Effective Date: June 07, 2026
1. Our Commitment to Your Privacy
Your privacy is important to us. Thus, it is a policy of Tour Packages Sri Lanka to respect your privacy regarding any information we may collect from you across our website, https://tourpackagessrilanka.com, and other sites we own and operate.
We only ask for personal information when we truly need it to provide a service to you. We collect it by fair and lawful means, with your knowledge and consent. Further, we also let you know why we’re collecting it and how it will be used.
We only retain collected information for as long as it is necessary to provide you with your requested service. We’ll protect whatever data we store, within commercially acceptable means to prevent loss and theft, as well as unauthorized access, disclosure, copying, use, or modification.
We don’t share any personally identifying information publicly or with third-parties, except when required to by law or when necessary to fulfill your booking (e.g., sharing your name with a hotel or transport provider).
Our website may link to external sites that are not operated by us. Please be aware that we have no control over the content and practices of these sites, and cannot accept responsibility or liability for their respective privacy policies.
You are free to refuse our request for your personal information, with the understanding that we may be unable to provide you with some of your desired services.
Your continued use of our website will be regarded as an acceptance of our practices around privacy and personal information.
2. Information We Collect
We may collect the following types of personal data:
| Data Type | Examples | How We Collect |
|---|---|---|
| Contact Information | Name, email address, phone number | Via Contact Us form, Tailor Made form, Taxi Booking form, or Activity Booking form |
| Travel Details | Travel dates, number of travelers, special requests | Via Tailor Made form, Taxi Booking form, or Activity Booking form |
| Pickup/Drop Location | Address, airport, hotel name | Via Taxi Booking form |
| Activity Preferences | Which activities you are interested in | Via Activity Booking form |
| Technical Data | IP address, browser type, cookies | Automatically via server logs |
| Payment Information | PayPal transactions (we do NOT store credit card details) | Via PayPal or direct deposit |
Important Note on Payments: Payments are processed through PayPal or direct deposits. We do NOT save any credit card details on our servers.
3. How We Use Your Information
We use your personal information only for:
-
Responding to your inquiries sent via our Contact Us page
-
Creating and managing Tailor Made tour packages based on your preferences
-
Processing taxi/vehicle booking requests
-
Processing activity booking requests
-
Fulfilling contractual obligations (hotel, transport, guide arrangements)
-
Improving our website and customer service
Legitimate purposes include:
-
Direct customer communication
-
Booking management and execution
-
Requirement analysis
-
Service development
-
Enhancing user experience
-
Legal compliance
We do not sell or rent your contact details to any third party. Your personal details will be shared with third parties (hotels, transport providers, guides) ONLY when necessary to fulfill your booking and ONLY with your expressed consent.
4. Data Retention Period
We retain your personal data only for as long as necessary:
| Data Type | Retention Period |
|---|---|
| Contact form submissions | 12 months from the date of submission |
| Tailor Made package requests | 24 months (for future reference and repeat customers) |
| Taxi booking submissions | 12 months from the date of travel |
| Activity booking submissions | 12 months from the date of activity |
| Deletion request records | 6 months (for audit/legal purposes) |
After the retention period, your data is automatically or manually deleted from our systems.
5. Your GDPR Rights (Important)
If you are located in the European Economic Area (EEA) or under GDPR jurisdiction, you have the following rights:
| Right | Description |
|---|---|
| Right to Access | Request a copy of all personal data we hold about you |
| Right to Rectification | Correct inaccurate or incomplete data |
| Right to Erasure (Right to be Forgotten) | Request permanent deletion of your personal data |
| Right to Restrict Processing | Limit how we use your data |
| Right to Data Portability | Receive your data in a structured, machine-readable format |
| Right to Object | Object to data processing based on legitimate interests |
| Right to Revoke Consent | Withdraw any previously given consent at any time |
6. How to Request Deletion of Your Data (GDPR Data Deletion Request Process)
We take data deletion requests very seriously. We have provided a simple process for you to request erasure of your personal data.
You can request deletion from ALL FOUR pages on our website that collect data:
-
Contact Us page:
https://tourpackagessrilanka.com/contact-us/ -
Tailor Made Packages page:
https://tourpackagessrilanka.com/tailor-made-tour/ -
Taxi Booking page:
https://tourpackagessrilanka.com/taxi-booking/ -
Activity Booking page:
https://tourpackagessrilanka.com/activity-booking/
On each of these pages, you will find a clearly marked red “Request Data Deletion” button located near the form.
Step-by-Step Process (Same for all locations):
-
Click the red “Request Data Deletion” button on any of the four pages listed above
-
Enter the email address you used when contacting us or submitting a booking
-
Check your email inbox for a verification link (sent within 2 minutes)
-
Click the verification link to confirm your identity
-
Your personal data will be permanently deleted within 48 hours
-
You will receive a confirmation email once deletion is complete
Response Time:
We will respond to all deletion requests within 30 days as required by GDPR. However, we typically process requests within 48 hours after verification.
What Gets Deleted:
Once your deletion request is verified and confirmed, we will delete:
-
✅ All Contact Us form submissions associated with your email
-
✅ All Tailor Made package requests associated with your email
-
✅ All Taxi Booking submissions associated with your email
-
✅ All Activity Booking submissions associated with your email
-
✅ Any other personal data we have collected from you
What We Keep (For Legal/Security Reasons):
We may retain minimal data for legal obligations or security purposes:
-
IP address of the deletion request (for audit trail)
-
Deletion request timestamp and confirmation
-
Anonymized booking records (cannot be linked back to you personally)
7. Verification Process (Why We Send a Confirmation Link)
To protect your privacy and prevent unauthorized deletion requests from others, we require email verification before processing any deletion request. This ensures that only you (the actual data subject) can request deletion of your data.
The verification link expires in 1 hour. If it expires, please submit a new request.
8. Cookies Policy
Our website uses minimal cookies. We have implemented a GDPR-compliant cookie consent plugin that allows you to:
-
Accept or decline non-essential cookies
-
Delete cookies at any time via your browser settings
Essential cookies (required for website functionality) cannot be disabled. No tracking or advertising cookies are used without consent.
Our advertising partners may set and access cookies on your device, subject to their own privacy policies.
9. Age Restrictions
Our website does not allow individuals under the age of 18 to place bookings. Users under 18 must be accompanied by a guardian to participate in tours organized by us.
10. Data Security
We protect your data within commercially acceptable means to prevent loss, theft, unauthorized access, disclosure, copying, use, or modification. Our security measures include:
-
Secure database storage
-
Regular backups
-
Limited staff access to personal data
-
SSL encryption for data transmission
-
No storage of credit card details (PayPal handles all payments)
Please Note: While we strive to protect your data, we cannot guarantee 100% security against factors beyond our control. We disclaim any warranties associated with the maintenance or nondisclosure of data.
11. Recipients of Data
Your data will be viewed only by authorized team members of our entity.
We may share your essential details with third parties ONLY when necessary to fulfill your booking, such as:
-
Hotels and accommodation providers
-
Transport and taxi companies
-
Tour guides
-
Activity providers
We cannot guarantee that the scale of data protection in a third party reaches the same as ours. However, we only share the minimum data required.
Advertising: We may share hashed (non-readable) email addresses with advertising partners to ensure our advertisements reach the right audience. These cannot be used for any other purpose.
12. Contact Information
If you have any doubts about how we handle user data and personal information, or if you need assistance with a deletion request, feel free to contact us:
| Method | Details |
|---|---|
| General Inquiries | Via our Contact Us page: https://tourpackagessrilanka.com/contact-us/ |
| Privacy Related Questions | [email protected] |
| Data Deletion Requests | Use the red “Request Data Deletion” button on any of our four data-collection pages |
Our support team is available from 8:00 AM to 10:00 PM, all 7 days.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make changes, we will update the Effective Date at the top of this policy. We encourage you to review this policy periodically.
If we make material changes that affect your rights, we will notify you via:
-
A notice on our website homepage
-
An email notification (if you have provided your email)
Your continued use of our site will be deemed acceptance of those changes.
14. Governing Law
This Privacy Policy is governed by the laws of Sri Lanka, while also respecting the GDPR requirements for our users in the European Economic Area (EEA).
15. Where to Find the Data Deletion Button (Important for Our Customers)
To make it as easy as possible for you to exercise your GDPR rights, we have placed the red “Request Data Deletion” button on EVERY PAGE that collects your personal information on our website.
You can find the deletion button on these four pages:
| Page | URL |
|---|---|
| Contact Us | https://tourpackagessrilanka.com/contact-us/ |
| Tailor Made Packages | https://tourpackagessrilanka.com/tailor-made-tour/ |
| Taxi Booking | https://tourpackagessrilanka.com/taxi-booking/ |
| Activity Booking | https://tourpackagessrilanka.com/activity-booking/ |
How to find it: On each page, look near the form (Contact Form, Tailor Made Form, Taxi Booking Form, or Activity Booking Form). You will see a clearly marked red button that says “Request Data Deletion”.
You do NOT need to navigate away from the page you are on. Whether you submitted a request via Contact Us, Tailor Made, Taxi Booking, or Activity Booking, you can request deletion of ALL your data instantly from that very same page.
