Privacy Policy

Bond & Beyond Holdings (“Bond & Beyond”, “we”, “us” or “our”) operates this website and the services described on it across our five practices: Travel & Tourism, Professional Education, Business Process Outsourcing (BPO), Consultancy & Taxation, and the B&B Intermediary Hub. This policy applies to everyone who visits the site, browses a sector page, submits a form or otherwise gets in touch, whether or not you go on to become a client, student, traveller or candidate.

We have written this in plain language rather than dense legal drafting wherever the two could say the same thing, because a policy nobody reads does not protect anybody. Where we do use a defined legal term, such as under Sri Lanka's Personal Data Protection Act, we say so.

Bond & Beyond Holdings is headquartered in Colombo, Sri Lanka, with a second office opening in Melbourne, Australia. Each of our five practices operates with its own team and its own client relationships, but this website, and the data it collects, is run centrally by the holding group. For data protection purposes, Bond & Beyond Holdings is the controller of the personal information described in this policy.

If you are a student, traveller, candidate or client of one specific practice, that practice's team is who actually handles your information day to day, but the group as a whole remains responsible for how it is protected.

We collect information in three ways: what you give us directly, what our systems collect automatically as you browse, and what we receive from third parties you have chosen to interact with through the site, such as WhatsApp or Google Maps.

Information you give us directly

Most of what we hold about you comes from a form you filled in. The exact fields depend on which one:

Information collected automatically

Like most websites, our hosting provider logs standard technical information for every visit, including your IP address, browser and device type, the pages you view and the page that referred you. We use this only to keep the site running, secure and fast; we do not currently combine it with the form data above to build a profile of you. See Cookies and local storage below for the specific browser storage we use.

Information from third parties

Where our pages embed a third-party service, such as the Google Maps panel on our contact and office pages, that provider may collect information directly from your browser under its own privacy policy. We do not receive a copy of what Google collects through that embed.

Some of the photography on this site, including sector and destination imagery on our practice pages, is AI-generated or AI-enhanced rather than a photograph taken at a real Bond & Beyond office, event or location. We would rather tell you than let an image imply otherwise.

Where a photograph shows a named person, such as a member of our leadership team, or a specific office, that image is genuine. AI and stock imagery is used for illustrative purposes only, for example to represent a sector or a destination in general terms, and should not be relied on as a literal depiction of our premises, staff, students or the exact experience of any service we offer. If an image on this site ever misrepresents something in a way that matters to your decision to work with us, tell us using the contact details below and we will correct it.

AI-generated imagery is a design choice about photography, not a statement about the underlying service. It does not change any of the disclosures elsewhere in this policy or in our Terms of Service.

We use the information described above to:

• Respond to enquiries and correspond with you by email, phone or WhatsApp
• Process bookings, course registrations, LMS access and job applications
• Deliver the specific service you have asked for, whether that is a consultation, a travel package, a training programme or a BPO engagement
• Verify identity and issue certification where a programme requires it
• Meet our own legal, tax and regulatory obligations
• Keep the website secure and working correctly, including basic spam and abuse prevention on our forms

We do not sell personal information, and we do not use the details you give us on a form to build advertising profiles or to serve you targeted ads. We do not currently carry out any automated decision-making that produces a legal or similarly significant effect on you; the honeypot field on our forms is simple spam detection, and does not evaluate anything about a genuine submission.

Our legal basis for processing

Every form on this site, whether it is a general enquiry, a call booking, a sector enquiry, a travel package request, a course registration or a job application, asks you to tick a consent box before you submit it. That consent is our legal basis for storing and using what you send, and we record it with your submission. Where we later process the same information to meet a legal, tax or regulatory obligation, or to perform a contract you have entered into with us, that obligation or contract is the basis for that particular processing rather than your consent.

Consent has to be a real choice to be worth anything. Ticking the box is never pre-selected for you, we do not accept a submission without it, and you can withdraw it afterwards by emailing us, which is covered under Your rights and choices below. Withdrawing consent does not affect anything we did lawfully before you withdrew it.

We use a small amount of storage in your browser to keep the site working. Today that is limited to what is described below; we do not run analytics or advertising cookies.

Neither of these identifies you personally, and neither is shared with a third party. If we introduce analytics, advertising or other non-essential cookies in future, we will update this section and the cookie notice will offer a genuine choice rather than a single acknowledgement. You can change your existing choice at any time using “Cookie Preferences” in the site footer, or by clearing your browser's local storage for this site.

Some pages embed third-party content, in particular Google Maps. Google may set its own cookies when that embed loads, governed by Google's Privacy Policy, not this one.

We share personal information only in the following circumstances:

• Within Bond & Beyond: with the practice team your enquiry, booking or application actually concerns, so a named person can respond to it
• Service providers: with hosting, email and, once in use, CRM providers who process data on our behalf under contract, strictly to help us run the site and respond to you
• Professional advisers: with our auditors, lawyers or accountants where reasonably necessary
• Legal and regulatory bodies: where we are required to by law, by a court, or by a competent regulator
• Business transfers: if part of Bond & Beyond were to merge, restructure or be acquired, in which case personal information may transfer as part of that transaction, subject to the same protections described here

We do not sell, rent or trade personal information to third parties for their own marketing purposes.

Bond & Beyond operates from Sri Lanka and, as our Melbourne office opens, from Australia. Depending on where you are contacting us from and which practice you are dealing with, your information may be processed in either country, or by a service provider located elsewhere (for example, cloud hosting infrastructure). Where we transfer personal information across borders, we take reasonable steps to ensure it continues to receive a comparable standard of protection to what this policy describes, wherever it is processed.

We keep personal information only for as long as we have a reason to:

• General enquiries: only where you have given consent on the form, and only for as long as it takes to answer your enquiry
• Job applications: for twelve months, so we can reconsider you for a future role without asking you to reapply. Ask us at any point and we will delete your application
• Student registrations: for as long as you are enrolled with us, and afterwards for as long as we are required to retain academic, financial or compliance records
• Travel and consultancy engagements: for the duration of the engagement and for as long afterwards as statutory, tax or contractual obligations require

Where none of the above applies, our default is to keep personal information for no longer than is reasonably necessary for the purpose it was collected for, and to delete or anonymise it after that.

We use reasonable technical and organisational measures to protect the personal information we hold, including restricting who within Bond & Beyond can access it and using basic automated defences against spam and abuse on our public forms. No website or storage system can be guaranteed completely secure, and we cannot promise that information you send us over the internet will never be intercepted. If we become aware of a data breach that is likely to affect you, we will notify you and the relevant authority as required by applicable law.

Depending on where you are and which law applies to you, which may include Sri Lanka's Personal Data Protection Act, the UK or EU General Data Protection Regulation, or Australia's Privacy Act 1988, you generally have the right to:

• Ask what personal information we hold about you, and get a copy of it
• Ask us to correct information that is inaccurate or incomplete
• Ask us to delete your information, subject to any legal reason we may have to keep it
• Withdraw consent at any point where we rely on consent, such as the general enquiry form
• Object to, or ask us to restrict, certain uses of your information
• Ask for your information in a portable format, where that right applies to you

To exercise any of these, email us at hello@bondandbeyond.example. We aim to respond within a reasonable time and, in any event, within the period applicable law requires. We may need to verify your identity before acting on a request, particularly one involving the sensitive details collected on our registration forms.

This website and the enquiry, booking and application forms on it are intended for use by adults. Our Professional Education programmes may be taken by learners under 18, in which case a parent or guardian should complete the registration on the learner's behalf and is responsible for the accuracy of the information provided. We do not knowingly collect personal information from a child through the general enquiry, booking or careers forms.

Our site links out to third-party services we do not control, including WhatsApp for direct messaging, Google Maps for office locations, and, where relevant, airline, hotel or other travel suppliers referenced on our Travel & Tourism pages. Once you leave our site or open one of these embeds, that provider's own privacy policy applies, not ours. We encourage you to read it before sharing information with them.

We may update this policy from time to time, for example as our practices grow or as data protection law in Sri Lanka, Australia or elsewhere develops. We will post the revised version here with an updated date at the top of the page. Where a change is material, such as a new category of information collected or a new purpose for using it, we will make that clear on this page rather than relying on the date alone.

If you have a question about this policy, or want to exercise any of the rights described above, contact us at:

Bond & Beyond Holdings
Colombo, Sri Lanka
hello@bondandbeyond.example

You can also reach the right team directly through our contact form.