your data, and on what basis

Purpose	Lawful basis
Managing your booking, invoicing, arranging transport and room allocation	Performance of our contract with you
Guest registration and retention of financial records	Compliance with a legal obligation
Catering for dietary requirements and allergies	Your explicit consent
Responding to enquiries, resolving issues, securing the property	Our legitimate interests
Inviting previous retreat leaders to book again, and other marketing	Your consent, which you may withdraw at any time

Who we share it with

We use third-party service providers to run our business. These currently include:

Zoho (Mail, Invoice, Sign) — correspondence, invoicing and booking agreements
Google Workspace (Drive, Sheets, Forms, Calendar) — booking records, signed contracts and planning documents
Notion — retreat planning notes and our internal booking records
Tally — online enquiry and booking forms
ZAPIER — connecting the systems above
WhatsApp (Meta) — messaging with guests and retreat leaders
Stripe — card payment processing
Bluehost — our website and online check-in forms
Airbnb — where you book through that platform
Google Analytics and Meta — website measurement and advertising, used only with your consent

We also share what is necessary with independent local providers who deliver services you request — for example airport transfer drivers and massage therapists — and with public authorities where we are legally required to do so.

We do not sell your personal data.

Cookies and website measurement

Our website uses cookies and similar technologies for measurement and advertising, including Google Analytics and Meta advertising tools. These are set only where you consent, and you may withdraw consent at any time through the cookie settings on our website.

International transfers

We operate from Sri Lanka and contract through an entity in the United Arab Emirates. Neither country has been granted an adequacy decision by the European Commission, so personal data you provide is handled outside the European Economic Area.

Where you provide information to us directly — for example by making an enquiry, completing a booking, or filling in our check-in form — you send that information to us on your own initiative.

Where we transfer personal data to the service providers listed above, we rely on the standard contractual clauses approved by the European Commission, incorporated into our agreements with those providers. You may request further detail using the contact address above.

How long we keep it

Booking and financial records: 2 years, as required for tax and accounting purposes
Identity and registration data: deleted once the registration obligation has been met
Dietary and emergency contact details: deleted after departure
Marketing contacts: until you withdraw consent

Your rights

You have the right to access the personal data we hold about you, to have inaccurate data corrected, to have your data erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time where we rely on consent. Withdrawing consent does not affect processing carried out beforehand.

To exercise any of these rights, contact us at [email protected]. We will respond within one month.

If you are in the EEA or UK and believe we have handled your data improperly, you have the right to complain to your national data protection authority.