Privacy Policy

The data controller responsible for your personal data is:

Depending on how you interact with us, we may collect the following types of information:

2.1 Information you give us

• Identity and contact details: full name, email address, telephone/WhatsApp number, postal address, country of residence, nationality.
• Booking and travel details: travel dates, itinerary preferences, number and ages of travelers, accommodation and transport preferences, flight arrival and departure details.
• Travel documents: passport details (name, number, expiry, nationality) and visa/ETA details, where needed for hotel registration, permits, national park entry or immigration purposes.
• Payment information: payment method, billing name, transaction references and bank transfer details. We do not store full card numbers on our own systems; card payments are processed by secure third-party payment providers.
• Special requirements: dietary needs, allergies, mobility needs, medical conditions or other information you choose to share so that we can arrange a safe and suitable trip. This may be sensitive information and we only use it with your consent and for arranging your travel.
• Emergency contact details of a person you nominate.
• Communications: messages, enquiries, feedback, reviews and testimonials you send us by email, WhatsApp, social media, phone or the website.

2.2 Information collected automatically

• IP address, browser type, device type, operating system, language, pages visited, time spent on pages, referring website and approximate location.
• Information collected through cookies and similar technologies (see Section 9).

2.3 Information from third parties

• Travel agents, tour operators or partners who book on your behalf.
• Online platforms and review sites where you contact us or review our services.
• Social media platforms, when you interact with our pages or messages.

We use your personal data only for lawful and specific purposes, including to:

• respond to enquiries and prepare quotations and itineraries;
• process and confirm bookings, and arrange hotels, transport, drivers, guides, entrance tickets, activities and other services;
• process payments and issue invoices and receipts;
• send pre-travel information, booking confirmations, updates and travel support during your trip;
• meet legal, regulatory, tax and tourism-authority requirements;
• handle complaints, claims, emergencies and insurance matters;
• improve our website, services, tour packages and customer experience;
• send newsletters, offers and promotional messages, where you have agreed to receive them;
• detect, prevent and investigate fraud, misuse and security incidents;
• publish reviews, photos or testimonials, with your permission.

We process your personal data on one or more of the following grounds recognised under the PDPA:

• Consent – for example, marketing communications, sensitive information such as health or dietary needs, and use of your photos or reviews.
• Performance of a contract – to provide the tour services you have requested or to take steps before entering into a booking.
• Compliance with a legal obligation – such as record keeping, tax and tourism regulations.
• Legitimate interests – such as improving our services, securing our website and managing our business, where these interests are not overridden by your rights.

Where we rely on consent, you may withdraw it at any time by contacting us. Withdrawal does not affect processing carried out before withdrawal.

We do not sell your personal data. We share it only where necessary, and only with parties who need it to deliver your trip or support our business:

• Service providers for your trip: hotels, guesthouses, villas, drivers, tour guides, transport companies, safari operators, activity providers, restaurants and attraction operators.
• Travel partners: overseas travel agents or tour operators who booked your trip through us, or whom you booked through.
• Payment and banking providers: to process payments securely.
• Technology providers: website hosting, email, analytics, booking and customer-management tools, cloud storage and messaging services.
• Authorities: Sri Lanka Tourism Development Authority, immigration, police, customs, tax and other government bodies, where required by law or to obtain permits.
• Professional advisers and insurers: lawyers, accountants, auditors and insurers.
• Emergency situations: hospitals, embassies or emergency contacts if needed to protect your health or safety.

Where we share data with service providers, we ask them to keep it confidential and use it only for the agreed purpose.

Because we serve travelers from many countries, your information may be transferred to, stored or processed in countries outside Sri Lanka, for example by overseas email, cloud, analytics or payment providers, or by travel partners in your home country. Where this happens, we take reasonable steps to ensure that your data is protected in line with the PDPA and applicable law.

We keep personal data only for as long as necessary for the purposes described in this Policy. As a general guide:

• Booking and invoice records are kept for the period required by Sri Lankan tax, accounting and tourism regulations (generally at least 2 years).
• Enquiries that do not lead to a booking are kept for up to 6 months.
• Marketing contact details are kept until you unsubscribe or ask us to delete them.
• Passport copies and sensitive information are deleted or anonymized after your trip is completed, unless we must keep them by law.

We take reasonable technical and organizational measures to protect your personal data against loss, misuse, unauthorized access, disclosure or alteration. These include secure website connections (HTTPS), restricted access to customer records, and the use of trusted service providers.

However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. Please avoid sending full card numbers by email or messaging apps.

Our website uses cookies and similar technologies to make the site work, remember your preferences, understand how visitors use it and improve performance.

• Essential cookies – needed for the website to function.
• Analytics cookies – such as Google Analytics, to understand traffic and visitor behavior in aggregated form.
• Marketing cookies – such as advertising pixels from Google or Meta, which may be used to show relevant ads or measure campaign results.

You can control or delete cookies through your browser settings. Disabling some cookies may affect how the website works. Where required, we will ask for your consent before placing non-essential cookies.

Our website may contain links to third-party websites, booking platforms, payment gateways, social media pages, maps and review sites. We are not responsible for the privacy practices or content of those sites. Please read their privacy policies before sharing your information.

Subject to the PDPA and other applicable law, you have the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request erasure of your data, where it is no longer needed or where you withdraw consent;
• withdraw consent to processing that is based on consent;
• object to or request restriction of certain processing, including direct marketing;
• complain to the Data Protection Authority of Sri Lanka if you believe your data has been handled unlawfully.

To exercise your rights, contact us using the details in Section 16. We may need to verify your identity before responding. We will reply within the time required by law. Some requests may be limited where we must keep information to meet legal obligations or to establish or defend legal claims.

With your consent, we may send you newsletters, tour offers and travel inspiration by email, WhatsApp or other channels. You can unsubscribe at any time by using the unsubscribe link in our emails or by contacting us. We will still send you essential service messages about your booking.

Our website is intended for adults. We do not knowingly collect personal data directly from children under 18. Where a booking includes children, the parent or legal guardian must provide the information and consent on the child's behalf.

Our guides or staff may take photographs or videos during tours for operational, safety or promotional purposes. We will only publish images in which you are clearly identifiable on our website, social media or marketing materials with your permission.

If you do not wish to be photographed or wish to have an image removed, please tell your guide or contact us at any time.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. The updated version will be published on this page with a new "Last updated" date. We encourage you to review it regularly. Continued use of our website after changes means you accept the updated Policy.

If you have any questions, concerns or requests about this Privacy Policy or your personal data, please contact: