Privacy
Policy

Who we are

Palmora Escapes is a Sri Lanka based travel company. In this policy, “Palmora Escapes”, “we”, “us” and “our” refer to the business responsible for deciding how personal information is used when you enquire with us or book travel through us.

For privacy questions or requests, contact reservations@palmoraescapes.com.

Information we collect

Depending on how you interact with us, we may collect:

• Identity details such as name, title, date of birth, nationality and passport information
• Contact details such as email address, telephone number, postal address and emergency contact
• Travel details such as destination, dates, accommodation, flight preferences, traveller numbers and children’s ages
• Booking and payment records, invoices, transaction references and refund information
• Communications, enquiries, feedback, complaints and special requests
• Technical information such as IP address, browser, device, approximate location, referring page and website activity where collected by our website services
• Marketing preferences and records of consent

How we collect information

We collect information directly when you complete a form, email, call, use WhatsApp or social media, request a quotation, make a payment or manage a booking. The lead traveller may provide information about other people in the same booking and must have permission to do so.

We may also receive information from travel companions, agents, airlines, hotels, tour operators, transfer providers, payment services, insurers, public authorities and website or security providers.

How we use information

We may use personal information to:

• Respond to enquiries and prepare personalised quotations
• Create, confirm, change and support travel bookings
• Share necessary details with airlines, hotels and other travel suppliers
• Take and record payments, issue invoices and manage refunds
• Send confirmations, reminders, schedule changes and important travel information
• Provide assistance before, during and after a journey
• Prevent fraud, protect our website and keep business records
• Meet tax, accounting, regulatory and legal requirements
• Improve our service and, where permitted, send relevant marketing

Legal bases for using information

Where data-protection law requires a legal basis, we rely on one or more of the following: taking steps at your request before a booking, performing our agreement with you, complying with a legal obligation, pursuing legitimate business interests, protecting a person’s vital interests, or your consent.

Our legitimate interests may include operating and improving the business, preventing fraud, supporting customers and keeping appropriate records. We consider your rights before relying on this basis. You may withdraw consent at any time, although this does not affect earlier lawful use.

Health, dietary and other sensitive information

You may choose to tell us about health, mobility, accessibility, dietary, religious or other needs so we can request suitable arrangements. We use this information only where necessary and permitted, normally with your explicit consent or to protect vital interests in an emergency.

Please provide only information relevant to the journey. We may need to share it with the suppliers responsible for providing the requested assistance.

Who we share information with

We share only the information reasonably needed with recipients such as airlines, hotels, resorts, tour operators, transfer companies, activity providers, destination representatives, booking systems, payment processors, insurers and technology providers.

We may also share information with professional advisers, accountants, auditors, banks, fraud-prevention services, regulators, immigration or border authorities, law-enforcement bodies and courts where required or permitted by law. We do not sell personal information.

International data transfers

Travel is international, so booking information may be sent to suppliers and authorities in your destination, transit countries or other locations. Privacy protections in those countries may differ from those in Sri Lanka or your home country.

Where required, we take reasonable steps to use recognised safeguards or rely on another lawful transfer method. Some transfers are necessary to perform the travel arrangements you request.

Payment information

Payments may be handled by banks, card processors or other payment providers. Those providers process payment information under their own privacy and security terms. Palmora Escapes may receive transaction confirmations, payment references and limited account information needed for records, refunds or fraud prevention.

Do not send complete card details through ordinary email, WhatsApp or an unsecured form.

Cookies and website data

Our website and the services supporting it may use cookies, pixels, logs or similar technologies for essential operation, security, preferences, form delivery, performance measurement and analytics.

Some technologies may be provided by our WordPress host, security tools, form provider, social networks or embedded services. Where consent is required, non-essential technologies should be used only after a visitor has been given an appropriate choice. Browser settings can block or remove cookies, but parts of a website may then work differently.

Marketing choices

We may send travel news or offers where you have consented or where otherwise permitted by law. You can unsubscribe using the option in a message or contact us at any time.

Service messages about an enquiry, payment, booking, disruption or safety are not marketing and may still be sent when necessary.

How long we keep information

We keep personal information only for as long as reasonably needed for the purpose collected. Retention depends on the type of enquiry or booking, supplier requirements, complaint and insurance periods, and legal, tax, accounting and fraud-prevention obligations.

When information is no longer required, we take reasonable steps to delete, anonymise or securely restrict it. Backup copies may remain for a limited period before routine deletion.

How we protect information

We use reasonable organisational and technical measures intended to protect personal information against accidental loss, unauthorised access, misuse, alteration or disclosure. Access should be limited to people and providers who need the information for their role.

No internet transmission or storage method is completely secure. Please contact us promptly if you believe information connected with your booking has been compromised.

Your privacy rights

Depending on the law that applies to you, you may have rights to request access, correction, deletion, restriction, objection, portability or withdrawal of consent. You may also have the right to complain to the relevant data-protection authority.

Email us with the request and enough information to identify you and the relevant enquiry or booking. We may ask for proof of identity and may retain information where the law permits or requires it. We will respond within the period required by applicable law.

Children’s information

We may process a child’s name, age, passport details, dietary needs and travel information when an adult includes the child in a booking. The adult making the booking must be authorised to provide this information.

Our website and booking services are intended for adults. Children should not submit information directly without the involvement of a parent or guardian.

External websites and services

Our website may link to airline, hotel, payment, social-media or other third-party services. Those organisations control their own websites and privacy practices. Please review their privacy notices before providing information to them.

Changes to this policy

We may update this policy when our services, suppliers, technology or legal obligations change. The latest version will appear on this page with its updated date. Significant changes may also be communicated directly where appropriate.

Contact us about privacy

Contact Palmora Escapes if you have a question, wish to exercise a privacy right or want to raise a concern about the way information has been handled.