Privacy Policy

1. Who We Are

Wilpattu Tours ("we", "us") is the data controller responsible for the personal data described in this policy. We are based at Hunuvilagama, Sri Lanka. For any privacy matter you can reach us at bookings@wilpattutours.com or +94 77 995 9688.

This policy explains how we handle personal data in line with Sri Lanka's Personal Data Protection Act No. 9 of 2022 (PDPA) and its regulations.

2. Information We Collect

When you submit an inquiry or booking request through our secure web form, we collect:

• Your name and email address
• Preferred travel dates and group size
• The tour or itinerary you are interested in
• Any additional details you choose to include in your message
• Your consent to this policy

We also collect standard, aggregated analytics data (page views, referral source, device type) through Vercel Analytics, which does not use cookies or collect personal identifiers.

We do not ask for passport numbers, payment card details, or other sensitive personal data through messaging apps. Where such data is legally required (for example, for a DWC park permit), we request it only through a secure channel and only for that purpose.

3. Why We Process It (Legal Basis)

• Consent — to respond to your inquiry and send you a quote, based on the consent you give when submitting the form.
• Performance of a contract — to process and manage your booking, including park permits and accommodation.
• Legal obligation — to keep accounting records and comply with applicable law.
• Legitimate interests — to improve our website and services, balanced against your rights.

You may withdraw consent at any time. Withdrawal does not affect processing carried out before the withdrawal.

4. Who We Share It With

We do not sell or rent your personal data. We share it only as needed to deliver your trip and run our systems:

• The Department of Wildlife Conservation (DWC), where required to process park permits.
• Accommodation and transport providers involved in fulfilling your booking.
• Service providers who host our website, store data, and send email on our behalf (for example, our email delivery provider). These providers act on our instructions and are bound to protect your data.

5. Storage, Retention & Security

Inquiry data is retained for up to 12 months. Booking and accounting records are retained for 2 years, or longer where law requires. Analytics data is aggregated and stored by our analytics provider.

We use reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS) for all form submissions. No method of transmission or storage is completely secure, but we work to protect your data against unauthorised access, loss, or misuse.

6. International Transfers

Some of our service providers may store or process data outside Sri Lanka. Where that happens, we take steps to ensure your data receives a comparable level of protection, consistent with the PDPA's requirements for cross-border transfers.

7. Cookies

Our website uses only essential cookies required for it to function. Vercel Analytics uses privacy-first tracking that does not use cookies or collect personal identifiers.

8. Your Rights

Under the PDPA you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Erase your data where there is no lawful reason for us to keep it
• Restrict or object to certain processing
• Withdraw consent at any time
• Request portability of the data you provided

To exercise any of these rights, email bookings@wilpattutours.com. We will respond within 21 days. We may ask you to verify your identity before acting on a request.

9. Complaints

If you are unhappy with how we have handled your data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the Data Protection Authority of Sri Lanka.

10. Changes to This Policy

We may update this policy from time to time. The date at the top of this page shows when it was last revised. Material changes will be reflected here.

11. Contact

For any privacy question or request, email bookings@wilpattutours.com, call +94 77 995 9688, or use our contact page.