1. Who we are
CeylonTour provides information and enquiry support for Sri Lanka holidays, private tours, accommodation, transport and related travel services.
For the purposes of applicable data-protection law, CeylonTour is responsible for deciding how and why personal information collected through this website is processed.
2. Information we collect
Depending on how you interact with us, we may collect the following categories of personal information:
- Your name, email address, telephone number and country of residence.
- Travel dates, destinations, passenger numbers and holiday preferences.
- Accommodation, transport, accessibility, dietary or other travel requirements that you choose to provide.
- Enquiry details and communications exchanged with our team.
- Booking-related information where you proceed with a travel service.
- Technical information such as IP address, browser type, device type, operating system and website usage data.
- Marketing preferences and records of any consent you have provided.
- Information supplied when you enquire about becoming a business partner or service provider.
Please avoid sending passport copies, payment-card details, medical records or other highly sensitive information through a general website enquiry unless we have specifically asked for it through an appropriate secure process.
3. How we collect information
We may collect personal information:
- Directly from you when you complete a form, email us, telephone us or contact us through WhatsApp.
- When you request a tour, transfer, hotel, coach or chauffeur service.
- When another traveller or group organiser provides your details as part of a shared enquiry.
- Through cookies, server logs and similar website technologies.
- From travel partners or service providers where necessary to manage an enquiry or confirmed service.
Where another person provides information about you, they should ensure they have permission to do so and that the information is accurate.
4. How we use your information
We may use personal information to:
- Respond to questions and travel enquiries.
- Prepare proposed itineraries, quotations and travel-service options.
- Arrange or coordinate tours, accommodation, transport and related services.
- Communicate about an enquiry, booking, change or service issue.
- Work with hotels, drivers, guides, activity providers and other relevant travel partners.
- Process payments or payment-related records where applicable.
- Maintain financial, accounting, operational and legal records.
- Improve our website, services and customer experience.
- Protect the website and detect fraud, misuse or security incidents.
- Send marketing communications where we have permission or another lawful basis to do so.
- Meet legal, regulatory, tax, insurance or law-enforcement requirements.
5. Our lawful bases
Where UK data-protection law applies, we rely on one or more lawful bases depending on the circumstances:
Contract
Processing may be necessary to take steps at your request before entering into a contract or to perform a confirmed travel-service agreement.
Legitimate interests
We may process information to respond to enquiries, operate our business, improve services and protect our website, provided those interests do not override your rights.
Consent
We may rely on consent for optional marketing, certain cookies or where you voluntarily provide information that requires explicit permission.
Legal obligation
Processing may be necessary to comply with tax, accounting, regulatory, court or other legal duties.
7. International transfers
CeylonTour operates in connection with travel services in Sri Lanka and may communicate with customers, suppliers and technology providers located in different countries.
This means personal information may be transferred between the United Kingdom, Sri Lanka and other countries where relevant service providers operate.
Where data-protection law requires safeguards for an international transfer, we will take reasonable steps to use an approved transfer mechanism, contractual safeguard or applicable legal exception.
8. How long we keep information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, tax, insurance and dispute requirements.
| Record type | Typical retention approach |
|---|---|
| General enquiries | Normally retained for up to 24 months after the last meaningful communication. |
| Unconfirmed quotations | Normally retained for up to 24 months unless needed for an ongoing enquiry or dispute. |
| Confirmed booking records | Retained for the period required for operational, financial, legal and tax purposes. |
| Marketing records | Retained until consent is withdrawn, you object, or the information is no longer required. |
| Technical and security logs | Retained for a limited period appropriate to security, troubleshooting and fraud prevention. |
These periods may be extended where information is needed for a complaint, legal claim, regulatory investigation or other lawful reason.
9. Information security
We use reasonable technical and organisational measures designed to protect personal information from accidental loss, misuse, unauthorised access, alteration or disclosure.
These measures may include:
- Access controls and password protection.
- Secure hosting and encrypted website connections.
- Software maintenance and security updates.
- Restricted access to customer and booking records.
- Backup and recovery procedures.
- Review of service providers handling personal data.
No internet transmission or electronic storage system can be guaranteed to be completely secure. Please contact us immediately if you believe information sent to us has been compromised.
10. Your privacy rights
Depending on your location and the law that applies, you may have rights relating to your personal information, including the right to:
- Request access to personal information we hold.
- Ask us to correct inaccurate or incomplete information.
- Ask us to erase information in circumstances where there is no lawful reason to continue processing it.
- Request restriction of processing in certain circumstances.
- Object to processing based on legitimate interests or direct marketing.
- Request transfer of eligible information in a portable format.
- Withdraw consent where processing relies on your consent.
- Raise concerns about solely automated decisions, where applicable.
These rights are not absolute and may be subject to legal exceptions. We may need to verify your identity before responding to a request.
To exercise a right, email info@ceylontour.lk.
United Kingdom
You may raise a concern with the UK Information Commissioner’s Office if you are dissatisfied with how your information has been handled.
Visit the ICO website →Sri Lanka
You may contact the Data Protection Authority of Sri Lanka where the Sri Lankan Personal Data Protection Act applies.
Visit the DPA website →12. Children’s information
Our services may form part of family holidays, but the website is not intended for children to submit travel enquiries independently.
A parent, guardian or responsible adult should provide any information needed about a child traveller. We will use such information only where reasonably necessary to arrange or support the requested travel service.
13. Third-party websites
Our website may link to third-party services, including accommodation providers, transport platforms, government websites, payment services and social-media platforms.
Those organisations operate under their own privacy policies. We are not responsible for how an independent third party collects or uses information after you leave our website.
14. Changes to this policy
We may update this Privacy Policy to reflect changes in our services, technology, suppliers, business arrangements or legal requirements.
The revised version will be published on this page with an updated “Last updated” date. Significant changes may also be communicated through an additional website notice where appropriate.
15. Contact us
Questions, requests or concerns about this Privacy Policy can be sent to:
We aim to acknowledge privacy enquiries promptly and respond within the period required by applicable law.