Privacy policy

1.1 When you send us a trip or a message. We keep what you enter in the form: your name, your email address, your phone number and country if you give them, and your message. With a trip request we also keep the trip itself: your dates, the number of adults and children, the children's ages, the places, hotels, activities and transport you chose, and the estimated price. We record that you ticked the box agreeing to be contacted.

1.2 When you book. To arrange a confirmed holiday, your travel designer will ask for more, usually by email: every traveller's name as it appears on their passport, dates of birth, flight times, your travel insurance details, and anything we need to know about health, diet or mobility. We ask for health information only so that we and our suppliers can look after you, and we use it only with your agreement.

1.3 When you save a trip. We store its stops and choices behind a private link that is hard to guess. A saved trip does not hold your name or contact details. Anyone you give the link to can see the trip.

1.4 While you design a trip. Your work in progress is kept in your own browser, on your own device, so that you do not lose it. It reaches us only if you save the trip or send it to us.

1.5 Technical information. Like most websites, the servers that run this site record standard details of each visit, such as your internet (IP) address, the type of browser and the pages requested. We use your IP address for a short time to stop the forms and live price checks from being misused.

1.6 When you pay. This website does not take payments itself. Ceylon Insider Travels sends you a secure payment link, and the payment is handled by Stripe. Stripe collects your card details and billing information directly. We never see or store your full card number. We receive a record of the payment: who paid, how much, when, and whether it went through.

1.7 Photographs and video. Our team, drivers and guides may take photographs and short videos during a holiday. The booking terms explain how we may use them and how to opt out.

1.8 What we do not collect. Visitors do not create accounts or passwords here, and we never ask for card details through this website. We do not buy information about you from anyone else.

2.1 To answer you. We use your contact details and your message to reply to your enquiry and to send you a checked itinerary and price. We do this because you asked us to.

2.2 To arrange your holiday. Once you book, we use your details to carry out our contract with you: reserving hotels, transport and activities, and helping you while you travel.

2.3 To meet our legal duties. We keep booking and payment records where tax, accounting or tourism law requires it.

2.4 To keep the site safe and working. We use technical information to protect the site against misuse and to find and fix faults.

2.5 To show what our holidays are like. Unless you have opted out, we may use photographs and video from your holiday on our websites, on social media and in other marketing, as the booking terms describe. You can opt out before you travel, or withdraw your permission later, by writing to us.

2.6 Nothing else. We do not sell, rent or trade your information. We do not pass it to advertisers, and we do not make decisions about you by automated means.

3.1 Currency. One small cookie remembers the currency you chose, so prices stay in it as you move around the site.

3.2 Your trip in progress. The holiday designer keeps your unfinished trip in your browser's own storage. Clearing your browser's site data removes it.

3.3 Staff sign-in. Our staff get a sign-in cookie when they use the admin area. Visitors never receive it.

3.4 No tracking. We do not use analytics, advertising or social media tracking cookies. If that ever changes, we will update this policy first and ask for your consent where the law requires it.

This site does not embed videos, maps or other content from outside services. It does link to other places, such as the Ceylon Insider Travels website, our social media pages and WhatsApp. Those services have their own privacy policies, and what they collect once you follow a link is between you and them.

5.1 The people who provide your holiday. Once you decide to book, we give hotels, drivers, guides and activity providers what they need to look after you: usually names, dates, the number of travellers, and any health, diet or mobility needs you have asked us to pass on.

5.2 Ceylon Insider Travels. Affordable Holidays is run by Ceylon Insider Travels, whose travel designers handle your enquiry and your booking and send your invoice and payment link. Its U.S. affiliate, Ceylon Insider Travels, LLC, may be involved in taking your payment.

5.3 Companies that work for us. The company that hosts this website stores its data for us. They may use your information only to provide their service to us.

5.4 Stripe and the banks. When you pay by card, Stripe handles the payment and uses your details under its own privacy policy, including to prevent fraud. When you pay by bank transfer, the banks involved see the payment details.

5.5 The authorities. We disclose information where the law requires it, for example to a court, the police or the tax authorities.

5.6 Live hotel prices. When we check a hotel's price online, we send only the hotel and the dates. Nothing about you goes with it.

We are based in Sri Lanka, and so are the hotels and suppliers who provide your holiday, so your information is used there. The servers that host this website, Stripe and our U.S. affiliate may hold it in other countries, including the United States. Wherever it is held, we treat your information as this policy describes.

7.1 Enquiries and bookings. We keep them for as long as we are dealing with you, and for a reasonable time afterwards to meet our legal and contractual duties, such as keeping accounts and answering any later question about your holiday.

7.2 Saved trips. We keep a saved trip so that its link carries on working. Ask us and we will delete it.

7.3 Server records. Standard server records are kept for a limited time and then deleted.

The website is served over an encrypted connection. Enquiries and bookings can be seen only by staff who sign in to our admin area, and the contracts and price lists we hold from suppliers are kept private. No website can promise perfect security, so please do not send us card numbers by email or message, or through the forms on this site. Card payments are made only through the secure payment link.

• show you the information we hold about you, and give you a copy
• correct anything that is wrong or out of date
• delete your information
• stop using it, or use it only in a limited way
• stop contacting you, by withdrawing the consent you gave us

To do any of these, contact us through our contact page. We may need to check that you are who you say you are, and we will answer as soon as we can and within the time the law allows. We cannot delete what the law obliges us to keep, such as accounting records of a booking. If you are unhappy with how we have handled your information, you may also complain to the data protection authority where you live.

This website is for adults planning a holiday, and bookings can be made only by someone aged 18 or over. We hold children's details, such as their ages and passport names, only when a parent or guardian gives them to us to arrange a family holiday.

We will update this policy when the way we handle information changes, and the date at the top of the page shows when it was last revised.