Privacy Policy

1. Who we are

Udawalawa Lanka Safari (Pvt) Ltd operates www.udawalawa.com and arranges private jeep safaris at Udawalawe and Yala National Parks. We are the data controller for the personal information described in this policy — meaning we decide what is collected and why.

Udawalawa Lanka Safari (Pvt) Ltd
7th Mile Post Junction, Udawalawe 70190, Sabaragamuwa Province, Sri Lanka
Email: info@udawalawa.com
Phone / WhatsApp: +94 77 083 3772

If you are in the United Kingdom or the European Economic Area, the UK GDPR or the EU GDPR applies to our handling of your information because we offer services to visitors in those regions. This policy is written to meet those standards for everyone, wherever you live.

2. What we collect

2.1 Information you give us when booking

Our booking form asks for exactly the following, and nothing more:

• Pickup date and preferred time
• Which park you want to visit (Udawalawe or Yala)
• Pickup location and drop-off location
• Number of passengers
• The quoted price for your safari
• Your telephone number
• Your email address
• Any notes or special requests you choose to add

We do not ask for your name, date of birth, passport number or nationality on the booking form. If you volunteer any of those in the notes field, or in a message to us, we will hold them only for as long as we need them to arrange your trip.

2.2 Payment information

Card payments are handled on a separate secure page operated by CyberSource (a Visa Inc. company). Your card number, expiry date and security code are entered on their systems and sent directly to them. We never receive, see or store your card details. We receive only the outcome of the transaction and a reference for it.

2.3 Information we receive when you contact us

If you email, call or message us on WhatsApp, we hold that correspondence and whatever information it contains so that we can answer you and arrange your safari.

2.4 Information collected automatically

• Technical data — IP address, browser type and version, operating system, device type, and the referring page. Our content delivery and security provider, Cloudflare, processes this for every visitor in order to serve the site and block malicious traffic.
• Usage data — pages viewed, time on page and general interaction with the site. This is only collected if you accept analytics cookies.
• Approximate location — inferred from your IP address, at country or city level. We cannot identify your precise location and we do not use device GPS.

3. Why we use it, and our legal basis

Under the UK and EU GDPR we must have a lawful basis for each use of your information. Ours are as follows:

We do not use your information to make automated decisions about you, and we do not build marketing profiles about individuals.

4. Who we share it with

We do not sell, rent or trade your personal information. We share it only with the following, and only as far as each of them needs it:

If you contact us through WhatsApp, your message is handled by WhatsApp (Meta) under their own privacy policy.

5. Cookies and tracking

A cookie is a small file stored on your device. When you first arrive we show a banner asking whether you accept analytics and advertising cookies. Until you accept, Google Analytics and Google Ads are held in a denied state and set no cookies for you. Declining keeps the whole website working normally.

Changing or withdrawing your choice

You can change your mind at any time, and it is as easy to withdraw consent as it was to give it. Use the button below, or the “Cookie settings” link at the bottom of any page on this site.

Change your cookie settings

You can also block or delete cookies in your browser settings, and you can opt out of Google Analytics entirely using Google's opt-out add-on.

6. How long we keep it

When a retention period ends, we delete the information or anonymise it so it can no longer be linked to you.

7. International transfers

We are based in Sri Lanka and our booking records are stored on servers there. Sri Lanka has not been the subject of an “adequacy decision” by the European Commission or the UK Government, which means it is not automatically recognised as offering the same standard of data protection as the UK or EEA.

If you book with us from the UK or EEA, you are asking us to arrange a service that can only be delivered in Sri Lanka, and your booking details must travel there for that to happen. Some of our service providers — Google and Cloudflare among them — also process data in the United States and elsewhere, under their own safeguards including the EU-US Data Privacy Framework and standard contractual clauses.

We keep the information we transfer to the minimum needed to run your safari, and we protect it with encryption in transit and restricted access. If you would like more detail about a specific transfer, please write to info@udawalawa.com.

8. Your rights

If the UK or EU GDPR applies to you, you have the following rights. They are free to exercise, and we will respond within one month.

• Access — ask for a copy of the personal information we hold about you.
• Rectification — have inaccurate or incomplete information corrected.
• Erasure — ask us to delete your information, where we have no overriding obligation to keep it (our accounting records, for example).
• Restriction — ask us to pause our use of your information while a dispute about it is resolved.
• Objection — object to processing we carry out on the basis of legitimate interests.
• Portability — receive the information you gave us in a structured, machine-readable format, or have it sent to another provider.
• Withdraw consent — where we rely on your consent, you can withdraw it at any time. Doing so does not affect anything we did before you withdrew it. For cookies, use the button in section 5; for marketing email, use the unsubscribe link or email us.

To exercise any of these, email info@udawalawa.com. We may ask you to confirm your identity before we act, so that we do not disclose your information to someone else.

Complaints

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to a data protection supervisory authority — in the UK, the Information Commissioner's Office; in the EEA, the authority in the country where you live or work. A list of EEA authorities is published by the European Data Protection Board.

9. Security

We take appropriate technical and organisational measures to protect your information:

• The whole site is served over HTTPS, so data in transit is encrypted.
• Card details are handled entirely by CyberSource on their own PCI DSS compliant systems and never reach ours.
• Access to booking records is limited to the people who need it to arrange your trip.
• Our site sits behind Cloudflare, which filters malicious traffic before it reaches us.

No system can be guaranteed completely secure. If a breach ever occurs that is likely to put your rights at risk, we will tell you and the relevant authority without undue delay.

10. Children

Our booking service is intended for adults. We do not knowingly collect personal information directly from children under 16. Children are very welcome on our safaris, but bookings that include them must be made by a parent or guardian, who should give us only the details needed for the trip. If you believe a child has given us information directly, contact us and we will delete it.

11. External links

This site links to third-party sites such as Google Maps, TripAdvisor and Wikipedia. Once you follow a link, that site's own privacy policy applies and we have no control over how it handles your information.

12. Changes to this policy

We review this policy whenever we change how we handle personal information, and at least once a year. The “Last Updated” date at the top shows when it last changed. If we make a change that materially affects your rights, we will make that clear on the site rather than relying on you to notice.