Privacy policy

Last updated: 31 July 2026

1. Who we are

Ceylon Paradise Holiday (“we”, “us”) is an inbound tour operator registered in Sri Lanka at No. 35/1, U.E. Perera Mawatha, Rajagiriya, Sri Lanka. Company registration number PV 00355360.

We are the data controller for the personal information described in this policy. If you have a question about it, write to info@cphlk.com.

2. What this policy covers

It covers personal information we collect when you enquire about a trip, book one, travel with us, subscribe to our newsletter, or use this website. It applies whether you contact us through the website, by email, by WhatsApp or by telephone.

It does not cover the separate privacy practices of hotels, airlines, park authorities or other suppliers, who handle your information under their own policies.

3. The information we collect

Depending on how far a booking progresses, we may collect:

• Contact details — name, email address, telephone or WhatsApp number, country of residence and postal address.
• Trip details — travel dates, number and ages of travellers, interests, budget and any preferences you tell us about.
• Travel document details — passport name, number, nationality, date of birth and expiry date, where a hotel, park permit or domestic booking requires them.
• Health and dietary information — only what you choose to tell us in order for us to arrange your trip safely, such as allergies, reduced mobility or dietary requirements. This is special category data and we treat it accordingly.
• Payment information — the fact and amount of a payment. Card details are handled by our payment provider and are not stored by us.
• Website usage data — pages viewed, approximate location derived from IP address, browser type. See the cookies section.

4. How we collect it

Directly from you, when you complete the enquiry form, email us, message us on WhatsApp or speak to us. From the person making a group booking, where they provide details for fellow travellers — if you do this, please make sure they are content for you to share their information. And automatically through this website, as described under cookies.

5. Why we use it, and our legal basis

What we do	Legal basis
Answer your enquiry and prepare a quote	Steps taken at your request before entering a contract
Arrange and run your trip, including passing details to hotels, guides and park authorities	Performance of our contract with you
Handle payments, keep accounts and meet tax obligations	Legal obligation
Accommodate health, mobility or dietary needs	Your explicit consent
Send you our newsletter	Your consent, withdrawable at any time
Improve the website and understand how it is used	Our legitimate interests, balanced against your rights
Deal with a complaint, dispute or insurance claim	Our legitimate interests in defending legal claims

6. Who we share it with

We share only what is necessary, only with those who need it, and never for their own marketing. Recipients may include:

• Hotels, guesthouses and lodges, to hold your reservation.
• Drivers, guides and safari operators working on your itinerary.
• National park and heritage site authorities, where permits require named visitors.
• Our payment provider, [[PAYMENT PROVIDER]].
• Our email, hosting and analytics providers, listed in section 7.
• Insurers, lawyers or auditors, where we are required to or need to defend a claim.
• Government or law enforcement, where the law requires it.

We do not sell your personal information, and we never will.

7. Cookies and similar technologies

This website sets a small number of cookies. Strictly necessary ones keep the site working and cannot be switched off. [[LIST THE ANALYTICS OR MARKETING TOOLS YOU ACTUALLY USE — for example Google Analytics, Meta Pixel — OR DELETE THIS SENTENCE IF YOU USE NONE.]]

You can refuse or delete cookies in your browser settings; parts of the site may then not work as intended. If you are visiting from the UK or EU, non-essential cookies are only set with your consent.

8. Sending information outside Sri Lanka

Some of our suppliers and service providers are based outside Sri Lanka, including in the European Union and the United States. Where we transfer personal data internationally we rely on appropriate safeguards, such as standard contractual clauses or a transfer to a country recognised as providing adequate protection.

9. How long we keep it

Enquiries that do not become bookings: [[e.g. 24 months]] from your last contact with us. Booking and financial records: [[e.g. 7 years]], to meet accounting and tax obligations. Newsletter subscribers: until you unsubscribe. Health information: deleted once your trip is complete and any claim period has passed.

10. How we protect it

Access to booking records is limited to staff who need it. The website is served over HTTPS. Passwords are not shared and accounts are individual. Backups are held securely. No system is perfectly secure, and we do not claim otherwise; if a breach occurs that is likely to put your rights at risk, we will tell you and the relevant authority without undue delay.

11. Your rights

Depending on where you live, you may have the right to ask us for a copy of your information; to correct it if it is wrong; to have it deleted; to restrict or object to how we use it; to receive it in a portable form; and to withdraw consent at any time. To exercise any of these, email info@cphlk.com. We will respond within one month.

Exercising these rights is free, and we will not treat you differently for doing so.

12. Marketing

We only send our newsletter to people who have asked for it. Every email carries an unsubscribe link that works immediately, and you can also email us to be removed. Unsubscribing from marketing does not stop us contacting you about a trip you have booked.

13. Children

We do not knowingly collect information directly from children. Where a booking includes children, we collect their details from the adult making the booking, and only what a hotel or permit requires.

14. Other websites

This site links to other websites — hotels, park authorities, government visa pages. We are not responsible for their privacy practices, and we would encourage you to read their policies before giving them your information.

15. Complaints

If you are unhappy with how we have handled your information, please tell us first at info@cphlk.com so that we can put it right. You also have the right to complain to a supervisory authority: in Sri Lanka, the Data Protection Authority established under the Personal Data Protection Act; in the UK, the Information Commissioner’s Office; in the EU, your national data protection authority.

16. Changes to this policy

We will post any changes on this page and update the date at the top. Where a change materially affects how we use your information, we will contact you directly.