
Privacy notice
This notice explains what personal data we collect when you use this website and send us a planning request, why we collect it and what your rights are under the EU General Data Protection Regulation (GDPR).
Who is responsible
The data controller is Explore Sri Lanka, based in Liljeholmen, Stockholm, Sweden. You can contact us about privacy, or about anything in this notice: Send us an email.
What we collect
When you send a message through the chat box: your name, email address and message.
When you send a planning request: your name, email address, phone number (optional), preferred language, travel dates or flexibility, number of travellers and children's ages, interests, destinations, hotel, transport and budget preferences, and any notes or messages you write — including accessibility or dietary needs if you choose to share them.
We also record the time of your consent. We do not ask for passport details or payment card information, and we ask you not to send sensitive information in free-text fields.
Our web server may log technical data such as IP addresses for security and to prevent abuse. These logs are kept for a short time.
Why we use your data
We use your details to answer your request, to prepare a proposed itinerary and quotation, and to communicate with you about it. The legal basis is taking steps at your request before a possible agreement, and your consent for sharing your trip details with partners. We do not use your data for marketing without your separate consent.
Who we share it with
To prepare a quotation, we share the relevant trip details with selected tour and hospitality partners in Sri Lanka. Sri Lanka is outside the EU/EEA, so we only share what the quotation needs, and protect such transfers with appropriate safeguards such as the European Commission's standard contractual clauses.
We use service providers who process data on our behalf under data processing agreements: Cloudflare (website hosting and storage of requests), Resend (delivery of request emails to our inbox) and Google (our Gmail inbox). Some of them may process data outside the EU/EEA, protected by the EU–US Data Privacy Framework or standard contractual clauses.
How long we keep it
We keep enquiries for as long as needed to handle your request and any resulting trip, and then delete them. Requests and messages are deleted no later than 24 months after our last contact with you, unless we must keep them longer by law (for example accounting records if you book through us).
Cookies
This website does not use tracking or advertising cookies, and no analytics are active. If we add analytics later, we will ask for your consent first and update this notice.
Your rights
You have the right to access, correct or delete your data, to restrict or object to processing, to data portability, and to withdraw your consent at any time. Contact us to use your rights. You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se.
Last updated 23 October 2026