Privacy policy.

This Privacy Policy explains how D'Bro Sri Lanka Travels ("we", "us", "our") collects, uses, and protects your personal data when you use our website at dbrosrilankatravels.com or contact us about a trip. We respect your privacy and are committed to protecting your data in line with the EU General Data Protection Regulation (GDPR) and the Sri Lankan Personal Data Protection Act (PDPA, 2022).

Who we are

D'Bro Sri Lanka Travels is a small private driver-guide service based in Sri Lanka. The data controller for any personal data submitted through this site is D'Bro Sri Lanka Travels. You can reach us at hello@dbrosrilankatravels.com.

What data we collect

We only collect personal data you actively give us. There is no analytics tracking, no advertising pixels, and no third-party marketing cookies on this site.

When you submit an enquiry through the "Plan a trip" form, we collect:

• Your name (optional)
• Your email address (required)
• Your phone or WhatsApp number (optional)
• Number of travellers (optional)
• Approximate travel dates (optional)
• The tour you are interested in or your message (optional)
• Your IP address and browser user-agent (collected automatically, used only for spam protection and abuse prevention)
• The page you submitted the form from

Why we use your data

We use your data only to reply to your enquiry, plan your trip, and follow up if you book a tour. The lawful basis under GDPR is your consent (by submitting the form you ask us to contact you back) and our legitimate interest in running our business and responding to enquiries.

We do not send marketing emails, newsletters, or promotional content unless you explicitly opt in to them in a separate communication.

Where your data is stored and who processes it

Your data is stored and processed by the following sub-processors, all of whom offer GDPR-compliant Data Processing Agreements:

• TiDB Cloud (PingCAP) — primary database, AWS Frankfurt, EU
• Resend — sends us the enquiry notification email; based in the United States, transfers governed by Standard Contractual Clauses
• Brevo — contact CRM, Paris, EU
• Cloudflare — website CDN and edge security; data is served from the closest edge location to you
• Fly.io — API server hosting, Frankfurt, EU

How long we keep your data

We keep enquiry records for 2 years from the date of submission, then they are deleted, unless you have booked a tour with us — in which case we keep records for 7 years for tax and accounting purposes per Sri Lankan law.

If you do not wish for your enquiry to remain on file, just email us and we will delete it.

Cookies

We use only strictly necessary cookies required for the site to work and stay secure:

• Cloudflare security cookies (__cf_bm, occasionally cf_clearance) — used by Cloudflare to distinguish humans from bots and protect against abuse

We do not use analytics cookies, marketing or tracking pixels, or third-party advertising cookies. Because we only use strictly necessary cookies, no consent banner is shown.

Your rights under GDPR

You have the right to:

• Access — ask for a copy of the personal data we hold on you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data
• Restriction — ask us to stop processing your data while we resolve a query
• Portability — receive your data in a machine-readable format
• Object to processing on grounds related to your particular situation
• Lodge a complaint with your local supervisory authority — for example the Dutch Autoriteit Persoonsgegevens or the Belgian Gegevensbeschermingsautoriteit

To exercise any of these rights, email us at hello@dbrosrilankatravels.com. We will reply within 30 days as required by GDPR.

Children

Our service is intended for adults planning travel to Sri Lanka. We do not knowingly collect personal data from children under 16.

Changes to this policy

We may update this policy from time to time. The "last updated" date at the top reflects the most recent change. For material changes we will note it on this page.

Contact

For any privacy questions or to exercise your rights, contact us at hello@dbrosrilankatravels.com.