Privacy Policy

Last updated 12 September 2026

1. Who we are

TripzaCeylon is a travel planning business based in Sri Lanka. For the purposes of data protection law we are the controller of the personal data described here — meaning we decide what is collected and why.

Trading name	TripzaCeylon
Registered company name	registered company name
Company registration number	registration number
Registered address	registered address
SLTDA registration number	SLTDA number, or delete this row
Contact	info@tripzaceylon.com · 076 167 4855

2. What we collect

Only what you type into the enquiry form. There is no account to create, no newsletter sign-up that runs without you, and no tracking of what you browse.

• Your name and email address — so we can reply.
• Your trip preferences — the package or route you chose, roughly when you want to travel, how many of you there are, trip length, budget band, and the interests you ticked.
• Anything you write in the notes box. Please don't put anything sensitive there — passport numbers, card details, health or medical information. If we need those later we will ask for them properly and securely, never through this form.

We do not collect payment details on this website, and we do not ask for your date of birth, passport details or address at enquiry stage. If you go on to book, we will tell you separately what is needed and why.

Our website sets no cookies and runs no analytics. See our Cookie Policy for the detail.

3. Why we collect it, and our legal basis

What for	Legal basis
Replying to your enquiry and preparing a quote	Steps taken at your request before entering a contract
Keeping a record of enquiries so we can pick up a conversation later	Our legitimate interest in running the business, balanced against your privacy
Sending you travel offers or news, if you ask for that	Your consent, which you can withdraw at any time

We do not sell your data, we do not share it with advertisers, and we do not use it to build a profile of you.

4. Who else sees it

A handful of service providers process enquiry data on our behalf. We have listed them by name because you are entitled to know who is holding your details.

Who	What they do	Where
Supabase	Stores the enquiry in our database	your Supabase region — Singapore if you followed the setup guide
Web3Forms	Delivers the enquiry to our email	Outside Sri Lanka
Google (Gmail)	Our email inbox	Outside Sri Lanka
GitHub Pages	Hosts this website; sees your IP address as any web server does	Outside Sri Lanka
Google Fonts, Unsplash	Serve the fonts and photographs on these pages, so they receive your IP address	Outside Sri Lanka

We may also share your details with the specific hotels, guides and transport operators needed to arrange a trip you have asked us to arrange — but only those, only what they need, and only once you are actually booking.

We will disclose information if the law requires it, for example a valid request from a court or a regulator.

5. Where it goes

Some of the providers above store data outside Sri Lanka. Where Sri Lankan or other applicable law requires a safeguard for that transfer, we rely on the provider's standard contractual terms. If you would like to know more about a particular provider, ask us.

6. How long we keep it

• Enquiries that don't turn into a trip: choose a period — 24 months is a common answer, then deleted.
• Enquiries that become bookings: kept for as long as we need them for the trip, and afterwards for period — check with an accountant; Sri Lankan tax record-keeping rules will drive this.
• Email: our inbox holds a copy of each enquiry. We clear these on the same schedule.

7. Your rights

Sri Lanka's Personal Data Protection Act No. 9 of 2022 gives you rights over your personal data. Its obligations on businesses are being brought into force in stages. We intend to meet them in full, and we will honour these requests now regardless of which sections are currently in force:

• ask what we hold about you, and get a copy
• have anything inaccurate corrected
• ask us to delete it
• object to our using it, or ask us to restrict how we use it
• withdraw consent for marketing at any time, without it affecting anything else

If you are in the United Kingdom or the European Economic Area, the UK GDPR or the GDPR may also apply to us because we offer services to travellers there. In that case you have the equivalent rights under those laws, including the right to data portability and the right to complain to your national data protection authority.

To exercise any of these, email info@tripzaceylon.com. We will reply within 30 days. We may ask you to confirm who you are first, so that we don't hand your details to somebody else.

8. Security

Enquiries are stored in a database with access rules that allow the website to add an enquiry but not to read any. Reading them requires a staff account with an individual password. The site is served over HTTPS.

No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your data we will tell you and the relevant authority as the law requires.

9. Children

This site is meant for adults planning travel. We don't knowingly collect personal data from children. If a trip involves children, we only need their details from the adult booking, at booking stage — never through this form.

10. Changes

If we change this policy we will update the date at the top. If the change is significant we will say so on the home page.

11. Contact and complaints

Questions or complaints about how we handle your data: info@tripzaceylon.com.

If you are not satisfied with our answer, you can complain to the Data Protection Authority established under the Personal Data Protection Act in Sri Lanka, or to your own national data protection authority if you are in the UK or the EEA.