Privacy Policy

ABOUT WONDERSCAPES TRAVELS

Wonderscapes Travels (Private) Limited, a Destination Management Company, is one of Sri Lanka's leading Destination Management Companies. We specialize in curated tours, holiday packages, and travel experiences across Sri Lanka, with a strong commitment to customer service, safety, and sustainability. Inspired by the admiration of guests from around the world who have been captivated by the beauty of Sri Lanka and the warm hospitality of our people and the Wonderscapes team, we continuously enhance our services by carefully selecting trusted partner suppliers. Our mission is to deliver the best possible experience of this magnificent country, regardless of budget.

---

THIS POLICY

Wonderscapes Travels takes the privacy of your personal information very seriously. This policy explains what information we collect, how and why we collect it, and how it is used. We regularly review and update this page to ensure transparency, clarity, and trust between all parties.

What information do we collect about you?

---

PERSONAL DATA & LEGAL BASIS

As of 25 May 2018, in the European Union, the processing of personal data is governed by the General Data Protection Regulation (GDPR). Wonderscapes Travels (Private) Limited processes personal data based on one or more of the following legal bases:

• The necessity to fulfil a contract (for example, when making a booking)
• Our legitimate interests (such as improving our services and preventing fraud)
• Compliance with legal obligations

---

WHERE WE COLLECT DATA

We may collect your personal data when you:

• Fill out forms on our website
• Contact us via email or telephone
• Communicate with us through social media platforms

This information is securely stored in our internal systems.

From time to time, we may use email marketing systems to share updates, offers, or promotions.

You may unsubscribe from these communications at any time.

---

WHY YOUR PRIVACY IS IMPORTANT TO US

We will collect certain information from you when you make an enquiry or book a trip with us. Typically we collect the following personal information:

• Basic Contact Details: Name, email address, phone number, country.
• Travel-Related Details: Address, date of birth, passport details, health information (only where necessary).
• Technical Details: Domain name, site usage statistics (e.g., page views, time on site).

Sensitive data (passport details, health conditions) will only be collected when strictly necessary and handled with the highest level of care.

---

HOW WE USE DATA

We use personal data to:

• Provide requested information and quotes.
• Process bookings and travel arrangements.
• Communicate changes or updates.
• Request feedback.
• Send marketing material (only with your consent).
• Ensure safety and comply with legal requirements.

---

CONTENT AND IMAGES

We will not use your images or content for marketing purposes without your explicit permission. We may request your consent to use photos (with or without attribution) on our website or social media platforms, and only if you agree.

---

DATA ACCESS AND SHARING

• Your data is accessible only to Wonderscapes staff who handle your inquiry or booking.
• We do not sell, lease, or rent personal data to third parties.
• In some cases, we may share necessary information (such as name and passport details) with trusted service providers (e.g., hotels, train ticket providers) solely for the purpose of fulfilling your booking.

---

DATA RETENTION

We retain your personal data only as long as necessary:

• Booking-related data: retained as required by applicable laws and regulations (up to 7 years).
• Marketing data: retained until you unsubscribe from our communications.

---

YOUR RIGHTS

Under GDPR and other data protection laws, you have the right to:

• Access the personal data we hold about you.
• Request correction or deletion of your personal data.
• Restrict or object to the processing of your personal data.
• Withdraw consent (where processing is based on consent).
• Lodge a complaint with your local Data Protection Authority (if you are in the EU).