3. Why We Process Your Data (Legal Basis)
Company
SriReisen
Address
772/D, Makumbura, 80562 Ahungalla, Sri Lanka
Email (privacy)
privacy@srireisen.com
Email (general)
info@srireisen.com
Phone/WhatsApp
+94 76 585 3276
2. What Personal Data We Collect
2.1 Data You Provide Directly
When you enquire about or book a tour with us, we may collect:
- Name (first and last name)
- Email address
- Phone number / WhatsApp number
- Nationality and passport details (required for certain bookings)
- Date of birth (required for some activities)
- Dietary requirements and food allergies
- Health conditions or accessibility needs relevant to your travel
- Emergency contact details
- Travel preferences and special requests
2.2 Payment Information
We collect confirmation of payments (e.g. transaction reference numbers). We do not collect, store, or process your full credit card or bank account details. All payment processing is handled by secure third-party payment providers.
2.3 Data Collected Automatically
When you visit our website, we may automatically collect:
- IP address and approximate geographic location
- Browser type and operating system
- Pages visited and time spent on the site
- Referring website or source
This data is collected via cookies and similar tracking technologies. Please see our Cookie Policy for full details.
2.4 Communications Data
3. Why We Process Your Data (Legal Basis)
Purpose
Legal Basis
Responding to your travel enquiry
Legitimate interest / pre-contractual steps
Confirming and managing your booking
Performance of a contract
Arranging travel services (hotels, guides, transport)
Performance of a contract
Sending booking confirmations and itinerary updates
Performance of a contract
Processing payments and issuing receipts
Performance of a contract / legal obligation
Complying with legal and tax obligations
Legal obligation
Improving our website and services
Legitimate interest
Sending promotional content (only with consent)
Consent
4. Who We Share Your Data With
4.1 Third-Party Service Providers
To arrange your tour, SriReisen must share relevant personal data with trusted third-party service providers, which may include:
- Hotels and guesthouses (for reservation purposes)
- Local drivers and vehicle operators
- Local tour guides and activity operators
- National park authorities (for permit applications)
- Domestic airlines or transport operators (where booked on your behalf)
We share only the minimum personal data necessary for each provider to deliver the service. All providers are required to handle your data responsibly and in accordance with applicable law.
4.2 Payment Processors
4.3 Legal Obligations
5. Cookies & Website Tracking
Our website uses cookies and similar tracking technologies. These help us understand how visitors use our site, remember your preferences, and improve the overall experience.
A cookie consent banner is displayed when you first visit our website. You can manage your cookie preferences at any time. For full details of the cookies we use, their purposes, and how to control them, please see our Cookie Policy.
6. International Data Transfers
SriReisen is based in Sri Lanka, which is not a country within the European Economic Area (EEA). When we process the personal data of EU/UK residents, this data may be transferred to and stored in Sri Lanka.
We ensure that appropriate safeguards are in place for such transfers, including sharing data only on a need-to-know basis with trusted partners, using secure communication methods, and processing data only as necessary for the performance of your travel contract.
Where third-party tools (such as Google Analytics) transfer data to the USA, these providers participate in the EU–US Data Privacy Framework or implement standard contractual clauses approved by the European Commission.
7. How Long We Keep Your Data
Booking & travel records
7 years (for legal, tax, and contractual compliance)
Enquiry data (no booking)
12 months from the date of your last communication
Website analytics data
Up to 26 months (in line with Google Analytics defaults
Marketing consent records
Until you withdraw consent or 3 years, whichever is earlier
After the relevant retention period, personal data is securely deleted or anonymised.
8. Your Data Protection Rights
Right of access
Request a copy of the personal data we hold about you
Right to rectification
Ask us to correct inaccurate or incomplete data
Right to erasure
Ask us to delete your personal data ('right to be forgotten'
Right to restriction
Ask us to limit how we process your dat
Right to portability
Receive your data in a structured, machine-readable format
Right to object
Object to processing based on legitimate interest or for direct marketing
Right to withdraw consent
Withdraw any consent you have given at any time
To exercise any of these rights, please contact us:
Email: privacy@srireisen.com
Post: SriReisen, 772/D, Makumbura, 80562 Ahungalla, Sri Lanka
We will respond within 30 days of receiving your request.
9. EU & UK Residents — GDPR Rights
If you are resident in the EU or UK, you have rights under the General Data Protection Regulation (GDPR) and, for UK residents, the UK GDPR. These rights include all those listed in Section 8 above.
You also have the right to lodge a complaint with a data protection supervisory authority. If you are in the EU, you may contact your national data protection authority. In the UK, this is the Information Commissioner’s Office (ICO) at https://ico.org.uk.
10. Data Security
SriReisen takes the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, accidental loss, destruction, or alteration. These measures include:
- Encrypted communications (HTTPS / SSL) on our website
- Secure email and messaging practices
- Limited access to personal data on a need-to-know basis
- Use of reputable, security-certified third-party payment processors
Despite these precautions, no method of data transmission or storage is 100% secure. If you have concerns about data security, please contact us at privacy@srireisen.com.
11. Children's Privacy
12. Changes to This Privacy Policy
13. Disclaimer
- Travel involves inherent risks. SriReisen recommends comprehensive travel insurance for all travellers.
- Website images and descriptions are illustrative. Actual services may vary within the same quality category.
- SriReisen is not liable for actions of independent third-party service providers beyond our direct control.