Privacy notice
Version 2026-11-14
The short version: we collect only what we need to answer you, we never sell it, and you can see or delete it whenever you like.
Who we are
This site is operated by [Company legal name to be added], [Registered address to be added] ([Company registration number to be added]). We are the controller of the personal data described here. For anything about your data, write to privacy@doyouknowsrilanka.com.
What we collect and why
| When you | We collect | Why, and our legal basis |
|---|---|---|
| Request a driver quote | Name, email, travel dates, party size, route, notes | To prepare and send your quote. Steps taken at your request before a contract (GDPR Art. 6(1)(b)). |
| Send a contact message | Name, email, your message | To reply to you. Our legitimate interest in answering enquiries (Art. 6(1)(f)). |
| Join the newsletter | Email address, date you confirmed | To send the newsletter. Your consent, given by confirming the link we email you (Art. 6(1)(a)). |
| List a business | Business name, description, contact details, registration type and number | To publish and verify your listing. Performance of our contract with you (Art. 6(1)(b)). Listing details are public; the registration number and enquiry email are not. |
| Send an enquiry to a business | Name, email, country, your message | To pass your enquiry to that business so it can reply. Steps taken at your request (Art. 6(1)(b)). |
| Sign in with Google | Your name, email address and Google account identifier | To create or open your account. Performance of our contract with you (Art. 6(1)(b)). We never see your Google password. |
| Create an account | Name, email, a scrambled (hashed) password, trips you save | To provide your account. Performance of our contract with you (Art. 6(1)(b)). |
| Choose cookie settings | A random identifier, your choice, the date | To remember and be able to demonstrate your choice. Legal obligation (Art. 6(1)(c)). |
We do not store your IP address in our database. Our hosting provider keeps short-lived server logs for security.
Verification documents
If you upload a registration document to verify your business, it is stored privately, seen only by our reviewers, never published, and deleted once the check is complete, or after 90 days at the latest.
Automated assistance
We use an AI service (Claude, provided by Anthropic) to help our reviewers. It reads the public text of a listing, and a verification document together with the registration details you typed, and gives our reviewer a recommendation. It is not given your account details or your enquiry email address. By default it only recommends: a person makes every decision to reject a listing or to grant or refuse verification, and you can ask us to look again at any decision. Anthropic acts as our processor and does not use this data to train its models under its commercial terms. [Confirm AI provider terms, location of processing and whether automatic approval is switched on to be added]
What we do not do
- We do not sell or rent personal data.
- We do not use cross-site tracking or advertising cookies.
- We do not make solely automated decisions that have legal or similarly significant effects on you.
Who we share it with
When you send an enquiry through a business's page, we pass your name, email, country and message to that business, which then handles them as its own controller. When you accept a driver quote, we pass the details needed for the journey to the driver who will carry it out. We also use service providers who process data on our instructions: a hosting provider and an email delivery provider. [Names and locations of hosting and email providers to be added]
Some of these recipients, including drivers in Sri Lanka, are outside the European Economic Area and the United Kingdom. Where data is transferred, we rely on standard contractual clauses or on the transfer being necessary to perform the contract you have asked for.
How long we keep it
- Quote requests, contact messages and enquiries to businesses: 24 months, then deleted automatically.
- Business listings: until you remove them or delete your account.
- Newsletter subscription: until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days.
- Accounts: until you delete your account. Accounts that are never verified are deleted after 7 days.
- Sign-in sessions: 30 days.
- Cookie choice records: 24 months.
Your rights
You have the right to access, correct, delete, restrict or object to the use of your data, to receive it in a portable format, and to withdraw consent at any time.
- If you have an account, you can download your data and delete your account from My account.
- Every newsletter has an unsubscribe link.
- For anything else, write to privacy@doyouknowsrilanka.com. We reply within one month.
You also have the right to complain to the data protection authority where you live.
Security
Passwords are stored only as salted hashes. The site is served over an encrypted connection, and access to the administration area is restricted to authorised staff.
Children
This site is not intended for children under 16 and we do not knowingly collect their data.
Changes
If we change this notice in a way that matters, we will update the version date above and tell account holders by email.