Privacy Policy

1. Information We Collect

We collect information you provide directly, including your name, phone number, email address, travel dates, passenger details, pickup/drop-off information, and any notes required to arrange your requested services.

We may also collect technical information such as device type, browser data, IP address, and website usage events for security, diagnostics, and service improvement.

2. How We Use Your Information

Your information is used to respond to inquiries, generate quotations, confirm bookings, coordinate travel services, process payments, issue refunds, prevent fraud, and comply with legal or regulatory obligations.

We may contact you by email, phone, or messaging platforms regarding your booking status, service updates, and required travel documentation.

3. Payment Data and Card Security

Card payments are processed by PCI-compliant payment gateway and acquiring bank systems. 28Holidays does not store full card number, CVV, PIN, or sensitive authentication data.

Payment transaction records, order references, and limited metadata may be retained for reconciliation, accounting, chargeback management, and compliance requirements.

4. Sharing of Information

We share personal data only as needed with transport operators, hotels, activity providers, payment service providers, and professional advisors to fulfill confirmed services.

We do not sell personal data. We may disclose data when required by Sri Lankan law, court order, lawful government request, or fraud and security investigations.

5. Data Retention

We retain personal data only for as long as required for operational, contractual, tax, accounting, dispute resolution, and legal compliance purposes.

When retention is no longer necessary, data is deleted or irreversibly anonymized.

6. Your Rights

You may request access, correction, or deletion of personal data, subject to lawful and contractual limitations. You may also object to non-essential processing where applicable.

To submit a request, contact info@28holidays.com. We may need to verify identity before completing certain requests.

7. Cookies and Tracking

We may use cookies and similar technologies for session management, security, analytics, and user experience optimization. You can manage cookie settings in your browser.

8. International Transfers and Security

Some service providers may process data outside Sri Lanka. We apply reasonable contractual and technical safeguards to protect data confidentiality and integrity.

While we implement appropriate security controls, no internet transmission or storage method is guaranteed to be absolutely secure.

9. Contact

For privacy or payment-data concerns, contact info@28holidays.com.