Privacy Policy

Company: Ascencia (Pvt) Ltd, trading as Ascencia Travels

Registration: PV00305505 · Incorporated in Sri Lanka, 21 July 2024

Registered address: 200/1, 1st Lane, Egodawatta Road, Boralesgamuwa, Sri Lanka

Version: 2.0

Effective date: 21 July 2026

Welcome to Ascencia Travels. We are committed to designing exceptional private journeys across Sri Lanka while handling your personal information carefully and responsibly. This Privacy Policy explains how Ascencia (Pvt) Ltd, trading as Ascencia Travels ("Ascencia", "we", "us", "our"), collects, uses, stores, shares, and protects the personal information of the people who visit our website, contact us, or travel with us.

This Policy has been prepared in alignment with the Sri Lanka Personal Data Protection Act, No. 9 of 2022 (the "PDPA"), Sri Lanka's principal law governing how organisations collect, use, and protect personal data. It reflects our voluntary commitment to the principles it sets out — lawfulness, transparency, purpose limitation, data minimisation, accuracy, and confidentiality — regardless of the specific commencement date of any individual provision of the Act. We collect only the information we genuinely need; we are clear about why we need it; and we give you meaningful control over it.

1.Scope of This Policy

This Policy applies to personal information we collect and process in connection with our business as a Sri Lankan destination management company, however that information reaches us — whether through our website, by email, WhatsApp, or phone, through a travel advisor acting on your behalf, or in person while you are travelling with us.

This Policy does not apply to the websites, apps, or services of third parties, including hotels, airlines, activity providers, or social media platforms, even where we link to them or work with them. Please refer to those parties' own privacy policies, as explained further in Section 10.

2.What Is Personal Information

"Personal Information" means any information that relates to, and makes it possible to identify, a living individual. This includes, without limitation, a name, contact details, passport information, an IP address, or travel preferences, where these can be linked back to you.

Certain categories of information are treated as more sensitive under the PDPA, including information relating to health, religious or philosophical belief, and political opinion. Where we collect this kind of information — such as a dietary requirement rooted in religious practice or a medical condition relevant to your journey — we do so only where you have chosen to share it with us for the purpose of arranging your travel safely, and we apply additional care in how it is handled.

3.Information We Collect

We collect only the information necessary to respond to your enquiry and to arrange and deliver your journey. This includes:

• Identity & Contact Details: your full name, email address, phone or WhatsApp number, address, occupation, ages of travellers including children, and nationality and country of residence.
• Enquiry Details: the information you share about your travel plans, dates, party size, interests, and preferences.
• Travel & Logistics Data: once you proceed to book — guest names as they appear on passports, passport numbers and validity where required for hotel registration or visa purposes, travel dates, dietary requirements, and any medical or accessibility needs you choose to share so we can arrange your journey safely.
• Financial Information for Payment: where a payment or refund is made by bank transfer, limited details such as a bank account number and bank name, collected solely to complete that transaction. See Section 4 for how we handle card payments specifically.
• Communications: records of our correspondence with you by email, WhatsApp, our website contact form, and social media messages.
• Digital Analytics: your IP address, browser type, operating system, device information, and browsing behaviour on our website, collected passively to understand how our website is used (see Section 9).

We may also collect information from you in the following instances:

• You select optional or paid experiences while in Sri Lanka.
• You request assistance during your journey.
• You provide feedback on the products and services we arranged.

We collect this information on the basis of a legitimate interest — to be able to design and deliver your journey properly — and, where a payment or specific consent is required, on that basis instead. See Section 6 for how each type of processing is justified.

4.How We Handle Payment Information

We do not collect or store your credit or debit card details on our systems at any time. Card payments are processed directly through authorised, encrypted third-party payment gateways, and Ascencia Travels never sees or has access to your full card number, expiry date, or security code.

Where a payment or refund is made by bank transfer, we may collect limited financial information — such as a bank account number and the name of your bank — solely to complete that specific transaction. This information is used only for that purpose, is retained only for as long as necessary to process the payment or refund and to maintain accurate financial records as required by law, and is not used for any other purpose.

5.How We Collect Your Information

Most of the information we hold is provided to us directly by you — for example when you submit an enquiry through our website, message us on WhatsApp, or complete a booking. We refer to this as active collection.

In some cases, we do not receive your information directly from you. If your journey is arranged through a travel agent, tour operator, or other referring party, whether based in Sri Lanka or overseas, we may receive your name, contact details, and travel requirements from that party on your behalf. We treat this information with the same care as information you provide us directly, and this Policy applies to it in the same way.

We also collect a smaller amount of information passively, without you directly providing it, primarily through the use of cookies and analytics tools when you visit our website. This is limited to technical information such as your IP address, browser type, and the pages you visit, as described in Section 9.

6.How We Use Your Information, and Our Legal Basis for Doing So

Under the PDPA, we must have a valid legal basis for every way we use your personal information. The table below sets out our main purposes and the basis we rely on for each.

7.Sharing Your Information with Others

• Hospitality, Activity, and Transport Partners: we securely share the necessary details — such as names, dietary preferences, and check-in requirements — with accommodation providers, activity and experience providers, chauffeurs and transport operators, and field guiding teams, so they can deliver the services you have booked.
• Anyone Assisting with Your Journey: where something changes during your trip — such as a vehicle breakdown, a weather-related itinerary change, or a medical need — we may share the relevant details with whoever is helping to resolve that situation, limited strictly to what they need to assist you.
• Secure Payment Gateways: financial transactions are routed entirely through authorised, encrypted third-party payment processing applications, as described in Section 4.
• Legal Authorities: information will only be disclosed to government or law enforcement agencies where required by prevailing Sri Lankan law or applicable international aviation or travel safety requirements.

We ensure only the amount of personal information genuinely required is shared with each partner, and we expect every partner we work with to protect your information and use it only for the purpose it was shared. Where a hotel or other partner will have a direct relationship with you, such as at check-in, they may separately request information and will handle it under their own privacy policy, which we encourage you to review.

We do not sell your personal information, and we do not share it with any third party for their own independent marketing purposes.

8.International Data Transfers

Because most of our guests travel to us from the United Kingdom, Europe, Australia, and New Zealand, some of your information naturally originates outside Sri Lanka. In the ordinary course of arranging your journey within Sri Lanka, your information is processed here, within the country.

We do not transfer your personal information outside Sri Lanka, except where this is necessary to arrange onward travel you have requested — such as a connecting stay in another country — or where a travel advisor or agent acting on your behalf is located outside Sri Lanka. Where such a transfer is necessary, we take reasonable steps to work only with recipients who agree to handle your information carefully and to a standard consistent with this Policy.

9.Website Cookies and Analytics

We use a limited number of cookies and similar technologies on our website, primarily to understand how visitors use it so that we can improve it.

• Google Analytics: we use Google Analytics to help us understand how our website is used. Through the use of cookies, Google Analytics generates statistical information about website use, including information such as an IP address as you browse our website.
• Opting Out: if you do not want your website visit information reported by Google Analytics, you may install the Google Analytics opt-out browser add-on, available at tools.google.com/dlpage/gaoptout.
• Your Control: you can also adjust your browser settings to decline cookies at any time. This will not affect your ability to browse our website, though certain features may not function as intended.

This information is collected on the basis of a legitimate interest — to understand website traffic and how our visitors reach and use our website.

10.Third-Party Links and Social Media

Our website and marketing material may contain links to websites or platforms that are owned or managed by third parties, including Instagram, Facebook, YouTube, TikTok, X (formerly known as Twitter), LinkedIn, and WhatsApp. These third-party platforms are not controlled by Ascencia and are specifically excluded from this Policy.

These platforms have their own, separate privacy policies, and may follow different practices in how they process your personal information. We recommend you read the privacy policy of any third-party platform you engage with. If you contact us through Instagram, Facebook, or another social platform, we use the information you send only to respond to your enquiry, in accordance with both this Policy and the privacy policy of that platform.

We are not responsible for the content, accuracy, or privacy practices of any third-party website or platform, even where we link to or promote it.

11.Data Security

We take steps reasonably necessary to ensure your information is treated securely and in accordance with this Policy. We have implemented appropriate technical and organisational measures to protect the personal information in our possession against loss, misuse, unauthorised access, and unauthorised disclosure.

We restrict access to your personal information to those within Ascencia who have a genuine operational reason to access it.

The transmission of information over the internet is not completely secure. While we take reasonable measures to protect your information, we cannot guarantee the absolute security of information transmitted to our website, and any such transmission is at your own risk.

12.Retention of Your Information

We keep records of communications, bookings, payments, and itineraries as evidence of what was agreed and delivered. In the event of a complaint, dispute, insurance claim, or legal matter, these records allow us to establish the facts and protect both you and Ascencia.

• The Seven-Year Standard: personal data, booking records, and essential correspondence are held for seven (7) years from the date of your last interaction or completed journey with us. This reflects the time limit within which a contractual claim could generally be brought under the Sri Lankan Prescription Ordinance, and supports our compliance with statutory tax audit requirements.
• Repeat Guests: if you travel with us again within an active seven-year cycle, the retention period for your guest profile and preferences renews from the date of your most recent interaction.
• Erasure: where information is no longer needed, or the retention period has expired, we permanently delete or securely anonymise it.

The Right to Erasure described in Section 13 is not absolute. We may be legally required to retain certain transactional records, booking agreements, and correspondence — even following an erasure request — where this is necessary to comply with tax law or to preserve evidence for a potential legal or insurance claim within the retention period described above.

13.Your Rights Under the Personal Data Protection Act

As a data subject, you have the following rights in respect of your personal information:

• Right of Access: you may ask us to confirm whether we are processing your personal information, and to provide you with a copy of it.
• Right to Rectification: you may ask us to correct or complete personal information that is inaccurate or incomplete.
• Right to Erasure: you may ask us to erase your personal information, subject to the legal exceptions described in Section 12.
• Right to Restrict Processing: you may ask us to limit how we use your personal information in certain circumstances, for example while a request to correct it is being considered.
• Right to Object: you may object to our processing of your personal information where we rely on legitimate interest as our basis, including for marketing purposes.
• Right to Withdraw Consent: where our processing is based on your consent, such as for marketing communications, you may withdraw that consent at any time. This does not affect the lawfulness of any processing carried out before you withdrew it.
• Right to Data Portability: in limited circumstances — primarily where processing is automated and based on your consent or a contract with you — you may ask us to provide your information to you or to another party in a structured, commonly used, machine-readable format.
• Right to Complain: you have the right to lodge a complaint with the Data Protection Authority of Sri Lanka if you believe we have processed your personal information unlawfully. The Authority can be reached at www.dpa.gov.lk. We would, of course, welcome the opportunity to address your concern directly before you take this step.

14.How to Exercise Your Rights

To exercise any of the rights described in Section 13, please contact us at info@ascenciatravels.com. We may ask you to verify your identity before proceeding, to make sure your information is kept secure and is only released to you.

We will respond to your request within a reasonable period, and in any event within twenty-one (21) business days. Please note that we may need to retain certain records where we have a legal obligation or legitimate interest to do so, as described in Section 12.

15.Marketing Communications

We will only send you marketing communications — such as journey ideas or seasonal updates — if you have agreed to receive them. If you are a travel advisor or represent a travel business, we may send you newsletters or information related to industry promotions on the basis of a legitimate interest, while ensuring your rights are protected.

You can ask us to stop at any time by replying to any message, contacting the staff member who worked with you on your booking, or writing to info@ascenciatravels.com. We will never share your details with other companies for their own marketing purposes.

16.Children

Our services are arranged with the adult making the booking. Where a journey includes children, we collect only the information necessary to arrange their travel safely, provided to us by the booking adult, who confirms they have the authority to share it.

17.Testimonials and Guest Feedback

We are proud of the journeys we design for our guests. If you choose to provide us with written feedback, reviews, or photography following your trip:

• we may display your testimonial on our website or social media channels to showcase authentic guest experiences; and
• to protect your privacy, all published reviews are partially anonymised (for example, "Sophia M., United Kingdom"), unless you give us explicit written consent to display your full name.

18.Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The current version is always available on our website, and the effective date is shown at the top of this document. Where a change is material, we will take reasonable steps to bring it to your attention.

19.Contact Us

For any enquiries, data access requests, or questions regarding this Privacy Policy, please contact us:

Ascencia Travels

200/1, 1st Lane, Egodawatta Road, Boralesgamuwa, Sri Lanka

Email: info@ascenciatravels.com

Phone / WhatsApp: +94 77 738 3485

If you are not satisfied with our response, you may contact the Data Protection Authority of Sri Lanka at www.dpa.gov.lk.