Privacy Policy

Who is responsible

Travel09 is operated by LAGOON DESTINATION TOURS PVT LTD, registered in Sri Lanka under number PV124637. Our registered address is 62/B Polwatha Road, Ampitiya, Kandy, Sri Lanka. We are responsible for personal information used for our own website, enquiries, bookings, accounts and business administration.

Hotels, transport operators and other suppliers may also be independent controllers for their own services. This notice covers travellers, people included in bookings, website visitors, driver applicants and supplier contacts.

Information we use

• Contact details: name, email, telephone, address and communication preferences.
• Travel details: dates, destinations, guests and child ages, accommodation, flight information, pickup locations, special requests and booking references.
• Account and security information: account identifiers, password hashes, verification records, IP addresses, device information and activity logs.
• Payments: amounts, currency, status, bank references, payment-link records, refund information and payment evidence you submit.
• Driver applications: Sri Lankan NIC number, identity-review information, contact and vehicle details, email verification and registration security records.
• Messages and website interactions, including information you choose to enter into travel-planning tools.

We receive information from you, an authorised booking organiser, relevant suppliers and service providers. An IP address is a security signal, not reliable proof of a person’s identity or exact location.

Purposes and legal grounds

• Enquiries, quotations, reservations and service communications: steps requested before a contract and performance of the relevant contract.
• Tax, accounting and legally required records: applicable legal obligations.
• Account security, fraud prevention, driver screening and handling disputes: our legitimate interests in operating a safe service, subject to your rights, or a legal obligation where applicable.
• Optional marketing and consent-dependent tracking: consent where required, or another specifically permitted basis under applicable law.

Required booking fields help us price or deliver the requested service. If required details are not supplied, we may be unable to complete it. Optional marketing is not a condition of booking.

Sensitive information and children

Provide passport or identity documents only when requested through an appropriate channel. Do not send passwords, card security codes or unnecessary documents through chat, ordinary enquiry fields or AI prompts.

Health, accessibility or dietary information can reveal sensitive personal data. Share only what is necessary to arrange assistance. Where required, we obtain explicit consent or use another lawful special-category condition before processing it. Parents or authorised adults provide children’s details for travel arrangements; children should not create independent booking accounts.

Suppliers, technology and international transfers

Relevant information may be shared with hotels, resorts, guides, transport and experience operators, banks and payment services, hosting and email providers, security services, professional advisers and authorities where legally required. We limit sharing to the relevant purpose.

Services can involve Sri Lanka, the Maldives and countries where our technology providers operate. Where transfer restrictions apply, a permitted mechanism is required, such as an adequacy decision, appropriate contractual safeguards or a narrowly applicable exception. You can request details of the safeguards relevant to your information using the contact details below.

Google Analytics is used only after an analytics choice in the shared website consent controls. Driver security may use Cloudflare Turnstile. External payment pages, maps and social-media sites also have their own privacy notices.

The shared website also requests fonts from Google Fonts, which receives connection information such as an IP address when fonts are fetched.

AI assistance and human review

Travel-planning tools process the information you enter to help suggest or organise an itinerary. Technology providers may process those requests to provide the feature. Do not submit sensitive documents in prompts. Check prices, availability and travel requirements before booking. You can request human assistance with a recommendation or an account decision.

Retention and security

Retention depends on the purpose and applicable record-keeping duties. Enquiries are kept while follow-up is reasonably needed; booking and payment records cover service delivery and applicable tax, accounting or claims periods. Account records are kept while needed to operate the account and resolve outstanding obligations. Security and driver-verification records are retained only for proportionate verification, fraud prevention, dispute or legal needs. Marketing suppression records may be retained to respect an unsubscribe request.

You can ask for the retention criteria applicable to a particular record. Closing an account does not necessarily delete records that must be kept by law. Access restrictions and technical safeguards reduce risk, but no system guarantees absolute security.

Your rights and complaints

Depending on applicable law, you may request access, correction, deletion, restriction, portability or information about processing; object to processing, particularly direct marketing; and withdraw consent. Withdrawal does not invalidate earlier lawful processing. We may request proportionate identity verification and explain any lawful reason we cannot fulfil a request.

Where the EU GDPR applies, we respond without undue delay and normally within one month. A permitted extension will be explained within that initial period. Other applicable statutory deadlines take precedence.

You may complain directly to a competent regulator without contacting us first. This may include the Sri Lanka Data Protection Authority, a relevant EU supervisory authority or the UK Information Commissioner, depending on the processing and applicable law.

Marketing, cookies and updates

Booking and verification messages are separate from marketing. You can unsubscribe from promotional messages or contact us to stop them. Use our Cookie Policy to review browser choices. This notice may be updated when our practices change; material changes requiring additional notice or consent will be handled accordingly.