The Curious Experience (“we”, “us”, or “our”) values your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and protect your information when you use our personalised travel itinerary services for Sri Lanka tours.

We adhere to the principles set out by the General Data Protection Regulation (EU) 2016/679 (the “GDPR”).

1. Data we collect

We collect only the information necessary to create a customised travel experience for you. This includes:

• Personal identification information:
  • Name
  • Email address
  • Phone number
  • Country of residence
• Travel preferences and requirements
• Accommodation preferences
• Activity interests
• Dietary requirements
• Budget preferences
• Any other relevant travel details you voluntarily provide
• Communication data: your interactions with us via email, phone, or online forms

2. Purpose of data collection

We collect your information solely for the following purposes:

• To design and propose a tailor-made travel experience plan that suits your preferences and requirements
• To communicate with you about your trip planning and respond to your inquiries
• To improve and personalise our services to ensure the best possible travel experience
• To comply with any legal obligations under applicable laws

3. Lawful basis for processing

We rely on the following lawful bases to process your personal data:

• Consent: You have given clear consent for us to process your personal data for a specific purpose.
• Contract: Processing is necessary to deliver our service to you (e.g., curating your travel experience plan).
• Legitimate interests: We have a legitimate interest in ensuring our services meet your expectations without compromising your rights and freedoms.

4. Data sharing

We do not sell, rent, or share your personal data with third parties for marketing or any other purposes.

In rare cases where essential (e.g., securing accommodation or special experiences on your behalf), we will obtain your explicit consent before sharing necessary information with trusted service providers, and we ensure they uphold strict confidentiality obligations.

5. Data retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

• Inquiry data: retained for 12 months
• Booking and service data: retained for 6 years (to comply with tax and contractual obligations)

After the retention period, your data will be securely deleted or anonymised.

6. Your rights under GDPR

As a data subject, you have the following rights:

• Right to access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of any inaccurate or incomplete data.
• Right to erasure: Request deletion of your data where appropriate (“right to be forgotten”).
• Right to restrict processing: Request us to limit the use of your data in certain circumstances.
• Right to data portability: Request your data be provided in a structured, machine-readable format.
• Right to object: Object to our processing of your data based on legitimate interests.
• Right to withdraw consent: Withdraw your consent at any time without affecting the lawfulness of processing based on consent before withdrawal.
• Right to lodge a complaint: File a complaint with a supervisory authority if you believe your rights have been violated.

7. Data security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction.

Examples include:

• Encrypted data storage
• Secure communication channels (SSL/TLS)
• Access controls and authentication

8. International data transfers

As we are based in Sri Lanka, and operate tours exclusively in Sri Lanka, we primarily process your data within the EU and Sri Lanka. 

We ensure any international data transfers meet GDPR requirements, using appropriate safeguards such as Standard Contractual Clauses where necessary.

9. Changes to this policy

We may update this Privacy Policy occasionally to reflect changes in law, best practices, or our services. The latest version will always be available on our website with the updated effective date.

10. Contact us

If you have any questions, concerns, or requests regarding your personal data or this Privacy Policy, please contact us:

hello@thecuriousexperience.com
+94 70 299 1951