Privacy policy

D Ceylon Collection (Pvt) Ltd

No. 14, 3rd Floor, Liberty Plaza,

R. A. De Mel Mawatha, Colombo 03,

Sri Lanka.

Email: info@dceyloncollection.com

Company Registration No.: PV 00370596

For the purposes of applicable data-protection legislation, D Ceylon Collection may act as a data controller where we determine the purposes and means of processing personal data.

Where we process personal data on behalf of another organisation, such as a travel agent, tour operator or other business partner, our role may instead be that of a processor, where applicable under the circumstances.

D Ceylon Collection is incorporated and operates in Sri Lanka and processes personal data in accordance with applicable Sri Lankan data-protection laws, including the Personal Data Protection Act, No. 9 of 2022, as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025, together with applicable regulations, rules, directives, commencement orders and guidance issued under the applicable data-protection framework.

The Data Protection Authority of Sri Lanka (“DPA”) is responsible for regulating and overseeing the Sri Lankan data-protection framework.

Where the laws of another jurisdiction apply to our processing of personal data, D Ceylon Collection will comply with the applicable requirements to the extent required by law.

This Privacy Policy explains our data-processing practices and should be read together with any applicable terms, booking conditions and other privacy notices provided to you.

This Privacy Policy applies to personal data relating to individuals who interact with D Ceylon Collection, including:

• website visitors;
• prospective travellers;
• customers and travellers;
• members of travelling parties;
• children travelling with a customer or group;
• family members travelling with a customer;
• individuals making enquiries on behalf of other travellers;
• travel agents;
• tour operators;
• wholesalers;
• destination and trade partners;
• suppliers and service providers;
• representatives of corporate or other organisations; and
• other individuals who communicate or interact with D Ceylon Collection.

Where a booking is made through a travel agent, tour operator, wholesaler or other intermediary, personal data may be provided to us by that organisation for the purpose of arranging and delivering the requested services.

The information we collect depends on how you interact with us, the services you request and the requirements of your journey.

We seek to collect only personal data that is reasonably necessary for the relevant purpose.

4.1 Contact and enquiry information

We may collect:

• name;
• email address;
• telephone or mobile number;
• country of residence;
• preferred travel dates;
• arrival date;
• number of nights;
• number of travellers;
• number and ages of children;
• travel preferences;
• accommodation preferences;
• destination preferences;
• budget information where voluntarily provided;
• information contained in your enquiry; and
• other information you choose to provide.

4.2 Booking and travel information

Where necessary to arrange or administer your travel, we may collect:

• traveller names;
• dates of birth or ages;
• nationality;
• passport or other travel-document details;
• visa or entry information where necessary;
• flight details;
• arrival and departure information;
• accommodation requirements;
• rooming arrangements;
• transportation requirements;
• dietary requirements;
• accessibility or mobility requirements;
• activity and excursion preferences;
• emergency-contact information;
• travel insurance information where relevant;
• information required for train, flight, accommodation, attraction or other reservations; and
• other information reasonably required to arrange or administer your journey.

4.3 Special occasions and personal preferences

Where voluntarily provided and relevant to your journey, we may collect information relating to special occasions or preferences, including:

• birthdays;
• dates of birth;
• wedding dates;
• wedding anniversaries;
• honeymoon details;
• engagement or other celebration details;
• other special occasion dates;
• preferred room arrangements;
• celebration preferences;
• special requests; and
• other personal preferences relevant to creating or delivering your requested travel experience.

This information may be used, for example, to help arrange an appropriate room, celebration, welcome amenity, experience or other service requested by you.

You are not required to provide such information unless it is necessary for a particular service or you choose to provide it.

4.4 Information relating to children

Where children are travelling as part of a booking or enquiry, we may collect information necessary to arrange their travel, including:

• name;
• age or date of birth;
• accommodation or rooming information;
• dietary requirements;
• accessibility or mobility requirements;
• activity requirements or restrictions;
• travel-document information where required; and
• other information reasonably necessary to provide the requested services.

Where required, information relating to a child should be provided by a parent, legal guardian or other person authorised to provide the information on the child's behalf.

We seek to collect only information reasonably necessary for the relevant travel or service purpose.

Where information relating to a child includes health, medical, accessibility or other sensitive information, we handle it in accordance with the provisions of this Privacy Policy relating to special category personal data.

4.5 Information received from travel-industry partners

Where a booking or enquiry is made through a travel agent, tour operator, wholesaler, overseas DMC or other travel partner, that organisation may provide us with personal data relating to travellers.

This may include names, dates of birth or ages, travel dates, passport information, rooming arrangements, dietary or accessibility requirements, special occasions and other information necessary to provide the requested services.

The relevant travel partner may have separate privacy obligations in respect of the information it collects and provides to us.

4.6 Payment and financial information

Where you make or receive a payment relating to our services, we may process information necessary to administer, record and reconcile that payment.

This may include information relating to invoices, payment status, transaction references and other financial administration.

Where a payment is processed by a third-party bank, payment provider or other financial service provider, that provider may process payment information under its own terms and privacy practices.

D Ceylon Collection does not intend to retain complete payment-card details where payment processing is handled directly by an authorised third-party payment provider.

4.7 Communications

We may retain information contained in communications with you through:

• email;
• telephone;
• WhatsApp or other messaging services;
• website forms;
• social media; and
• other communication channels.

This may include the contents of enquiries, requests, quotations, booking discussions, amendments, complaints and other correspondence.

4.8 Website and technical information

When you visit our website, certain technical information may be collected automatically, depending on the technologies used on the website.

This may include:

• IP address;
• browser type;
• device type;
• operating system;
• pages visited;
• date and time of access;
• referring website;
• approximate technical location information; and
• information collected through cookies and similar technologies.

The use of cookies and similar technologies is addressed in our Cookie Policy, where applicable.

We may process personal data for the following purposes:

Travel enquiries and quotations

To understand your requirements, respond to enquiries and prepare quotations, proposals and itineraries.

Booking and travel arrangements

To arrange and administer accommodation, transportation, transfers, guides, excursions, activities, restaurants, wellness services and other travel services.

Booking administration

To confirm, amend, manage and administer bookings and travel arrangements.

Personalisation and special occasions

To personalise requested travel experiences and, where relevant, arrange services relating to birthdays, honeymoons, weddings, anniversaries, celebrations or other special occasions.

Communication

To communicate with you regarding enquiries, quotations, bookings, travel arrangements, amendments, cancellations and other matters relating to our services.

Customer service

To respond to questions, requests, complaints and other communications.

Health, safety and emergencies

To assist with emergencies or circumstances affecting the health, safety or welfare of a traveller where reasonably necessary and permitted by law.

Payments and accounting

To administer payments, invoices, refunds, accounting records and financial obligations.

Business administration

To maintain appropriate business records, manage customer and trade relationships, prevent fraud, recover debts and protect our legal rights.

Legal and regulatory compliance

To comply with applicable laws, regulations, court orders, lawful requests from authorities and other legal obligations.

Website operation and security

To operate, maintain, secure and improve our website, systems and services and to detect or prevent fraud, misuse or security incidents.

Marketing and communications

Where permitted by applicable law, to provide information about D Ceylon journeys, experiences, destinations, accommodation, offers, news and other relevant services.

You may opt out of marketing communications where applicable.

Depending on the circumstances and applicable law, D Ceylon Collection may process personal data where:

• processing is necessary to provide or administer a service or booking requested by you;
• processing is necessary to take steps at your request before entering into an arrangement or contract;
• you have provided consent where consent is required;
• processing is necessary to comply with a legal or regulatory obligation;
• processing is necessary to protect the life, health or safety of an individual in circumstances permitted by law;
• processing is necessary for a lawful public-interest purpose; or
• another lawful basis permitted under applicable data-protection legislation applies.

Where we rely on consent, you may withdraw that consent where permitted by law.

Withdrawal of consent does not affect processing that was lawfully undertaken before consent was withdrawn.

Where certain information is necessary to provide or administer a requested service, failure to provide that information may prevent us from confirming or delivering the relevant travel arrangement.

Some travel arrangements may involve information relating to health, medical requirements, accessibility, dietary requirements or wellness.

This may include information relating to:

• medical conditions;
• allergies;
• dietary requirements;
• mobility or accessibility;
• pregnancy;
• medical treatment;
• Ayurvedic treatments;
• wellness programmes;
• yoga or meditation;
• medical consultations; or
• other health or treatment-related services.

Health-related information may constitute special category personal data under applicable Sri Lankan data-protection law.

Where such information is processed, D Ceylon Collection will do so only where permitted by applicable law and where reasonably necessary for the relevant purpose, including arranging requested travel services, protecting health or safety, or on another lawful basis applicable to the circumstances.

Where required, we may seek appropriate consent before processing such information.

Relevant information may need to be shared with a hotel, doctor, hospital, medical provider, Ayurvedic practitioner, wellness provider, activity operator, guide or other supplier where reasonably necessary to provide the requested service or protect the traveller's health or safety.

We seek to limit health-related information to what is reasonably necessary for the relevant purpose.

We may collect and process personal data relating to children when arranging travel or other services for families and groups.

Children's information may include names, ages or dates of birth, accommodation and travel arrangements, dietary requirements, accessibility requirements, activity requirements and other information reasonably necessary to provide the requested services.

Where required, children's personal data should be provided by a parent, legal guardian or other person authorised to provide the information on the child's behalf.

We seek to collect and process children's personal data only where reasonably necessary for the relevant travel or service purpose and in accordance with applicable data-protection law.

Where children's information constitutes special category personal data, including health-related information, additional safeguards and lawful processing requirements may apply.

If you believe that information relating to a child has been provided to us without appropriate authority, please contact us using the details in this Privacy Policy.

We may disclose relevant personal data to third parties where reasonably necessary to provide, administer, support or improve our services.

These may include:

• hotels and accommodation providers;
• airlines and other transport providers;
• railway operators;
• drivers and transportation companies;
• guides;
• restaurants;
• attractions;
• excursion and activity providers;
• safari and wildlife operators;
• medical practitioners, hospitals and clinics;
• Ayurvedic and wellness providers;
• yoga and meditation practitioners;
• insurance providers where relevant;
• payment providers;
• banks and financial institutions;
• website hosting providers;
• technology and software providers;
• email and communication providers;
• customer-management and reservation systems;
• professional advisers;
• accountants and auditors;
• insurers;
• government authorities where required or permitted by law;
• travel agents and tour operators;
• overseas travel partners; and
• other suppliers or partners involved in delivering the requested travel arrangements.

We do not sell personal data as a commercial commodity.

We seek to disclose only information reasonably necessary for the relevant purpose and in accordance with applicable law.

D Ceylon Collection works with independent hotels, transport providers, guides, activity operators, wellness providers, medical providers and other travel suppliers.

Where necessary to arrange or deliver a service, relevant personal data may be provided to the applicable supplier.

Those suppliers may process personal data independently and may have their own privacy policies and legal obligations.

Where a supplier acts as a processor on our behalf, we will seek to apply appropriate contractual and organisational safeguards as required by applicable law.

Where a supplier acts independently as a controller, its own privacy practices and legal obligations may also apply.

D Ceylon Collection operates in an international travel environment. Personal data may therefore be accessed, processed or transferred across national borders where necessary for the provision or administration of our services.

This may occur, for example, where we:

• communicate with an international traveller;
• work with an overseas travel agent, tour operator or other trade partner;
• arrange travel for an individual travelling internationally;
• use an international technology, software or hosting provider;
• process payments through an international financial provider; or
• otherwise need to use a service provider located outside Sri Lanka.

Where personal data is transferred outside Sri Lanka, D Ceylon Collection will comply with applicable requirements governing cross-border data flows and apply the safeguards required by applicable law.

Where a transfer is subject to the Sri Lankan Personal Data Protection Act and its applicable cross-border requirements, we will use an appropriate lawful transfer mechanism or safeguard required by the applicable framework.

Where another jurisdiction's data-protection requirements apply to a particular transfer, we will apply the safeguards required by the applicable law.

D Ceylon Collection retains personal data only for as long as reasonably necessary for the purposes for which it was collected.

The retention period will depend on the nature and purpose of the information and may include consideration of:

• whether an enquiry or booking remains active;
• the period necessary to provide or administer travel services;
• the period required to maintain booking and customer records;
• accounting, financial and tax requirements;
• legal and regulatory requirements;
• the need to resolve complaints or disputes;
• the need to establish, exercise or defend legal claims;
• fraud prevention and security requirements; and
• legitimate business administration.

Different categories of information may therefore be retained for different periods.

When personal data is no longer reasonably required and there is no legal or legitimate reason to retain it, we will take reasonable steps to securely delete, destroy or anonymise it.

Where applicable law requires or permits longer retention, we may retain information for the required or permitted period.

We seek to maintain personal data that is accurate, complete and reasonably up to date for the purposes for which it is processed.

You may contact us if information you have provided to us needs to be corrected or updated.

We may also ask you to confirm or update information where this is reasonably necessary to provide travel services safely or accurately.

D Ceylon Collection takes reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, destruction or other unlawful processing.

Depending on the circumstances, these measures may include:

• appropriate access controls;
• limiting access to personal data to authorised persons;
• secure handling of electronic and physical records;
• appropriate password and account controls;
• security measures for systems and devices;
• secure communication and data-transfer practices where appropriate;
• supplier and service-provider controls; and
• procedures for identifying and responding to suspected data-security incidents.

No method of electronic transmission, storage or communication can be guaranteed to be completely secure.

D Ceylon Collection maintains procedures for identifying, assessing and responding to suspected personal-data breaches.

Where a personal-data breach occurs, we will take reasonable steps to contain, investigate and mitigate the incident.

Where notification to the Data Protection Authority, affected individuals or another authority is required under applicable law, we will make the required notification in accordance with the applicable requirements and procedures in force at the relevant time.

Subject to applicable law and any relevant limitations, you may have rights relating to your personal data, including rights to:

• request access to personal data held about you;
• request information about how your personal data is processed;
• request correction or completion of inaccurate or incomplete personal data;
• withdraw consent where processing is based on consent;
• request erasure or deletion where legally applicable;
• object to or request restriction of certain processing where legally applicable;
• request review of certain decisions based solely on automated processing where applicable; and
• exercise any other rights available under applicable Sri Lankan data-protection law.

Some rights may be subject to conditions, exemptions or other legal limitations.

We may need to verify your identity before responding to a request concerning personal data.

Where you make a request, please provide sufficient information for us to understand the request and locate the relevant information.

We will handle requests in accordance with the applicable legal requirements and procedures in force at the time.

To make a privacy-related request, please contact us:

Email: info@dceyloncollection.com

Please include:

• your name;
• contact details;
• the nature of your request; and
• any information reasonably necessary for us to identify the relevant records.

We may request additional information where reasonably necessary to verify your identity and protect personal data from unauthorised disclosure.

We will respond to requests in accordance with applicable law.

If you have a concern about how D Ceylon Collection has handled your personal data, we encourage you to contact us first so that we can investigate and address the matter.

D Ceylon Collection (Pvt) Ltd

No. 14, 3rd Floor, Liberty Plaza,

R. A. De Mel Mawatha, Colombo 03,

Sri Lanka.

Email: info@dceyloncollection.com

Where applicable under Sri Lankan data-protection law, you may also have the right to make a complaint or appeal to the Data Protection Authority of Sri Lanka.

D Ceylon Collection does not currently make decisions about travellers that produce legal or similarly significant effects based solely on automated processing without appropriate human involvement.

We may use ordinary technology, software or automated tools for administrative purposes, such as managing enquiries, communications, reservations, website operation or security.

If our processing practices change in a way that involves solely automated decision-making or profiling subject to specific legal requirements, we will review and update our practices and this Privacy Policy as appropriate.

Where applicable law requires D Ceylon Collection to designate or appoint a Data Protection Officer, we will make the appropriate designation or appointment and provide the relevant contact details as required.

For general privacy enquiries, please contact:

info@dceyloncollection.com

Where permitted by applicable law, we may send information about D Ceylon Collection, our journeys, experiences, destinations, accommodation, offers, news and related services.

Where consent is required, we will obtain the appropriate consent before sending such communications.

You may opt out of marketing communications at any time by using the available unsubscribe mechanism or contacting us at info@dceyloncollection.com.

Opting out of marketing communications will not affect communications that are necessary for an existing enquiry, booking, transaction, service or other legitimate business purpose.

Our website may use cookies and similar technologies for purposes such as website functionality, security, performance, analytics and other purposes depending on the technologies implemented on the website.

The specific cookies and technologies used may change over time.

Where applicable, information about these technologies, their purposes and available choices is provided in our Cookie Policy or through the relevant website cookie controls.

Our website or communications may contain links to websites, platforms or services operated by third parties.

Those third parties may have their own privacy policies, terms and data-processing practices.

D Ceylon Collection is not responsible for the independent privacy practices of third-party websites or services that operate outside our control.

We encourage you to review the privacy information provided by third parties before providing them with personal data.

We may receive personal data about you from another traveller, family member, employer, travel agent, tour operator, wholesaler, overseas partner or other person arranging travel on your behalf.

The person providing the information should ensure that they are authorised to provide it where required.

Where appropriate, we may rely on the relevant travel partner or person arranging the booking to provide required privacy information to the traveller.

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, regulatory guidance or data-processing practices.

The latest version will be published on our website with the relevant Last Updated date.

We encourage you to review this Privacy Policy periodically.

If you have any questions, requests or concerns regarding this Privacy Policy or the way we process personal data, please contact us:

D Ceylon Collection (Pvt) Ltd

No. 14, 3rd Floor, Liberty Plaza,

R. A. De Mel Mawatha, Colombo 03,

Sri Lanka.

Email: info@dceyloncollection.com

Company Registration No.: PV 00370596