Privacy Policy

Effective date: 1 June 2026

CoNomad (“CoNomad,” “we,” “us,” or “our”) is a brand operated by DBI Hotels in Sri Lanka. This Privacy Policy explains how we collect, use, share, and protect your personal information when you visit conomad.lk, apply to join our community, purchase an Island Nomad Pass or add-ons, or otherwise interact with us.

By using our website or submitting your information to us, you agree to the practices described in this policy.

Note: This policy refers to the Island Nomad Pass and related services offered in partnership with Mastercard and delivered across DBI Hotels properties in Sri Lanka.

1. Who we are

CoNomad is operated by DBI Hotels, a curated network of properties across Sri Lanka.

• Trading name: CoNomad (a DBI Hotels brand)
• Registered entity: DBI Ceylon (Pvt) Ltd
• Registered address: 56/3, Koswatta Cross Road, Nawala, Sri Lanka
• Email: hello@conomad.lk
• WhatsApp: +94 70 722 2999

For privacy-related questions or requests, please contact us using the details in the “Contact us” section below.

2. Information we collect

We collect information in the following ways:

a. Information you give us directly

When you complete a form on our site (for example “Start Your Island Journey” or “Apply to join”), or when you buy a pass, we may collect:

• Full name
• Email address
• WhatsApp / phone number
• Country or location you are travelling from
• The purpose of your trip (e.g. remote work, surf & adventure, wellness, slow travel, community & networking)
• Planned length of stay
• Destinations you are interested in
• Any details you share about your ideal Sri Lanka experience
• Your marketing preferences (whether you opt in to offers, events, and travel inspiration)

b. Payment and transaction information

When you purchase an Island Pass or add-on, payment is handled by our third-party payment provider [INSERT PAYMENT PROCESSOR, e.g. Stripe / PayHere / Mastercard Gateway]. We do not store your full card number or security code on our servers. We may retain limited transaction records such as order details, amount, date, and a payment confirmation reference.

c. Information collected automatically

When you browse conomad.lk, we and our service providers may automatically collect:

• IP address and approximate location
• Browser type, device type, and operating system
• Pages visited, time spent, and referring website
• Cookie and similar tracking identifiers (see the Cookies section)

3. How we use your information

We use your information to:

• Respond to your enquiry and process your application to join the community
• Sell, issue, and manage your Island Nomad Pass and any add-ons
• Coordinate your stays and experiences across DBI Hotels properties
• Process payments and keep transaction records
• Send you service messages (booking confirmations, pass details, important updates)
• Send marketing communications only where you have opted in
• Improve our website, services, and customer experience
• Detect, prevent, and address fraud, security issues, and misuse
• Comply with our legal and regulatory obligations

4. Legal bases for processing

Where applicable law (such as the Sri Lanka Personal Data Protection Act No. 9 of 2022, or the EU/UK GDPR for visitors from those regions) requires a legal basis, we rely on one or more of the following:

• Performance of a contract — to deliver the pass and services you purchase
• Consent — for marketing communications and non-essential cookies
• Legitimate interests — to operate, secure, and improve our business
• Legal obligation — to meet tax, accounting, and regulatory requirements

You may withdraw consent at any time where consent is the basis for processing.

5. How we share your information

We do not sell your personal information. We may share it with:

• DBI Hotels and partner properties in Sri Lanka, to fulfil your stays and experiences
• Mastercard, in connection with the Mastercard-powered programme and associated benefits, in line with applicable agreements
• Payment processors, to complete your transactions securely
• Service providers who support us (hosting, email, analytics, customer communication, marketing tools)
• Authorities or third parties where required by law, regulation, or to protect our legal rights

We require third parties to handle your information securely and only for the purposes we specify.

6. International data transfers

CoNomad operates in Sri Lanka, but our visitors and some of our service providers are located in other countries. Your information may therefore be transferred to and processed outside your country of residence. Where required, we take appropriate steps to ensure your information remains protected in line with applicable data protection laws.

7. Cookies and tracking

Our website uses cookies and similar technologies to make the site work, remember your preferences, understand how the site is used, and (where you allow it) support marketing. Cookies we use may include:

• Essential cookies — required for the site, cart, and checkout to function
• Analytics cookies — to understand site usage and improve performance
• Marketing cookies — to deliver and measure relevant communications

You can control or disable cookies through your browser settings. Disabling some cookies may affect how the site works. [If you add a cookie banner / consent tool, reference it here.]

8. Data retention

We keep your personal information only for as long as necessary to fulfil the purposes described in this policy, including to provide our services, meet legal and accounting obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we securely delete or anonymise it.

9. How we protect your information

We use reasonable technical and organisational measures to protect your information, including encryption of data in transit (HTTPS/SSL), access controls, and secure payment processing through trusted providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to respond promptly to any incident.

10. Your rights

Depending on your location and applicable law, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your information
• Object to or restrict certain processing
• Withdraw consent (e.g. unsubscribe from marketing)
• Request a copy of your information in a portable format
• Lodge a complaint with the relevant data protection authority

To exercise any of these rights, contact us using the details below. We may need to verify your identity before responding. You can unsubscribe from marketing emails at any time using the link in those emails.

11. Children’s privacy

Our website and services are intended for adults. We do not knowingly collect personal information from children under [INSERT AGE, e.g. 16]. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

12. Third-party links

Our website and communications may contain links to third-party sites (for example DBI Hotels, Mastercard, or social media). We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy policies.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Effective date” at the top of this page and, where appropriate, notify you. We encourage you to review this policy periodically.

14. Contact us

If you have any questions, requests, or concerns about this Privacy Policy or your personal information, contact us at:

CoNomad — a DBI Hotels brand Operated by DBI Ceylon (Pvt) Ltd Email: hello@conomad.lk WhatsApp: +94 70 722 2999 Address: 56/3, Koswatta Cross Road, Nawala, Sri Lanka

© 2026 CoNomad · A DBI Hotels brand · Sri Lanka