Privacy & GDPR Data Protection

Ceylora Journeys (ceylorajourneys.com) is a bespoke Sri Lanka travel concierge. We act as the data controller for information you share with us through this website and our concierge channels.

• Trip enquiries: name, email, phone/WhatsApp, nationality, dates, travel party, budget tier and preferences.
• WhatsApp communications: messages you send to our concierge line.
• VIP booking receipts: the receipt image and booking reference you upload to claim VIP perks.
• SLTDA partner applications: business details, SLTDA licence number and certificate uploads.
• Newsletter: your email address.

We use your details to design your itinerary, match you with a licensed specialist, verify perks and vet partners. Our legal bases under UK/EU GDPR are your consent, steps taken at your request before a contract, and our legitimate interest in running a safe, quality-checked service.

Your details are shared strictly 1-on-1 with the single SLTDA-verified specialist you are matched with, only so they can plan and quote your trip. We never sell, rent or pass your data to mass mailing lists or advertisers.

Data is stored with an encrypted cloud provider. Receipts and partner certificates sit in private storage, viewable only by our concierge team through short-lived secure links.

Enquiries and receipts are kept for up to 24 months after your trip, partner records for the life of the partnership, and newsletter emails until you unsubscribe.

You may access, correct, delete, restrict or export your data, withdraw consent, or object to processing at any time. Email concierge@ceylorajourneys.com and we will respond within 30 days. You may also complain to your local data protection authority (e.g. the UK ICO).

We use only essential browser storage (for example, your chosen display currency). We do not use advertising cookies.