Privacy notice
This notice explains how Uga Resorts ("Uga", "we") uses personal data in Uga Lens, our content library for the travel trade, press and partners. We are the controller of this data. Contact our privacy lead at dit@ugaresorts.com.
What we collect
- Account details you give us: name, work email, organisation, job title, country, phone, website and trade ID.
- Sign-in and security data: password (stored only as a one-way hash), two-step verification settings, sign-in times, the IP address of your last sign-in and a security audit trail.
- Usage data: which content you view, search for and download, and which properties you follow. Analytics keep only a shortened IP address (the last part removed).
- Showcase visitors: if you open a showcase that asks for it, your name, email and organisation, plus a shortened IP address and browser type.
- Your choices: the version of these terms you accepted and your email preferences, with the date.
We do not collect payment details or special-category data. Images in the library may show people; we publish those externally only when a model release is on file.
Why we use it, and our legal basis
- To verify that you are a travel professional, journalist or partner and run your account — contract (providing the service you asked for).
- To keep the service and content secure, prevent misuse and keep audit records — legitimate interests in protecting our systems and brand.
- To show properties which content performs and which advisors engage, so we can support your sales — legitimate interests. You can object at any time.
- To send content digests and offers — consent, which you can withdraw in your account at any time.
- To meet legal obligations — legal obligation.
This applies the EU and UK GDPR where they cover you, and Sri Lanka's Personal Data Protection Act No. 9 of 2022 (as amended).
Who sees it
- Uga Resorts team members who manage the library and the properties whose content you engage with.
- Our service providers, under contract and only on our instructions: hosting (our server provider), email delivery and, if enabled, an AI service that tags images. We never send your personal data to the AI service.
- Authorities, only where the law requires.
We do not sell personal data or share it for others' advertising.
International transfers
Uga Lens is hosted on servers that may be outside your country. Where data leaves the EU/UK or Sri Lanka we rely on appropriate safeguards such as standard contractual clauses, or another lawful ground.
How long we keep it
- Accounts: while active. Accounts unused for 24 months are anonymised after a reminder.
- Usage analytics: 25 months.
- Showcase visitor records: 24 months.
- Unconfirmed sign-up requests: 30 days.
- Security audit records: up to 7 years, to protect the integrity of our records.
Your rights
You can ask to access, correct or delete your data, object to processing, restrict it, take a copy (portability) or withdraw consent. Most of this is self-service under My account & privacy: download your data, change preferences or request deletion. Otherwise email dit@ugaresorts.com. We reply within one month. You may also complain to your data protection authority — in Sri Lanka the Data Protection Authority, in the UK the ICO, or in the EU your local supervisory authority.
Security
Encrypted connections (HTTPS), hashed passwords, optional two-step verification (required for administrators), role-based access, signed expiring file links, rate limiting, a tamper-evident audit log and daily backups.
Cookies
We use one essential session cookie and no tracking or advertising cookies. See the Cookie notice.
Changes
We will tell you about material changes and ask you to accept them when you next sign in.