Website Privacy Policy

1. Who we are and how to contact us

Routes to Ceylon (Private) Limited ("RTC", "we", "us" or "our") is a Sri Lankan inbound tour operator and destination management company. RTC is the controller of personal data for the processing described in this Policy unless another party is identified as an independent controller.

Registered company details: ROUTES TO CEYLON (PRIVATE) LIMITED, company registration number PV 00217491, No. 185/4A, Havelock Road, Colombo 05, Sri Lanka. Website: https://routestoceylon.com. General email: info@routestoceylon.com. Privacy and Guest Relations inquiries: guestrelations@routestoceylon.com. Telephone: +94 11 226 8269.

RTC's Guest Relations and Quality Assurance Team is responsible for coordinating privacy matters and inquiries, subject to any formal Data Protection Officer appointment or governance changes advised by legal counsel.

2. Who this Policy applies to

This Policy applies to website visitors, persons who contact RTC, direct Clients, Travellers, group members, emergency contacts, persons whose information is supplied by a booking organiser or travel partner, and business contacts where RTC processes their personal data.

If a Client or another person provides personal data about a Traveller, child, family member or emergency contact, that person should ensure the information is accurate, necessary and lawfully provided, and should bring this Policy to the relevant person's attention where reasonably possible.

3. Personal data we collect

RTC may collect identity and travel-document data, including names, dates of birth, nationality, passport or identification details, photographs and visa or permit information where required for a booking.

RTC may collect contact and booking data, including postal and email addresses, telephone and messaging details, itinerary preferences, accommodation and rooming requirements, arrival and departure details, transport arrangements, loyalty information, emergency contacts, communications, feedback and complaints.

Where necessary for safety or service delivery, RTC may collect dietary requirements, allergies, accessibility or mobility needs, relevant health information and other sensitive information voluntarily provided for the tour. RTC seeks only information reasonably necessary for the stated purpose.

RTC may collect billing and transaction information, invoice and receipt data, payment status, bank-transfer references, refund information and fraud-prevention records. RTC may also collect website contact-form submissions, IP address, browser/device information, security logs, cookie identifiers and interaction data where the website or its service providers use these technologies.

4. How we obtain personal data

We may obtain personal data directly from the individual, through the RTC website contact form, by email, telephone, WhatsApp or other correspondence, and through quotations, invoices, payment confirmations, surveys or complaint records.

We may also receive data from a lead Traveller, family member, group organiser, overseas travel agent or tour operator, hotel, guide, transport or activity Supplier, payment provider, insurer, public authority, emergency service, website or technology provider, or another person involved in arranging or delivering the travel service.

5. Why we use personal data and our processing grounds

We use personal data to answer inquiries, design tailor-made itineraries, prepare quotations, take steps requested before booking, confirm and manage bookings, issue vouchers and invoices, arrange accommodation, transport, guides, excursions and activities, communicate operational changes, provide support, handle emergencies, complaints, refunds and claims, and maintain service-quality records.

Depending on the circumstances, processing may be necessary to enter into or perform a contract; comply with a legal, regulatory, accounting or tax obligation; respond to an emergency affecting life, health or safety; pursue RTC's legitimate interests in service administration, security, fraud prevention, quality assurance and legal claims; or be based on consent, including where consent is required for sensitive data or marketing.

Where information is required for a booking or legal obligation, failure to provide it may prevent RTC or a Supplier from confirming or safely delivering the relevant Service. RTC will not make consent to unnecessary processing a condition of providing the contracted travel Service.

6. Health, accessibility and other sensitive data

Health, allergy, dietary, disability, mobility, pregnancy or similar information may reveal sensitive personal data. RTC uses it only where reasonably necessary to assess suitability, communicate requirements to relevant Suppliers, provide assistance, protect health or safety, or establish or respond to a legal claim, and on an appropriate lawful basis.

Clients should not provide detailed medical records unless RTC specifically requests them and they are necessary. RTC may ask for explicit consent or other confirmation before sharing sensitive information with a Supplier, except where processing is otherwise lawfully necessary for an emergency or another permitted purpose.

7. Children's personal data

RTC may process a child's identity, passport, age, dietary, health, accessibility and booking information where the child is included in a tour. The adult making the booking confirms that the adult is a parent, legal guardian or otherwise authorised to provide the child's data and booking instructions.

RTC does not knowingly use children's personal data for direct marketing. Additional consent or safeguards will be used where required by applicable law.

8. Who we share personal data with

RTC may share the minimum personal data reasonably necessary with hotels and other accommodation providers; transport operators, drivers and guides; airlines and rail operators; activity providers, attractions and restaurants; insurers and emergency or medical services; banks and payment providers; technology, hosting, communications and professional service providers; auditors and advisers; and government, immigration, tourism, tax, law-enforcement or regulatory authorities where required or lawfully requested.

Travel Suppliers generally process some information under their own legal responsibilities and privacy terms. RTC does not sell or rent personal data. A recipient may use personal data only for the relevant service, legal obligation or other disclosed lawful purpose.

9. International and cross-border processing

Travel arrangements and technology services may require personal data to be accessed or processed outside Sri Lanka, including by an overseas travel partner, airline, accommodation provider, payment or communications provider, or cloud/technology service provider.

RTC will use an applicable lawful basis for an international transfer and, where required, reasonable contractual, organisational or technical safeguards. A transfer may also be necessary to perform or prepare the Client's travel contract, respond to an emergency, establish or defend a legal claim, or take place with appropriately informed consent where the law permits.

10. Payments and card information

Payments may be made by bank transfer or through a credit-card payment link provided through RTC's bank. Where a bank or payment provider hosts the payment page, the Client enters payment-card data directly into that provider's system and the provider's privacy and security terms also apply.

RTC does not ask Clients to send complete card numbers, security codes or online-banking passwords by ordinary email or WhatsApp. Transaction confirmations, payer details, amounts, references and refund information may be retained for booking, accounting, fraud-prevention and legal purposes.

11. Website forms, cookies and third-party features

When a person submits the website contact form, RTC processes the name, email address and message to respond to the inquiry and maintain appropriate correspondence records.

The website may use essential cookies or similar technologies for operation, security and preferences. Embedded maps, social-media links, analytics or other third-party features may collect information under their own privacy notices. Where applicable law requires consent for a non-essential cookie or similar technology, RTC should provide an appropriate consent choice before activation.

12. Marketing communications

RTC may send promotional emails or WhatsApp messages only where the recipient has consented to receive them. Marketing is kept separate from essential booking, safety and service communications.

A recipient may withdraw marketing consent or opt out at any time by using an unsubscribe method provided, replying STOP where appropriate, or contacting guestrelations@routestoceylon.com. RTC may retain a minimal suppression record to ensure that the opt-out is respected. Withdrawing marketing consent does not affect necessary booking communications or processing that occurred lawfully before withdrawal.

13. How long we retain personal data

RTC retains personal data only for as long as reasonably necessary for the purpose for which it was collected and for applicable legal, accounting, tax, regulatory, safety, insurance, complaint, limitation and evidentiary requirements.

The relevant period is determined by whether an inquiry became a booking, the completion date of the tour, the nature and sensitivity of the data, Supplier and payment records, any complaint or claim, legal retention duties and the need to prevent fraud or enforce agreements. Sensitive health or accessibility information should be deleted, anonymised or access-restricted when it is no longer reasonably necessary. Marketing contact data is retained until consent is withdrawn, the purpose ends or RTC determines that continued retention is no longer appropriate.

14. Security and personal data breaches

RTC uses reasonable technical and organisational measures appropriate to the nature of the data and processing risk. These may include access restrictions, authorised-user controls, secure payment channels, backups, staff confidentiality, supplier controls, record management and incident-response procedures.

No method of transmission or storage is completely risk-free. If RTC identifies a personal data breach, it will investigate, contain and document the matter and notify the Data Protection Authority, affected individuals or another body where and when applicable law requires.

15. Your choices and data requests

Subject to the provisions of applicable data-protection law that are in operation, an individual may be entitled to request access to personal data, correction or completion of inaccurate data, withdrawal of consent, objection or restriction in appropriate circumstances, erasure where legally available, and review of a qualifying automated decision.

RTC may ask for information to verify identity or authority before acting on a request. A request may be limited or refused where the law permits or requires continued processing, including for legal, accounting, tax, safety, fraud-prevention, evidentiary or third-party-rights reasons. RTC will respond within the applicable statutory period and explain any material refusal where legally permitted.

RTC does not use personal data to make a solely automated decision producing legal or similarly significant effects unless the processing and safeguards are specifically explained and lawfully implemented.

16. Privacy questions and complaints

A privacy question, correction request, marketing opt-out or complaint should be sent to guestrelations@routestoceylon.com with sufficient information for RTC to identify the relevant record and request. Postal requests may be sent to Routes to Ceylon (Private) Limited, No. 185/4A, Havelock Road, Colombo 05, Sri Lanka.

RTC will investigate a privacy complaint and seek a practical resolution. Where applicable law provides a right to complain to the Data Protection Authority of Sri Lanka or another competent authority, this Policy does not restrict that right.

17. Changes to this Policy

RTC may update this Policy to reflect changes in law, regulation, guidance, technology, Suppliers or business practices. The current version and effective date will be published on the website. A material change will not retrospectively remove a right that has already accrued.

This Policy should be read with RTC's Website and Booking Terms and Conditions and any specific privacy information supplied for a particular Service.