CeylonreiseThe island as we know it
ENDE
Enquire
Private toursYour own driver-guideTour & beachCulture first, then the seaSafari & wildlifeLeopards, elephants, whales

Privacy policy

We take the protection of your data seriously. This policy explains which personal data we process when you visit our website or send us an enquiry, why, and on what legal basis. It applies to visitors from the UK, the EU, the USA and elsewhere. Last updated: September 2026.

1. ControllerTrimowa UG (haftungsbeschränkt) Brand: Ceylonreise Ursulinenstraße 35 66111 Saarbrücken Germany Phone: +49 1579 2530699 Email: travel@ceylonreise.com We are not legally required to appoint a data protection officer. If you have any questions about your data, simply write to the email address above.
2. Hosting, Cloudflare and server log filesOur website runs on a server operated by Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany. We have a data processing agreement with Contabo (Art. 28 GDPR). To make the website load quickly worldwide and protect it against attacks, we use the Cloudflare network (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). All page requests pass through Cloudflare servers, which process technical data such as IP address, browser, the page requested and the time in order to deliver and cache the pages and fend off attacks. The legal basis is our legitimate interest in a secure and fast website (Art. 6(1)(f) GDPR / UK GDPR). We have a data processing agreement with Cloudflare; Cloudflare is certified under the EU-US Data Privacy Framework and the UK Extension (Art. 45 GDPR). When you visit the website, your browser automatically sends technical data: IP address, date and time, the page requested, referrer URL, browser type and operating system. We need this data to deliver the website securely and reliably and to fend off attacks (Art. 6(1)(f) GDPR / UK GDPR – legitimate interests). Server log files are deleted after 14 days at the latest unless they are needed to investigate a security incident.
3. Enquiries, call requests and contactWhen you send us an enquiry via a form, by email, phone or WhatsApp, we process the details you give us – for example name, email address, phone number, travel dates, length of trip, number of travellers, hotel preference and your message – as well as the page you sent it from, your selected currency and your country (derived from your connection). We use this data to reply to your enquiry and to prepare a travel proposal (Art. 6(1)(b) GDPR / UK GDPR – steps prior to entering into a contract). Your enquiry is stored in our content management system on our server and forwarded to our team by email. For this we use the email services of IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany) and Namecheap, Inc. (4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA). Where data is transferred to the USA, this is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). If you do not book, we delete your enquiry no later than two years after our last contact. If you book, we keep the data for as long as commercial and tax law requires (up to ten years).
4. Spam protectionTo protect our forms against automated spam, we check how quickly a form was filled in, whether a field invisible to humans was completed, and whether the domain of your email address can receive email. We also limit the number of enquiries per IP address; for this purpose the IP address is held only briefly in the server’s memory and is not stored permanently. The legal basis is our legitimate interest in a working enquiry system free of abuse (Art. 6(1)(f) GDPR / UK GDPR).
5. NewsletterIf you sign up for our newsletter, we use your email address only to send you new tour dates and stories from Sri Lanka (Art. 6(1)(a) GDPR / UK GDPR – consent). You can unsubscribe at any time using the link in every issue or by sending a short message to travel@ceylonreise.com. We will then remove your address from the list.
6. Chat assistant and WhatsAppThe chat assistant on our website answers common questions automatically, directly in your browser. What you type is not sent to us or to anyone else and is not stored. You can message us directly via the WhatsApp links. WhatsApp only opens once you click such a link; the privacy policy of WhatsApp Ireland Limited (Merrion Road, Dublin 4, Ireland) then applies. We treat messages you send us via WhatsApp like an enquiry (see section 3).
7. Cookies and local storageStrictly necessary cookies (§ 25(2) no. 2 TDDDG; PECR for UK visitors): – “currency”: remembers the currency you chose for prices – £, US$ or € (12 months). – “country”: your country, derived from your connection, so we can show prices in a suitable currency (30 days). – “lang”: remembers whether you prefer the English or the German website (12 months). – “cr_consent”: stores your choice in the cookie banner (12 months). – Login cookies for our content management system (staff only). Only with your consent (see section 8): – Google Analytics: “_ga” and “_ga_…” (up to 14 months). – Google Ads: “_gcl_au”, “_gcl_aw” and similar (up to 90 days). – “cr_ads”: stores the click ID of a Google ad (gclid, gbraid or wbraid) so we can tell whether an enquiry came from an ad (90 days).
8. Google Tag Manager, Google Analytics and Google AdsWe use services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Tag Manager: a tool we use to manage the measurement code on our website. Tag Manager itself sets no cookies and does not analyse any data; when it loads, your IP address is necessarily transmitted to Google. Consent Mode (v2): in our own cookie banner (we do not use an external consent platform) you decide whether Google may set cookies. Until you accept or decline, Google Analytics and Google Ads do not set or read cookies. Only cookieless signals are sent (for example page view, time, device and browser, and whether consent was given), which Google uses for statistical modelling and does not link to an individual. The legal basis is our legitimate interest in basic measurement of our website and ads (Art. 6(1)(f) GDPR / UK GDPR). With your consent (“I agree”): – Google Analytics 4 records which pages you view, how long you stay, which website you came from, your approximate location (country/city), your device and browser, and whether you send an enquiry, request a brochure or contact us via WhatsApp, phone or email. Google Analytics 4 does not store IP addresses. The data is deleted after 14 months. – Google Ads measures whether a visit from one of our Google ads leads to an enquiry or contact (conversion tracking) and may show our ads again to visitors of our website (personalised advertising). When you send an enquiry, we pass your email address and phone number to Google in encrypted form (a hash) (“enhanced conversions”) so that Google can match the enquiry to an ad click; Google uses these values only for this match. We store the ad click ID (gclid) with your enquiry. If you book, we report only this ID, the time and the value of the booking to Google – no names or contact details. We use this to improve our website and our advertising and to measure how well they work. The legal basis is your consent (Art. 6(1)(a) GDPR / UK GDPR, § 25(1) TDDDG, PECR). Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework and the UK Extension (adequacy decision, Art. 45 GDPR). You can withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer. We then delete the Google cookies and “cr_ads” in your browser.
9. Embedded videos (YouTube)Some pages contain videos from YouTube (Google Ireland Limited). We use the privacy-enhanced mode (youtube-nocookie.com): a video is only loaded when you click on it. Only then is a connection to YouTube established and your IP address and technical data sent to Google (Art. 6(1)(a) GDPR / UK GDPR – your consent by clicking).
10. FontsThe fonts on this website are loaded from our own server. No connection is made to servers of Google or any other provider.
11. Reviews and external linksWe show reviews that guests published on Tripadvisor after travelling with us – with first name or user name, place of residence and month of travel, as publicly shown there. No data about your visit is transferred to Tripadvisor. Links to other websites are simple links; data is only transferred to the provider once you click on them, and the provider’s privacy policy then applies.
12. Your rightsYou have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interests (Art. 21). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)). A short message to travel@ceylonreise.com is enough. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Unabhängiges Datenschutzzentrum Saarland, Fritz-Dobisch-Straße 12, 66111 Saarbrücken, Germany. If you live in the UK, you can also contact the Information Commissioner’s Office (ico.org.uk). Visitors from the USA: we do not sell or share personal information for cross-context behavioural advertising. You can ask us at any time which data we hold about you and have it deleted.
13. Data securityAll data on this website is transferred with SSL/TLS encryption (recognisable by “https://”). Only staff who need enquiries to plan your trip have access to them.
14. Tour brochuresWhen you request a tour brochure (PDF), we store your email address, the tour you chose, the country of your connection, the time and how often you downloaded the brochure. We email you the download link (valid for 30 days) and will get in touch personally at most once in case you have questions about the tour. You will not receive a newsletter. The legal basis is your request (Art. 6(1)(b) GDPR / UK GDPR) and our legitimate interest in a single follow-up (Art. 6(1)(f)), which you can object to at any time. We delete the data no later than two years after your request.
16. Payments with StripeFor card payments and for saving a credit card as a guarantee for booked services we use the payment provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. When you save a card or pay, you enter your card details directly on a Stripe page; we never receive your full card number, only your name, email address, card type, the last four digits and the expiry date. Stripe processes the data to carry out the payment, prevent fraud and authenticate the card (3-D Secure). The legal basis is the performance or preparation of the contract (Art. 6(1)(b) GDPR / UK GDPR) and our legitimate interest in secure payment processing (Art. 6(1)(f)). Data may be transferred to Stripe, Inc. in the USA; Stripe is certified under the EU-US Data Privacy Framework and its UK extension. We keep payment records for as long as statutory retention periods require (up to 10 years). More information: https://stripe.com/gb/privacy
17. Live chat with CrispYou can write to us through a chat window on our website. Common questions are first answered by the chat window itself, without any data going to third parties. Only if you want to send your own message to our team and expressly agree to this do we load the live chat of the provider Crisp IM SAS, Nantes, France. Crisp then processes your messages, your name and email address if you provide them, and technical data such as IP address, browser, device, language and the page you are on. This allows us to read and answer your message, including through our smartphone app. The legal basis is your consent (Art. 6(1)(a) GDPR / UK GDPR, § 25(1) TDDDG) and, for questions about a trip, the preparation or performance of the contract (Art. 6(1)(b)). You can withdraw your consent at any time with effect for the future by clearing this website's data in your browser or by writing to us. We keep chat transcripts for as long as they are needed to deal with your request or statutory retention periods apply. We have a data processing agreement with Crisp. More information: https://crisp.chat/en/privacy/