Privacy policy

Account details — your name, email address, phone number and password when you register or make a booking.

Booking details — dates, destination, guest count, services and add-ons chosen, amounts paid, booking codes, and any notes or preferences you share with partners.

Payment information — payment details are collected and processed by our payment providers. We do not store full card numbers on our servers.

Device & usage data — browser type, device, pages visited, referral source and approximate location, used to keep the platform secure and to improve it.

Communications — messages you send us through support tickets, email, WhatsApp or chat, and our replies.

To create and manage your account and authenticate you.

To process bookings and payments, and send confirmations, booking codes and updates.

To share with partners only what they need to deliver your booking.

To provide customer support and resolve disputes.

To improve the platform, personalise your experience, prevent fraud and abuse, and meet legal, tax and accounting obligations.

Where required, we rely on one or more of the following: performing our contract with you (for example processing your booking), your consent (for marketing and some analytics cookies), our legitimate interests (security, fraud prevention and improving the platform), and legal obligations (such as accounting and regulatory requirements).

Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Partners — the details a partner needs to deliver your booking, typically your name, contact number, dates and any requests you made.

Payment providers — to process payments and refunds. They handle payment data under their own security and privacy policies.

Service providers — companies that help us run the platform, such as hosting, email and analytics providers, bound by data processing agreements.

Legal authorities — where required by law, regulation or legal process.

We do not sell your personal data, and we never share more than necessary.

We keep account and booking data for as long as your account is active and as needed to provide our services, honour our policies, and meet legal, tax and accounting requirements.

Support conversations and tickets are kept while they remain useful for ongoing support, then archived or deleted.

When data is no longer needed, we delete or anonymise it.

Passwords are stored using strong hashing, and traffic to the platform is encrypted in transit (HTTPS).

Access to personal data is limited to team members who need it for their work, and payment card data is handled by providers that meet industry security standards.

We monitor for suspicious activity, keep our software updated, and train our team on data handling. No system can be 100% secure; if a breach affects your data we will notify you as required by law.

Depending on where you live, you may have the right to:

• Access — ask for a copy of the personal data we hold about you
• Correction — ask us to fix inaccurate or incomplete data
• Deletion — ask us to delete your data where we have no legal need to keep it
• Objection & restriction — object to or ask us to restrict certain processing, including direct marketing
• Portability — ask for your data in a machine-readable format

To exercise any of these rights, email [email protected]. We respond within a reasonable time, usually within 30 days.

Cookies are small files stored on your device. We use them to keep you signed in, remember your preferences, measure how the platform is used and keep it secure.

Analytics helps us understand which pages are useful; where possible this data is aggregated or anonymised.

You can control or delete cookies through your browser settings. Blocking necessary cookies may affect how the platform works.

With your consent, we may send you offers, travel ideas and partner news by email or WhatsApp.

You can opt out at any time using the unsubscribe link in any email, by replying STOP on WhatsApp, or by contacting us.

Opting out of marketing does not stop essential service messages such as booking confirmations, security notices and payment receipts.

Our hosting and some service providers may be located outside Sri Lanka. Where data is transferred, we use providers that offer appropriate safeguards for your data, such as contractual protections.

The platform is not directed at children under 18, and we do not knowingly collect their personal data. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this policy from time to time. We will post the updated version on this page and update the "last updated" date. Significant changes may be highlighted on the platform or by email.

Privacy questions or requests? Email [email protected] or [email protected], or WhatsApp +94 70 303 1636. Kandyam is based in Kandy, Sri Lanka.