1. Introduction
Welcome to SriLankiyo ("we," "our," or "us"). We operate the website srilankiyo.com and provide Sri Lanka tour planning, private chauffeur guide services, day trips, round tours, and wildlife safaris.
This Privacy & Cookie Policy describes how SriLankiyo collects, uses, stores, shares, and protects personal information you provide when you visit our website, submit enquiries, make bookings, or interact with our services. It also covers how we use cookies and similar tracking technologies.
By using our website and services, you agree to the collection and use of information in accordance with this policy. If you do not agree with any part of this policy, please do not use our website.
This policy applies to all visitors, users, and customers of SriLankiyo, regardless of location. Users in the European Union and European Economic Area have additional rights under the General Data Protection Regulation (GDPR), which are outlined in Section 6.
2. Information We Collect
We collect several types of information to provide and improve our services. We only collect what is genuinely necessary.
2.1 Information You Provide Directly
| Category | Examples | Purpose |
|---|---|---|
| Contact Information | Full name, email address, phone number, country | Tour enquiries, booking confirmations, customer support |
| Booking Details | Travel dates, number of travellers, special requests, itinerary preferences | Tour planning and personalisation |
| Payment Details | All tour payments are settled directly on the ground in Sri Lanka — we do not collect or process online payments on this website | Tour invoicing and receipt verification on arrival |
| Account Information | Email, password (hashed), profile preferences | Account management via Firebase Authentication |
| Communication Records | Messages sent via contact forms, WhatsApp, or email enquiries | Customer service and follow-up |
| Feedback & Reviews | Tour reviews, ratings, feedback submitted through our platform | Service improvement and publication with consent |
2.2 Information Collected Automatically
When you visit our website, we automatically collect:
- IP address and approximate geolocation (country/region level)
- Browser type, version, and operating system
- Pages visited, time on page, and navigation paths
- Referring website or search query that led you to us
- Device type (mobile, desktop, tablet)
- Session duration and interaction patterns
- Errors encountered during your visit
2.3 Information from Third Parties
We may receive information from:
- Google Analytics and Firebase Analytics (aggregated behaviour data)
- Social media platforms if you interact with our social media pages
- Partner travel agencies or affiliates who refer bookings
- Review platforms (TripAdvisor, Google Reviews) where you mention SriLankiyo
3. How We Use Your Information
We use your personal information for the following purposes, each with a lawful basis under GDPR:
Tour Booking & Service Delivery
Processing your tour enquiries, confirming bookings, coordinating with local guides, and delivering the services you have requested.
Customer Communication
Sending booking confirmations, itinerary updates, pre-departure guides, and responding to your questions and support requests.
Marketing & Newsletters
Sending promotional emails, travel inspiration, seasonal offers, and updates about new tours — only if you have explicitly opted in. You can unsubscribe at any time.
Website Analytics & Improvement
Understanding how visitors use our website to improve content, fix technical issues, and optimise the user experience.
Legal Compliance
Meeting our obligations under Sri Lankan law, tax regulations, and any applicable international laws, including data protection laws.
Fraud Prevention & Security
Detecting and preventing fraudulent bookings, spam, and abuse of our services to protect both our customers and our business.
4. Data Sharing & Disclosure
We do not sell, trade, or rent your personal information to third parties. We share data only in the following limited circumstances:
4.1 Service Providers
We work with trusted third-party service providers who assist us in operating our website and delivering our services. These providers are contractually bound to keep your data confidential and may only use it for the specific purpose we have engaged them for:
| Provider | Service | Data Shared |
|---|---|---|
| Google Firebase | Authentication, database, hosting, analytics | Account data, usage analytics |
| Google Analytics | Website traffic analysis | Anonymised browsing data |
| Nodemailer / SMTP | Email delivery for enquiries and confirmations | Email address, enquiry content |
| Mapbox / Leaflet | Interactive tour maps | No personal data shared |
| Vercel | Website hosting and deployment | Server logs, anonymised |
4.2 Local Tour Partners
When you book a tour, we share relevant details (name, travel dates, group size, special requirements) with our vetted local guide partners and accommodation providers in Sri Lanka who are directly involved in delivering your tour experience. These partners are bound by confidentiality agreements.
4.3 Legal Requirements
We may disclose your information if required to do so by law, or in response to valid requests by public authorities (e.g., a court order or government agency request).
4.4 Business Transfers
If SriLankiyo undergoes a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you via prominent notice on our website before your data becomes subject to a different privacy policy.
5. Data Security
We implement industry-standard security measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction.
SSL/TLS Encryption
All data transmitted between your browser and our servers is encrypted using TLS 1.3.
Firebase Security Rules
Firestore database access is controlled by strict security rules. Users can only access their own data.
Password Hashing
Passwords are never stored in plain text. Firebase Authentication handles secure password hashing.
Access Controls
Only authorised team members with a legitimate need can access personal data.
Regular Security Audits
We periodically review our security practices and update them as threats evolve.
Data Minimisation
We only collect and retain the minimum data necessary for the purposes described in this policy.
While we use commercially reasonable security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.
Data Retention
We retain your personal data only for as long as necessary:
- Booking and customer data: 7 years (for legal/tax compliance in Sri Lanka)
- Marketing preferences and newsletter data: Until you unsubscribe or withdraw consent
- Website analytics data: 26 months (Google Analytics default)
- Support communications: 3 years from last interaction
- Account data: Until account deletion is requested
6. Your Rights
Depending on your location, you have various rights regarding your personal data. We respect these rights and will respond to valid requests within 30 days.
Right to Access
GDPR, UK GDPR, CCPARequest a copy of the personal data we hold about you, including information on how it is used.
Right to Rectification
GDPR, UK GDPRRequest correction of inaccurate or incomplete personal data we hold about you.
Right to Erasure ("Right to be Forgotten")
GDPR, UK GDPR, CCPARequest deletion of your personal data, subject to legal retention obligations. We will delete your data unless we are required to retain it by law.
Right to Restrict Processing
GDPR, UK GDPRRequest that we limit how we use your data in certain circumstances (e.g., while a dispute is being resolved).
Right to Data Portability
GDPR, UK GDPRReceive your data in a structured, machine-readable format and transfer it to another service provider.
Right to Object
GDPR, UK GDPRObject to processing based on legitimate interests, or opt out of direct marketing at any time.
Right to Withdraw Consent
All jurisdictionsWhere processing is based on consent (e.g., marketing emails), you may withdraw your consent at any time. This does not affect the lawfulness of prior processing.
Right Not to be Discriminated Against
CCPA (California)Exercising your privacy rights will not result in denial of services, different pricing, or lower quality of service.
How to Exercise Your Rights
To exercise any of the rights above, email us at privacy@srilankiyo.com with your full name, email address associated with your account, and a description of your request. We will respond within 30 days. If you are in the EU/EEA and are unsatisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority.
8. Third-Party Services
Our website integrates several third-party services to enhance functionality. Each third party has its own privacy policy that governs how they handle data:
| Service | Purpose | Privacy Policy |
|---|---|---|
| Google Analytics / Firebase | Website analytics and performance monitoring | policies.google.com/privacy |
| Firebase (Google Cloud) | Authentication, Firestore database, file storage | firebase.google.com/support/privacy |
| Mapbox | Interactive tour maps and route visualisation | mapbox.com/legal/privacy |
| Vercel | Website hosting, CDN, and edge functions | vercel.com/legal/privacy-policy |
| Nodemailer / SMTP | Transactional email delivery | N/A (self-hosted) |
| WhatsApp Business | Customer enquiries via WhatsApp | whatsapp.com/legal/privacy-policy |
| Google Fonts | Web typography (Inter, Outfit, Lora, Karla) | policies.google.com/privacy |
We are not responsible for the privacy practices of these third-party services. We encourage you to review their privacy policies before interacting with them.
9. Children's Privacy
Our website and services are not directed to children under the age of 16. We do not knowingly collect personal information from children under 16.
If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@srilankiyo.com. We will take prompt steps to delete such information from our systems.
Tour bookings for families including children are made by the adult members of the travelling party. Any personal data relating to minors (e.g., names for documentation) is collected only as necessary for the service and is handled with extra care.
10. International Data Transfers
SriLankiyo is based in Sri Lanka. If you are accessing our services from the European Union, United Kingdom, or other regions with data protection laws, please note that your information may be transferred to and processed in Sri Lanka and other countries where our service providers operate (including the United States, where Google and Vercel data centres are located).
When we transfer personal data internationally, we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission for transfers to countries without adequate data protection laws
- Data processing agreements with all our service providers that include appropriate transfer mechanisms
- Technical and organisational measures to ensure data security during transfer and storage
- Reliance on providers who are certified under frameworks such as the EU-US Data Privacy Framework (Google, Vercel)
11. Changes to This Policy
We may update this Privacy & Cookie Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Last Updated" date at the top of this page
- Display a prominent notice on our website for 30 days after the change
- Send an email notification to registered users for significant changes
- Maintain an archive of previous policy versions (available upon request)
Your continued use of our website after any changes to this policy constitutes your acceptance of the updated policy. If you do not agree to the updated policy, please discontinue use of our website.
12. Contact Us
If you have any questions, concerns, or requests regarding this Privacy & Cookie Policy or how we handle your personal data, please contact us through any of the following channels:
Postal Address
SriLankiyo Tours, Sri Lanka
For formal written communications
Response Time: We aim to respond to all privacy-related requests within 30 days. For urgent matters, please indicate the urgency in your subject line. If you are an EU/EEA resident and we fail to respond satisfactorily, you have the right to lodge a complaint with your national Data Protection Authority (DPA).
This policy was last reviewed and updated on October 2, 2026. | © 2026 SriLankiyo. All rights reserved.