Privacy Policy
Thank you for your interest in the Thaulle Pure Ayurveda Resort. Protecting your personal data matters to us. On this page we explain in plain language which data we collect when you visit this website, what we use it for and what rights you have.
Our website is aimed among others at guests from Germany, Austria and Switzerland. We therefore apply the General Data Protection Regulation of the European Union (GDPR), even though our business is based in Sri Lanka.
1. Who is responsible for processing your data?
The controller within the meaning of the GDPR is:
Thaulle Pure Ayurveda Resort
Owner: Thilak Wettimuni
No. 35, Mahadeira, Yodakandiya
Tissamaharama 82600, Southern Province, Sri Lanka
Telephone: +94 47 2237 901
E-mail: reservations@thaulle-ayurveda.com
You can reach us at this address with any questions about data protection. We have not appointed a data protection officer, because the legal requirements for doing so do not apply to us.
2. Your rights at a glance
You have the right at any time
- to request information about which data we hold about you (Art. 15 GDPR),
- to request the rectification of inaccurate data (Art. 16 GDPR),
- to request the erasure of your data (Art. 17 GDPR),
- to request the restriction of processing (Art. 18 GDPR),
- to receive your data in a transferable format (data portability, Art. 20 GDPR),
- to object to processing that we base on a legitimate interest (Art. 21 GDPR),
- to withdraw consent you have given at any time (Art. 7(3) GDPR). Withdrawal takes effect for the future; the lawfulness of processing carried out up to that point remains unaffected.
An informal e-mail to the address given above is sufficient.
You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — the competent authority is the one at your habitual residence, your place of work or the place where you suspect an infringement.
3. When you visit our website
Each time you open a page, your browser transmits technically necessary data to our server. This data is stored in what are known as server log files:
- your IP address
- the date and time of access
- the page requested and the volume of data transferred
- the page previously visited (referrer)
- browser type, browser version and operating system
We need this data to deliver the website, to ensure its stability and security and to fend off attacks. The legal basis is our legitimate interest in a secure and functioning web presence (Art. 6(1)(f) GDPR). This data is not merged with other data sources.
Hosting: Our website is operated at Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The servers are located in Germany. Strato processes the data listed above on our behalf; a data processing agreement pursuant to Art. 28 GDPR is in place.
4. Cookies and your consent
Cookies are small text files stored on your device. Some are necessary for the website to work, others are not.
Technically necessary storage that we carry out without your consent (Section 25(2) TDDDG):
| Name | Purpose | Storage period |
|---|---|---|
wp-wpml_current_language | remembers the language you selected | session (ends when you close your browser) |
borlabs-cookie | stores which consents you have given or refused | 60 days |
mwai_gdpr_accepted | remembers your consent to using the advisory assistant | 1 year |
Services requiring consent are only loaded after you have agreed in the consent dialogue. To manage your consent we use Borlabs Cookie (Borlabs GmbH, Germany). The tool works exclusively on our own server; it does not transmit any data to third parties.
You can change your decision at any time — via the “Change consent” link at the bottom of every page.
5. Google Analytics 4
With your consent we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use it to understand which content on our website is in demand, so that we can improve it.
The data processed includes in particular: a shortened IP address, a randomly assigned identifier for your browser, the pages you visit, time spent, the source you came from, and technical details about your device and browser.
The following cookies are set:
| Name | Purpose | Storage period |
|---|---|---|
_ga | distinguishes visitors | around 13 months |
_ga_28J5MLWFY1 | maintains the session state | around 13 months |
The legal basis is solely your consent (Art. 6(1)(a) GDPR). Without your agreement the service is not loaded.
Transfer to the USA: Google may transfer data to Google LLC in the United States. Google LLC is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition. Despite these safeguards, it cannot be entirely ruled out that US authorities may access the data. By giving your consent you expressly agree to this transfer (Art. 49(1)(a) GDPR).
Further information: Google’s privacy policy
6. Google Maps — map loads only on click
On pages with directions we embed map material from Google Maps (Google Ireland Limited, Ireland).
The map does not load automatically. At first you only see a preview image that comes from our own server. Only when you click “Load map” is a connection to Google established. Your IP address and technical details about your device are then transmitted to Google, possibly to the USA.
The legal basis is your consent, which you give by clicking the button (Art. 6(1)(a) GDPR, and for the transfer additionally Art. 49(1)(a) GDPR). If you do not click, no transfer takes place.
The preview image is based on map data from OpenStreetMap (© OpenStreetMap contributors, ODbL) and is delivered from our server.
7. YouTube videos — video loads only on click
On some pages we show videos hosted on YouTube (Google Ireland Limited, Ireland).
Here too nothing loads automatically: at first you see a preview image. Only when you click is the video loaded — and then in extended privacy mode via youtube-nocookie.com. In this mode YouTube does not set any advertising cookies as long as you do not play the video. From the moment you click, your IP address and technical device data are transmitted to Google, possibly to the USA.
The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR, Art. 49(1)(a) GDPR).
8. Profile pictures (Gravatar)
On individual pages with posts we embed profile pictures via the Gravatar service of Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA. Your IP address is transmitted to Automattic in the process. The legal basis is your consent (Art. 6(1)(a) GDPR).
9. Our advisory assistant “Amara”
On our inquiry page, Amara is available to you — a text-based assistant that answers your questions about the cure and takes down your inquiry. Amara works with an AI language model.
Before you can use the assistant, we ask for your express consent. Without that consent no processing takes place.
Which data is processed: everything you enter into the chat. As a rule this is your name, your e-mail address, your travel period and the number of travellers — and often also information about your state of health, such as complaints or reasons for taking an Ayurveda cure.
Health data is specially protected. We process such information exclusively on the basis of your express consent (Art. 9(2)(a) GDPR). You are not obliged to provide health information — you can also make an inquiry without it, or contact us by telephone or e-mail instead.
Where your entries go: in order to generate the answers, our server transmits your entries to Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA. This transmission takes place from our server; your browser does not establish any connection to Anthropic. Anthropic processes the content as a processor on our behalf and does not use it to train its models. A data processing agreement is in place; the transfer to the USA is safeguarded by standard contractual clauses, supplemented by your express consent (Art. 49(1)(a) GDPR).
What is stored: we do not store the transcript of your conversation in our database. When you complete an inquiry, we send a summary of your details including the course of the conversation by e-mail to our reservations department (reservations@thaulle-ayurveda.com) so that we can prepare an offer for you. The legal basis for this is the initiation of the contractual relationship (Art. 6(1)(b) GDPR), and for the health information your express consent (Art. 9(2)(a) GDPR).
Usage statistics: for technical monitoring and cost control of the assistant we store one record per request containing a shortened IP address, a session identifier, the time and the number of characters processed. No content is stored in the process. The legal basis is our legitimate interest in secure and economical operation (Art. 6(1)(f) GDPR). We delete these records after 90 days.
No medical advice, no automated decision-making: Amara does not make diagnoses and does not replace a consultation with a doctor. A human being always decides on your inquiry. No automated decision-making with legal effect within the meaning of Art. 22 GDPR takes place.
10. Inquiries by e-mail or telephone
If you contact us by e-mail or telephone, we process the information you provide in order to deal with your request. The legal basis is the initiation or performance of a contract (Art. 6(1)(b) GDPR), and otherwise our legitimate interest in answering your inquiry (Art. 6(1)(f) GDPR).
Our e-mail accounts are operated by Strato AG in Germany. Please note that unencrypted e-mails can be read by third parties in transit. For confidential information — in particular about your health — we are happy to offer you a telephone conversation instead.
11. How long we store your data
| Data | Storage period |
|---|---|
| Server log files | as a rule a few days |
| Usage statistics of the advisory assistant | 90 days |
| Inquiries and related correspondence | until fully processed, then until statutory retention periods expire |
| Analytics data in Google Analytics | 14 months |
| Records of consent | up to 3 years, as evidence towards supervisory authorities |
Beyond that, we delete your data as soon as the purpose of the processing no longer applies and no statutory retention obligation stands in the way.
12. Recipients of your data
We only pass on your data where this is necessary for the purposes described. The recipients are:
- Strato AG, Germany — hosting of the website and operation of the e-mail accounts
- Anthropic PBC, USA — processing of chat entries in order to generate the answers
- Google Ireland Limited, Ireland — only where consent has been given (analytics, maps, videos)
- Tour operators, if you book through one — in that case as part of performing the contract
We do not pass data on to third parties for advertising purposes. We do not sell data.
13. Security
This website is transmitted exclusively in encrypted form (TLS/HTTPS). You can recognise this by the padlock symbol in your browser’s address bar. Fonts and images are delivered from our own server; no connection is made to external font services.
14. Changes to this privacy policy
We adapt this policy when the legal situation or our website changes. The version available here applies in each case.
Last updated: 23 August 2026