Privacy Policy

1. Who we are

Veloura Ceylon Travels (“Veloura”, “we”, “us”) is a travel brand of LankaNova Digital Solutions, Colombo, Sri Lanka.

We are the controller of the personal data described here. For any privacy question or request, contact us at velouraceylontravels@gmail.com.

This policy is written to meet the Personal Data Protection Act, No. 9 of 2022 (“PDPA”) of Sri Lanka. If you are in the European Union or United Kingdom, we also respect the equivalent rights you have under the GDPR.

2. What we collect

• Account details when you sign in with Google (or Apple, when available): name, email address and profile photo. We never see your Google or Apple password.
• Enquiry details you send us: name, email, phone, country, travel dates, number of travellers and your message.
• Booking details: the tour, dates, number of travellers, the lead traveller’s contact details and any notes you give us (for example dietary or mobility needs, which you choose to share).
• Payment records: amount, currency, status and reference. Card details are entered directly on PayHere’s secure checkout and never reach our servers.
• Saved places and tours (favourites), kept so they sync between the website and app.
• Technical data needed to run and protect the service: IP address, device and browser type, and security logs.

We do not use advertising trackers and we do not sell or rent personal data.

3. Why we use it (lawful basis)

4. Who we share it with

• Guides, drivers, hotels, safari operators and other suppliers on your itinerary — only what they need to deliver your trip.
• PayHere (Sri Lanka) to process payments, when online payment is available.
• Google and Apple, to sign you in.
• Our processors: Neon (database, API and file storage, hosted on AWS in Singapore) and Vercel (website hosting).
• Authorities, when the law requires it (for example the police, the Department of Immigration and Emigration or a court order).

Each processor is bound by a contract to protect your data and use it only on our instructions.

5. International transfers

Some of our processors store data outside Sri Lanka (mainly in Singapore). Where we transfer personal data abroad we do so under the conditions set by the PDPA and the Data Protection Authority of Sri Lanka, using providers that give an adequate level of protection.

6. How long we keep it

• Enquiries that do not become a booking: up to 24 months.
• Your account and favourites: until you delete your account.
• Bookings, invoices and payment records: for as long as Sri Lankan tax and accounting laws require, even after an account is deleted.
• Security logs: up to 90 days.

7. Your rights

Under the PDPA you can ask us to:

• give you access to the personal data we hold about you;
• correct or complete data that is wrong or out of date;
• erase your data, or stop using it, where there is no longer a lawful reason to keep it;
• withdraw consent you gave earlier (this does not affect what we did before);
• review a decision made about you by automated means (we do not make any).

Email velouraceylontravels@gmail.com from the address on your account. We will reply within 21 working days. If you are not satisfied, you may complain to the Data Protection Authority of Sri Lanka.

8. Security

Data is encrypted in transit (HTTPS) and at rest. Access is limited to staff who need it, and admin accounts are protected by Google sign-in. If a breach affects your data we will notify you and the Data Protection Authority as the PDPA requires.

9. Children

Our services are for adults. Children may travel on a booking made by a parent or guardian, who provides their details. We do not knowingly create accounts for anyone under 18.

10. Changes

We will post any update here with a new date. If a change is significant we will tell signed-in users by email or in the app.