Privacy Policy

1. Data Controller Identification

This website and travel booking system are operated by LIBORA TOURS ("we", "us", or "our"), an inbound destination management travel specialist headquartered in Thotagoda, Akmeemana, Galle, Southern Province 80000, Sri Lanka.

For all inquiries regarding our data handling practices or to exercise your statutory rights under the European Union General Data Protection Regulation (GDPR) or the Sri Lanka Personal Data Protection Act No. 9 of 2022 (PDPA), please contact our Data Protection Officer at:

• Email: info@liboratours.com
• Telephone: +94 78 166 9368 / +94 77 160 2335
• Office: Thotagoda, Akmeemana, Galle, Sri Lanka

2. Information We Collect

When you browse our catalog, submit an inquiry wizard form, contact us via WhatsApp, or reserve a private chauffeur tour, we may collect the following categories of information:

• Contact Identification Data: Full name, email address, international telephone/WhatsApp number, and country of origin.
• Expedition & Logistics Requirements: Desired arrival and departure dates, number of adult/child travelers, hotel accommodation tier (4-Star, 5-Star, or Boutique Heritage), preferred travel themes, and dietary or mobility requests.
• Travel Documentation (Upon Tour Confirmation): Passport copies or flight arrival/departure numbers required strictly for government airport clearances, national park entry permits (e.g., Yala/Udawalawe), and Sri Lanka Railways first-class observation train reservations.
• Technical & Telemetry Data: Anonymized IP address, browser type, device information, and interaction metrics processed via privacy-focused Google Analytics 4.

3. Purpose and Legal Basis for Processing

We process your data strictly under the following legal bases:

• Contractual Performance (Art. 6(1)(b) GDPR): Formulating custom price quotations, confirming hotel reservations, coordinating certified private chauffeur drivers, and securing entrance permits for UNESCO citadels.
• Explicit Consent (Art. 6(1)(a) GDPR): When you tick the privacy consent box on our booking wizard or initiate direct conversations via WhatsApp.
• Legal Compliance (Art. 6(1)(c) GDPR): Satisfying mandatory Sri Lanka Tourism Development Authority (SLTDA) ground operator reporting, accounting, and tax compliance regulations.
• Legitimate Interests (Art. 6(1)(f) GDPR): Ensuring website security, mitigating bot attacks, and optimizing our web performance.

4. Third-Party Disclosures & Partners

We never sell, trade, or monetize your personal information to third parties. Data is shared only with verified operational partners necessary to execute your trip:

• SLTDA Registered Partner Hotels & Villas: Guest names and booking dates for room reservation vouchers.
• Statutory Authorities: Sri Lanka Department of Wildlife Conservation (safari jeep permits) and Sri Lanka Railways (observation train seats).
• Designated Chauffeur Guide: Lead guest name and flight/pickup coordination details.
• Technology Service Providers: Encrypted hosting on Serverbyt / 20i / StackCDN infrastructure and Google Analytics telemetry.

5. Cookies & Telemetry Policy

We use cookies to maintain your language selection (?lang=ru|hi|ar|de), preserve form states, and monitor site health:

• Strictly Necessary Cookies: Hardened session cookies (PHPSESSID with Secure, HttpOnly, and SameSite=Lax flags) to prevent cross-site request forgery and authenticate requests.
• Preference Cookies: Storing cookie consent status and language preferences locally in your browser.
• Analytics Telemetry: Anonymized Google Analytics cookies (_ga) loaded asynchronously without tracking personally identifiable information (PII).

6. Your Statutory Rights (GDPR & PDPA)

As a valued traveler, you retain comprehensive rights over your personal data:

• Right of Access: Request a copy of all personal records we hold regarding your bookings.
• Right to Rectification: Request correction of inaccurate names, phone numbers, or dates.
• Right to Erasure ("Right to be Forgotten"): Request total deletion of your personal records from our database once travel services and statutory tax audit obligations have concluded.
• Right to Withdraw Consent: Revoke consent for communications at any time by messaging info@liboratours.com.

7. Security Measures & Encryption

We implement industry-standard cryptographic safeguards, including Transport Layer Security (TLS 1.2 & TLS 1.3), Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), and parameterized SQL database queries to shield your submissions against interception or unauthorized tampering.