Privacy Policy

We collect a few different types of information from you:

• Identity data: Your full name, date of birth, and nationality.
• Contact data: Your email address, phone number, and mailing address.
• Booking data: Your tour preferences, travel dates, group size, special requests, and payment details.
• Technical data: Your IP address, browser type, device information, and cookies (check out our Cookie section below).
• Communications: Any messages you send us through email, chat, or contact forms.

Here is how we use your personal data:

• To process and manage your tour and vehicle bookings.
• To send you booking confirmations, updates, and reminders.
• To personalize your experience on our platform.
• To securely process payments and issue refunds.
• To send you promotional offers and newsletters, but only if you give us permission. You can unsubscribe at any time.
• To comply with legal obligations and resolve disputes.
• To improve our website, services, and customer experience using analytics.

We never sell your personal data. We only share your information with trusted partners who help us deliver our services:

• Payment processors like Stripe and PayPal for handling secure transactions.
• Tour guides and drivers assigned to your booking, but we only share the necessary details.
• Hotel and accommodation partners when your tour includes overnight stays.
• Analytics providers like Google Analytics to help us understand website usage. This data is kept anonymous.
• Government or regulatory authorities if we are required to do so by law.

All of our partners are required by contract to protect your data and only use it for the intended purpose.

Your data is stored safely on secure servers located in the European Union and Asia-Pacific regions. We use industry-standard security measures, which include:

• SSL/TLS encryption for all data as it travels across the internet.
• AES-256 encryption to protect sensitive data when it is stored.
• Regular security checks and penetration testing.
• Strict access controls so only the right staff members can see personal data.

While we do our best, no internet transmission is completely flawless. We will let you know right away if a data breach ever affects your information.

We use cookies and similar tracking tools to make your experience on our website better. Here are the types of cookies we use:

• Essential cookies: These are necessary for core website features like logging in and booking.
• Analytics cookies: These help us understand how people use our site, using anonymous data.
• Preference cookies: These remember your settings like language, currency, and display choices.
• Marketing cookies: These are used to show you relevant ads, but only if you consent.

You can manage your cookie preferences in your browser settings or through our cookie banner. If you disable essential cookies, some parts of the website might not work properly.

Depending on where you live, you have certain rights regarding your personal data:

• Right to access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate or incomplete data.
• Right to erasure: You can ask us to delete your personal data, subject to legal requirements.
• Right to restrict processing: You can ask us to limit how we use your data.
• Right to data portability: You can request your data in a machine-readable format.
• Right to object: You can object to us using your data for marketing.

If you want to exercise any of these rights, just email us at [email protected]. We will get back to you within 30 days.

If you live outside of Sri Lanka, your data might be transferred to and processed in other countries where our servers or partners are located. We make sure all international transfers follow data protection laws and use the right safeguards, like Standard Contractual Clauses.

We only keep your personal data for as long as we need it for the reasons explained in this policy:

• Booking records are kept for 7 years for accounting and legal reasons.
• Account data is kept until you delete your account, plus an extra 90 days for recovery.
• Marketing preferences are kept until you change your mind and withdraw consent.
• Analytics data is made anonymous after 26 months.

We might update this privacy policy from time to time if our practices or legal requirements change. If we make big changes, we will let you know by email or by putting a clear notice on our website. The date at the top of the page shows when it was last updated.

If you keep using our services after the changes happen, it means you accept the new policy.