Privacy Policy

1. Who we are

The Institute of Hospitality Sri Lanka ("IoH Sri Lanka", "we", "us" or "our") is responsible for deciding how personal data submitted through this website is used. This policy applies to website visitors, members, applicants, event participants, customers and other people who communicate with us.

2. Personal data we collect

Depending on how you interact with us, we may collect:

• identity and contact details, such as name, title, email address, telephone number, postal address, country and date of birth;
• membership, certification, education, employment and professional information;
• application documents, photographs, correspondence, enquiries and event-registration details;
• transaction details, such as the amount, currency, payment status, receipt and limited payment-card details supplied by a payment provider (for example, card type and last four digits);
• technical and usage information, such as IP address, browser/device information, pages visited, referral source and security logs; and
• marketing choices and cookie preferences.

Please do not send card numbers, CVV/security codes, passwords, or unnecessary sensitive personal data by email, WhatsApp, contact forms or uploaded documents.

For membership applications, our Join IoH page provides a downloadable form and asks you to email the completed, signed application to the Secretary and Chairman. Information you send this way, including your signature and supporting documents, is used to handle your application. Downloading the form alone does not submit an application.

3. How and why we use personal data

We use personal data only where we have a lawful purpose and legal basis. These purposes include:

• handling membership, certification, event, training and other service applications;
• taking payment, issuing receipts, maintaining accounting records and preventing fraud;
• responding to enquiries and providing requested services;
• administering member accounts and communicating service or organisational updates;
• protecting our website, users and systems, and investigating misuse;
• meeting legal, regulatory, tax, audit and record-keeping obligations; and
• sending optional marketing where you have consented, or where otherwise permitted by law. You may opt out at any time.

Our legal bases may include taking steps at your request or performing a contract, complying with law, pursuing a legitimate interest that does not override your rights, and consent. We will request explicit consent where the law requires it.

4. Payments and card information

Where a service or event directs you to an online payment provider, that provider handles the payment information you enter. Review the provider's privacy notice at checkout for details about card-data collection and processing. Transaction records needed to administer your registration may include a payment reference, payment status, amount and receipt.

If a payment is refunded, disputed or investigated, we may retain relevant transaction and communication records for accounting, fraud-prevention and legal purposes.

5. Google, Facebook and other service providers

Some pages use or link to third-party services, including Google-hosted fonts or maps, Facebook content, YouTube, WhatsApp and social-media pages. When third-party content loads, the provider may receive technical data such as your IP address, browser details, the page visited and cookie or device identifiers. If you are signed in to that provider, it may associate the visit with your account.

We may also use carefully selected providers for website hosting, email, database support, payment processing, security, analytics, professional membership administration and events. They may process only the data needed for their service and must protect it under their contracts and applicable law. We do not sell personal data.

Third parties control their own platforms. Please review their privacy settings and notices. Following an external link takes you to a site whose privacy practices we do not control.

We may disclose relevant records where required by law, to respond to a valid request from an authority, to resolve a dispute, or to protect the rights and safety of our members, participants and organisation. Any disclosure should be limited to what is necessary for that purpose.

6. International customers and data transfers

Our website links to the Institute of Hospitality's international membership services. If you apply or use services on that organisation's website, its privacy notice also applies. Providers involved in hosting, communications, membership or event services may process information outside Sri Lanka, where privacy laws may differ.

Where we arrange a transfer of your personal data overseas, the safeguards and legal requirements depend on the destination, recipient and applicable law. Contact us if you need information about the recipients or safeguards relevant to your application or transaction.

If you are in a jurisdiction that grants additional privacy rights, including the United Kingdom or European Economic Area, you may contact us to exercise those rights. We will assess the request under the law that applies to the processing.

7. Cookie policy

What are cookies and browser storage?

Cookies are small text files that a website saves on your device. Similar technologies, including local storage, can remember choices between visits. Session cookies usually expire when you close your browser; persistent cookies remain until they expire or you delete them.

Categories in our cookie preferences

• Necessary: storage needed to operate the website and remember your privacy choices. This category stays enabled in our preference controls.
• Analytics: optional measurement tools, where enabled, that help us understand how visitors use our pages. Selecting this category permits analytics integrations managed by our consent system; it does not mean every page uses analytics.
• Marketing and external media: optional third-party content, including YouTube and Facebook embeds managed by our consent system. Allowing this category lets those providers load their content and may allow them to use their own cookies or identifiers.

How we remember your decision

Our preference tool saves a record called ioh_cookie_consent in your browser's local storage. It contains your category choices, the date of your decision and the preference version. This record has no automatic expiry in the current implementation and remains until you clear site data, change your choice or the website replaces it. It is specific to the browser and device you use.

Manage or withdraw your preferences

Use Accept All, Reject or Manage cookies in the cookie banner. You can reopen the controls below or through Cookie Settings in the footer. Analytics and marketing categories are off until you allow them. Saving a withdrawal may reload the page to stop optional content that was already running.

Manage cookies

You can also use your browser's privacy settings to block cookies or delete cookies and site storage. Deleting our preference record means you may be asked again on your next visit. Blocking storage may prevent your choices from being remembered, and rejecting external media can leave videos or social content unavailable until you permit it.

Third-party cookies and personal data

External providers may receive your IP address and device information when their resources load. Our pages also request resources such as hosted fonts and stylesheets; the optional-media controls do not prevent every third-party network request. Provider-specific storage and retention are governed by their own notices. See the Google privacy policy (including YouTube) and the Meta privacy policy for Facebook.

Changing our preferences does not automatically erase cookies already set by another provider or information it has already received. Use your browser's site-data controls and the provider's privacy settings for those records. For personal data held by IoH Sri Lanka, use the privacy contact below.

These preference controls apply to this website. Separate services, including the Vision 2030 registration platform and the Institute of Hospitality's international website, may use different storage, tracking tools and consent controls. Check the notices and settings on those services when you visit them.

8. Communications and unsubscribe

We may contact you about an application, membership renewal, certification, event booking or payment you have requested. Optional newsletters and promotional messages are separate from these service communications.

To stop optional marketing, follow the unsubscribe instructions in the message or email secretary@ihsrilanka.lk with your request. Cookie preferences do not change your email subscription choices. We may still send communications needed to administer an existing booking, membership or transaction.

Please do not use our forms or contact channels to send spam or share another person's private contact details without appropriate authorisation.

9. Retention and security

We retain personal data only for as long as it is reasonably needed for the purpose collected, our relationship with you, and applicable legal, tax, accounting, dispute-resolution and safeguarding requirements. We then delete, anonymise or securely archive it.

We use proportionate administrative, organisational and technical safeguards, such as access controls, secure connections, limited staff access, backups and service-provider checks. No internet transmission or storage system can be guaranteed completely secure. Please contact us promptly if you believe your data or account has been compromised.

10. Your choices and rights

Subject to applicable law and limited exceptions, you may ask us to:

• confirm whether we process your personal data and provide access to it;
• correct inaccurate or incomplete data;
• erase data or restrict/stop particular processing;
• withdraw consent without affecting processing already lawfully completed;
• object to direct marketing or certain legitimate-interest processing;
• provide portable data where the law grants that right; or
• review a decision made solely by automated means, where relevant.

We may need to verify your identity before responding. You may also complain to the Data Protection Authority of Sri Lanka or another competent supervisory authority in your country.

11. Children and policy changes

Our services are generally intended for adults and professionals. If an application involves a child, we will seek consent or authorisation from a parent or guardian where required and limit collection to what is necessary.

We may update this policy when our services, providers or legal obligations change. The latest version will be posted here with a revised date. Material changes may also be communicated through an appropriate additional notice.