Privacy Policy & Security Standards
Effective Date: September 2026 • Ceylon Adventure Sports (Pvt) Ltd, Kitulgala, Sri Lanka
1. Information We Collect
When booking an expedition, requesting a corporate OBT proposal, or registering as a B2B travel partner, we collect essential operational information including:
- Contact details: Full legal name, corporate or personal email address, WhatsApp/phone number, and country of origin.
- Operational details: Group size, participant age distribution, dietary requirements, and medical disclosures relevant to swift-water safety.
- B2B Agency data: Business registration (BR) numbers, tourism licenses, and contracted wholesale billing entities.
2. Direct Bank IPG Payment Security (3DS 2.0)
Ceylon Adventure Sports does not store, log, or process credit/debit card numbers directly on our servers. All digital transactions are redirected to the Commercial Bank of Ceylon direct IPG using EMV 3-D Secure 2.0 protocol and signed with HMAC SHA-256 cryptographic verification tokens.
3. Purpose of Processing & Data Sharing
Collected customer details are used strictly for:
- Dispatching certified river guide rosters, lifejacket safety sizing, and expedition manifests.
- Generating verifiable digital check-in passes and official group vouchers.
- Fulfilling legal and insurance compliance requirements under Sri Lanka Tourism Development Authority (SLTDA) and International Rafting Federation (IRF) standards.
We never sell, lease, or monetize customer data with third-party ad networks or data brokers.
4. Data Subject Rights & Inquiries
Under international data protection regulations (GDPR / Sri Lanka Personal Data Protection Act No. 9 of 2022), you maintain the right to access, rectify, or request deletion of your personal contact records upon completion of your expedition.
For privacy-related inquiries, contact our Data Governance Officer at privacy@ceylonadventuresports.com or call our Kitulgala base at +94 77 123 4567.