1. Who is responsible for your information?

Controller: Lumenoeva (Pvt) Ltd, trading through the Aqua Sri Lanka brand.

Registered office: Palli Wasalpaduwa, Koththanthivu 61252, Sri Lanka

Email: concierge@aquasrilanka.com

2. Information we may collect

Depending on how you use the website, we may process:

• your name, email address, telephone or WhatsApp number;
• your country of residence and preferred method of contact;
• travel dates, party size, activity interests, destination preferences, experience level, budget and other trip-planning information you choose to provide;
• operator or partner information, including business contact details, licences, certifications, insurance and listing information;
• messages, correspondence, enquiry references and follow-up history;
• technical information such as IP address, browser type, device information, security logs and basic website usage data; and
• consent records and communication preferences.

Please do not send passports, payment-card details, detailed medical records or other highly sensitive documents through the general contact form.

3. How we use personal information

We use information to:

• respond to questions and provide trip-planning assistance;
• identify potentially suitable activities, destinations and independent operators;
• request availability, quotations or further information when you ask us to do so;
• manage partner applications, listings, verification and commercial relationships;
• send administrative messages relating to an enquiry or booking;
• protect the website, prevent spam and fraud, and maintain records;
• comply with legal, accounting and regulatory obligations; and
• improve the clarity, accessibility and performance of the platform.

4. Legal grounds

Where a legal basis is required, processing is based on one or more of the following:

• steps requested by you before entering into a contract, or performance of a contract;
• your consent, including where you ask us to share an enquiry with an operator;
• our legitimate interests in operating a secure, responsive travel platform and managing partner relationships;
• compliance with a legal obligation; or
• the establishment, exercise or defence of legal claims.

We aim to apply the principles of Sri Lanka's Personal Data Protection Act No. 9 of 2022, as amended, when and to the extent applicable. Where our services are offered to individuals in the European Economic Area, United Kingdom or another jurisdiction with applicable privacy requirements, those requirements may also apply.

5. Sharing information with operators

Aqua Sri Lanka is an enquiry-led planning platform. We do not automatically send every message to every operator. When you ask us to obtain availability, a quotation or a booking proposal, we may share the relevant parts of your enquiry with selected independent activity providers, accommodation providers, transport providers or other travel partners.

We share only what is reasonably needed for that request. Those businesses may act as independent controllers for their own booking, safety, insurance and regulatory processes. Their privacy terms may therefore also apply.

6. Service providers and other recipients

Information may be processed by carefully selected providers supporting website hosting, email delivery, security, backups, analytics, customer communication, professional advice and business administration. We may also disclose information where required by law, to protect rights or safety, or in connection with a legitimate corporate transaction.

We do not sell or rent personal information to advertising companies.

7. International transfers

Aqua Sri Lanka is operated from Sri Lanka and works with Sri Lankan operators. Information submitted from another country may therefore be transferred to or accessed in Sri Lanka. Where data-protection law requires safeguards for an international transfer, we will use an appropriate legal mechanism or obtain specific consent where that is lawful and suitable for the particular transfer.

8. Cookies, analytics and embedded services

The website may use essential cookies needed for security, forms, language or session functions. Optional analytics, advertising or embedded third-party services should be activated only in accordance with the consent choices presented on the website.

The location map on the Contact page is click-to-load. No connection to OpenStreetMap is made through that map panel until a visitor actively chooses to load it.

9. Retention

General enquiries are normally retained for up to 24 months after the last meaningful interaction, then deleted or anonymised unless a longer period is needed for a continuing relationship, a booking, legal claims, fraud prevention or statutory recordkeeping. Booking, accounting and commercial records may be retained for the period required by applicable law.

10. Your rights

Depending on the law that applies to you, you may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or review of certain automated decisions. You may also have the right to complain to a competent data-protection authority.

Send privacy requests to concierge@aquasrilanka.com. We may need to verify your identity before acting on a request.

11. Security

We use reasonable technical and organisational measures designed to protect personal information, including access controls, secure connections, anti-spam controls, backups and restricted administration access. No internet transmission or storage system can, however, be guaranteed as completely secure.

12. Children

The general website and contact form are not directed at children acting independently. A parent or legal guardian should make enquiries concerning a minor and provide only the information necessary for safe trip planning.

13. External websites

Operator profiles and travel guides may link to independent websites. Aqua Sri Lanka does not control those websites' privacy practices. Please review their policies before providing personal information directly to them.

14. Changes to this policy

We may update this policy when the service, legal requirements or the tools used on the website change. The date at the top shows the latest published version.