Privacy Policy

Majesty Tours (“Majesty Tours”, “we”, “us” or “our”) is a destination management company based in Colombo, Sri Lanka, arranging private tours across the island. We respect your privacy and are committed to protecting your personal data in accordance with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka (the “PDPA”) and other applicable laws.

1. Who we are (data controller)

For the purposes of the PDPA, Majesty Tours is the data controller responsible for the personal data described in this policy. Our contact details are set out in the “How to contact us” section below.

2. What personal data we collect

We only collect the data we need to plan, book and deliver your journey. Depending on how you interact with us, this may include:

• Identity & contact details — your name, nationality, email address, telephone/WhatsApp number, and country of residence.
• Travel details — passport number and expiry, date of birth, flight and arrival information, number and ages of travellers, and accommodation preferences (required for hotel bookings, safari permits and airport transfers).
• Trip preferences — the journeys, day trips and activities you enquire about or add to a planned itinerary, and any special requests.
• Health & accessibility information — only where you choose to share it (for example dietary needs, mobility requirements or medical conditions relevant to activities), so that we can arrange your trip safely.
• Payment information — details needed to process deposits and balances. Card payments are handled by our payment providers; we do not store full card numbers on our systems.
• Correspondence — messages you send us by email, WhatsApp, our contact form or social media, and our replies.
• Technical data — basic analytics such as your IP address, browser type and pages visited, collected through cookies and similar tools (see section 8).

3. How we use your data and our lawful basis

Under the PDPA we may only process personal data where we have a lawful basis. We rely on the following:

• To perform our contract with you — to prepare quotations, confirm bookings, arrange hotels, guides, vehicles, permits and transfers, and to provide support during your trip.
• With your consent — for example to send you optional updates, or to process any health information you voluntarily provide. You may withdraw consent at any time.
• For our legitimate interests — to respond to enquiries, improve our services and website, and keep our business records, provided this does not override your rights.
• To comply with legal obligations — including tax, accounting and tourism-sector record-keeping requirements in Sri Lanka.

4. Who we share your data with

We do not sell your personal data. We share it only as needed to deliver your journey, including with:

• Hotels, resorts and guesthouses where you will stay;
• Our chauffeur guides and licensed transport partners;
• National parks and authorities for safari permits and site entry;
• Airlines, domestic transport and activity operators booked on your behalf;
• Payment processors and banks, to collect payment;
• Professional advisers, and government or regulatory bodies where required by law.

Where any of these partners are located outside Sri Lanka, we take reasonable steps to ensure your data continues to be protected in line with the PDPA before transferring it.

5. How long we keep your data

We keep your personal data only for as long as necessary for the purposes above. Booking and financial records are retained for the period required by Sri Lankan tax and accounting law (generally up to six years after your trip). Enquiries that do not lead to a booking are deleted or anonymised within a reasonable period.

6. How we protect your data

We apply appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, and we limit access to staff and partners who need it to serve you. No method of transmission over the internet is completely secure, but we take your privacy seriously and act promptly on any concern.

7. Your rights under the PDPA

As a data subject under Sri Lanka's Personal Data Protection Act, No. 9 of 2022, you have the right to:

• Access the personal data we hold about you;
• Rectify data that is inaccurate or incomplete;
• Withdraw consent where we rely on it, at any time;
• Request erasure of your data where it is no longer needed and no legal obligation requires us to keep it;
• Object to or restrict certain processing;
• Be notified of a personal data breach that is likely to cause you harm, in line with the Act.

8. Cookies & analytics

Our website uses cookies and similar technologies to make the site work and to understand how it is used. This includes Google Analytics, which helps us see how visitors find and move through the site. You can control or block cookies through your browser settings; some parts of the site may not function fully if you do.

9. Children's privacy

Our services are booked by adults. Where a booking includes children, their details are provided by the responsible adult making the booking. We do not knowingly collect data directly from children.

10. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The current version, with its date, will always be published on this page.