Privacy Policy
How we collect, use, protect and share your personal information.
1 About This Privacy Policy
Colombo City Tuk Tuk Tours (referred to as "we," "us," "our," or "the Operator") provides private tuk tuk tours, Colombo city tours, shore excursions, food tours, night tours and private transportation services in Sri Lanka.
This Privacy Policy explains how we handle personal information when you:
- visit or interact with our website;
- request information or a quotation;
- make, change or cancel a booking;
- contact us by email, telephone, website form or WhatsApp;
- subscribe to travel updates or promotional communications; or
- participate in a tour operated or arranged by us.
We aim to follow fair, transparent and proportionate privacy practices consistent with applicable Sri Lankan law and internationally recognised data-protection principles. Where privacy laws outside Sri Lanka apply to a particular traveller, we will take reasonable steps to honour the rights provided by those laws.
2 Information We Collect
The information we collect depends on how you use our services.
2.1 Identity and Contact Information
We may collect:
- full name;
- email address;
- telephone and WhatsApp number;
- country of residence or nationality, where relevant to a booking;
- billing contact details;
- emergency contact information supplied voluntarily; and
- account details if you create a customer account on our website.
2.2 Booking and Tour Information
To arrange and operate a tour, we may collect:
- selected tour or transport service;
- preferred tour date and start time;
- number of adults and children;
- hotel, residence, port terminal or other pickup location;
- hotel name, room or lobby details where voluntarily provided;
- cruise ship name, expected arrival time and all-aboard time;
- flight, train or vessel timing where relevant to pickup planning;
- dietary information for food tours;
- accessibility, mobility or other assistance requests;
- route preferences, requested stops and special occasions;
- booking reference and booking history;
- communications about amendments, delays, complaints or refunds; and
- notes reasonably required for safety and service delivery.
2.3 Payment and Transaction Information
When you pay online, payment information is processed by the payment gateway or financial institution displayed at checkout. We do not normally receive or store your complete card number, card security code or online-banking password.
We may receive and retain limited transaction information such as:
- payment status;
- transaction or gateway reference;
- amount, currency and payment date;
- payment method category;
- limited card information such as card type or last four digits, where provided by the gateway;
- bank-transfer confirmation or deposit slip; and
- refund, reversal or chargeback records.
2.4 Website and Device Information
When you use our website, our systems and service providers may automatically collect:
- IP address;
- browser type and version;
- device type and operating system;
- approximate location derived from IP address;
- pages viewed and links selected;
- referring website;
- date, time and duration of visits;
- cookie identifiers; and
- technical logs used for security, diagnostics and fraud prevention.
2.5 Photographs, Reviews and Feedback
If you voluntarily provide a review, testimonial, photograph or video, we may collect and use that material in accordance with the permission you provide. We will not intentionally use an identifiable customer image for advertising without consent or another lawful basis.
3 How We Use Personal Information
We may use personal information to:
- check availability and respond to enquiries;
- create, confirm and manage bookings;
- collect and verify payments;
- communicate pickup instructions, driver details and operational updates;
- coordinate drivers, guides, vehicles, restaurants, attractions and other service partners;
- tailor a private itinerary to customer preferences;
- manage delays, cancellations, rescheduling, complaints and refunds;
- provide customer support by email, telephone or WhatsApp;
- maintain financial, tax, booking and audit records;
- protect customers, staff, drivers, systems and transactions from fraud or misuse;
- improve our website, tours and customer experience;
- send marketing communications where permitted, with an unsubscribe option; and
- comply with legal, regulatory, insurance, payment-processing or law-enforcement requirements.
4 Legal Grounds for Processing
Depending on the circumstances, we process personal information because:
- it is necessary to take steps at your request before a booking;
- it is necessary to perform our booking contract with you;
- we have a legitimate business interest, such as operating tours safely, preventing fraud, improving services or maintaining records;
- you have given consent, for example for optional marketing cookies or promotional messages;
- processing is needed to comply with a legal obligation; or
- processing is needed to establish, exercise or defend a legal claim.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out lawfully.
5 Cookies and Similar Technologies
Our website may use cookies, pixels, local storage and similar technologies to:
- keep the website and booking functions operating;
- remember preferences;
- maintain security and prevent misuse;
- measure website traffic and performance;
- understand which tours and pages are useful to visitors; and
- support advertising or remarketing where such tools are enabled and consent is required.
Further details are provided in our separate Cookie Policy. You can manage non-essential cookies through any consent tool made available on the website and through your browser settings.
6 Analytics
We may use analytics providers to understand aggregated website usage, such as page visits, device categories, traffic sources and booking-path performance. Analytics providers may set cookies or process technical identifiers. Where required, analytics cookies will be activated only after consent.
We use analytics information to improve navigation, identify technical errors, assess marketing performance and make tour information easier to find. We do not use analytics to make decisions that produce legal or similarly significant effects about individual travellers.
7 WhatsApp Communication
If you contact us through WhatsApp or ask us to contact you there, your messages, number, profile information and message metadata will also be processed by WhatsApp and its related service providers under their own terms and privacy practices.
We may use WhatsApp to:
- answer enquiries;
- confirm booking information;
- share pickup points or live operational updates;
- notify you of a driver's arrival;
- receive location pins or travel documents you choose to send; and
- resolve service issues.
8 Email Communication
We use email for booking confirmations, payment notices, invoices or receipts, pickup instructions, itinerary updates, customer support and legally required messages.
We may also send travel news or offers where you have subscribed or where otherwise permitted. Every promotional email will include a reasonable method to unsubscribe. We may retain a minimal suppression record so that we do not send further marketing to an address that has opted out.
9 When We Share Information
We do not sell personal information. We may disclose only the information reasonably necessary to:
9.1 Drivers, Guides and Tour Partners
We may share names, group size, contact number, pickup location, timing, route and relevant assistance requirements with the assigned driver, guide or service provider.
9.2 Payment and Banking Providers
Payment gateways, card networks, banks and fraud-prevention providers process payment and transaction information under their own privacy terms.
9.3 Technology and Business Service Providers
We may use providers for web hosting, email delivery, booking administration, analytics, security, customer support, cloud storage and data backup. Providers are permitted to process information only for the services they supply to us, subject to appropriate contractual or practical safeguards.
9.4 Attractions, Restaurants and Other Suppliers
Where a tour includes tickets, meals, reservations or third-party activities, we may share details required to make or manage that arrangement.
9.5 Legal and Safety Disclosures
We may disclose information where reasonably necessary to:
- comply with law, court orders or lawful government requests;
- cooperate with payment disputes or fraud investigations;
- protect the safety, rights or property of customers, staff, drivers or the public;
- enforce our booking terms; or
- obtain legal, accounting, insurance or professional advice.
10 International Data Transfers
Some technology, communications, analytics and payment providers may process information outside Sri Lanka. Where this occurs, we take reasonable steps to use reputable providers and safeguards appropriate to the nature of the information and applicable law.
By using an international communication platform such as WhatsApp or an overseas payment provider, your information may be processed in countries with privacy rules different from those in your home country.
11 Data Retention
We retain personal information only for as long as reasonably needed for the purpose for which it was collected, including legal, accounting, tax, insurance, fraud-prevention and dispute-resolution requirements.
Our general retention approach is:
| Record Type | Typical Retention Approach |
|---|---|
| Booking, invoice and payment records | Up to seven years after the relevant financial year, or longer where required by law or an active dispute |
| Completed-tour operational records | Normally up to three years, unless linked to accounting, insurance, safety or legal matters |
| Enquiries that do not become bookings | Normally up to twenty-four months after the last meaningful contact |
| Customer-support and complaint records | For the time needed to resolve the matter and manage legal or insurance risk |
| Marketing subscription records | Until consent is withdrawn or the list is no longer used; a minimal suppression record may be retained |
| Technical and security logs | For a limited period proportionate to security and diagnostic needs |
We may anonymise information so that it can no longer identify an individual. Anonymous statistics may be kept for business analysis without a fixed retention period.
12 Information Security
We use reasonable administrative, technical and organisational measures designed to protect personal information. Measures may include access controls, password protection, encryption in transit, secure hosting, software updates, backups, staff confidentiality practices and restricted access to booking information.
13 Your Privacy Rights
Subject to applicable law and reasonable identity verification, you may ask us to:
- confirm whether we hold personal information about you;
- provide access to relevant personal information;
- correct inaccurate or incomplete information;
- delete information where there is no lawful reason to retain it;
- restrict or object to certain processing;
- provide certain information in a portable format where applicable;
- withdraw consent for consent-based processing;
- stop direct marketing; and
- explain how a significant decision was made if automated decision-making is ever used.
Some requests may be limited where retaining information is required for tax, payment, fraud-prevention, legal-claim, safety or other lawful purposes. We will explain any material limitation.
To exercise a privacy right, contact us using the details below and describe your request. We may ask for information needed to confirm your identity and protect customer data.
14 Children's Information
Our tours may be booked for children by a parent, guardian or responsible adult. We do not knowingly invite children to create bookings independently. The adult making the booking is responsible for providing only the child-related information reasonably needed for safety, pricing or service delivery.
15 Third-Party Websites
Our website may link to attractions, social networks, review platforms, payment providers or other websites. Those websites operate independently and have their own privacy notices. We are not responsible for their content or privacy practices.
16 Changes to This Policy
We may update this Privacy Policy to reflect changes in law, technology, booking practices or service providers. The revised version will be posted on this page with a new "Last updated" date. Material changes may also be communicated through the website or booking channels where appropriate.
17 Contact Information
For privacy questions or requests, contact:
Colombo City Tuk Tuk Tours
Colombo, Sri Lanka
Email: help@colombocitytuktuk.com
Telephone / WhatsApp: +94 76 807 7242
Website: https://colombocitytuktuk.com
You may also contact the competent data-protection authority where you have the legal right to do so.