CeylonreiseThe island as we know it
ENDE
Enquire

Privacy policy

We take the protection of your data seriously. This policy explains which personal data we process when you visit our website or send us an enquiry, why, and on what legal basis. It applies to visitors from the UK, the EU, the USA and elsewhere. Last updated: September 2026.

1. ControllerTrimowa UG (haftungsbeschränkt) Brand: Ceylonreise Ursulinenstraße 35 66111 Saarbrücken Germany Phone: +49 155 69222570 Email: [email protected] We are not legally required to appoint a data protection officer. If you have any questions about your data, simply write to the email address above.
2. Hosting, Cloudflare and server log filesOur website runs on a server operated by Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany. We have a data processing agreement with Contabo (Art. 28 GDPR). To make the website load quickly worldwide and protect it against attacks, we use the Cloudflare network (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). All page requests pass through Cloudflare servers, which process technical data such as IP address, browser, the page requested and the time in order to deliver and cache the pages and fend off attacks. The legal basis is our legitimate interest in a secure and fast website (Art. 6(1)(f) GDPR / UK GDPR). We have a data processing agreement with Cloudflare; Cloudflare is certified under the EU-US Data Privacy Framework and the UK Extension (Art. 45 GDPR). When you visit the website, your browser automatically sends technical data: IP address, date and time, the page requested, referrer URL, browser type and operating system. We need this data to deliver the website securely and reliably and to fend off attacks (Art. 6(1)(f) GDPR / UK GDPR – legitimate interests). Server log files are deleted after 14 days at the latest unless they are needed to investigate a security incident.
3. Enquiries, call requests and contactWhen you send us an enquiry via a form, by email, phone or WhatsApp, we process the details you give us – for example name, email address, phone number, travel dates, length of trip, number of travellers, hotel preference and your message – as well as the page you sent it from, your selected currency and your country (derived from your connection). We use this data to reply to your enquiry and to prepare a travel proposal (Art. 6(1)(b) GDPR / UK GDPR – steps prior to entering into a contract). Your enquiry is stored in our content management system on our server and forwarded to our team by email. For this we use the email services of IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany) and Namecheap, Inc. (4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA). Where data is transferred to the USA, this is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). If you do not book, we delete your enquiry no later than two years after our last contact. If you book, we keep the data for as long as commercial and tax law requires (up to ten years).
4. Spam protectionTo protect our forms against automated spam, we check how quickly a form was filled in, whether a field invisible to humans was completed, and whether the domain of your email address can receive email. We also limit the number of enquiries per IP address; for this purpose the IP address is held only briefly in the server’s memory and is not stored permanently. The legal basis is our legitimate interest in a working enquiry system free of abuse (Art. 6(1)(f) GDPR / UK GDPR).
5. NewsletterIf you sign up for our newsletter, we use your email address only to send you new tour dates and stories from Sri Lanka (Art. 6(1)(a) GDPR / UK GDPR – consent). You can unsubscribe at any time using the link in every issue or by sending a short message to [email protected]. We will then remove your address from the list.
6. Chat assistant and WhatsAppThe chat assistant on our website answers common questions automatically, directly in your browser. What you type is not sent to us or to anyone else and is not stored. You can message us directly via the WhatsApp links. WhatsApp only opens once you click such a link; the privacy policy of WhatsApp Ireland Limited (Merrion Road, Dublin 4, Ireland) then applies. We treat messages you send us via WhatsApp like an enquiry (see section 3).
7. Cookies and local storageWe only use a few cookies that are strictly necessary (§ 25(2) no. 2 TDDDG; PECR for UK visitors): – “currency”: remembers the currency you chose for prices – £, US$ or € (12 months). – “country”: your country, derived from your connection, so we can show prices in a suitable currency (30 days). – “lang”: remembers whether you prefer the English or the German website (12 months). – “cr_consent”: stores your choice in the cookie banner (12 months). – Login cookies for our content management system (staff only). We only set cookies for statistics with your consent (see section 8).
8. Google Analytics (only with your consent)If you click “Accept” in the cookie banner, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies (such as “_ga”) and records which pages you view, how long you stay, which website you came from, your approximate location (country/city), your device and browser, and whether you send an enquiry or contact us via WhatsApp, phone or email. Google Analytics 4 does not store IP addresses. We use this to improve our website and our tours. The legal basis is your consent (Art. 6(1)(a) GDPR / UK GDPR, § 25(1) TDDDG, PECR). Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework and the UK Extension (adequacy decision, Art. 45 GDPR). The data is deleted after 14 months. You can withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer. Without your consent, Google Analytics is not loaded.
9. Embedded videos (YouTube)Some pages contain videos from YouTube (Google Ireland Limited). We use the privacy-enhanced mode (youtube-nocookie.com): a video is only loaded when you click on it. Only then is a connection to YouTube established and your IP address and technical data sent to Google (Art. 6(1)(a) GDPR / UK GDPR – your consent by clicking).
10. FontsThe fonts on this website are loaded from our own server. No connection is made to servers of Google or any other provider.
11. Review sites and external linksWe link to reviews, for example on Tripadvisor. These are simple links; data is only transferred to the provider once you click on them, and the provider’s privacy policy then applies.
12. Your rightsYou have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interests (Art. 21). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)). A short message to [email protected] is enough. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Unabhängiges Datenschutzzentrum Saarland, Fritz-Dobisch-Straße 12, 66111 Saarbrücken, Germany. If you live in the UK, you can also contact the Information Commissioner’s Office (ico.org.uk). Visitors from the USA: we do not sell or share personal information for cross-context behavioural advertising. You can ask us at any time which data we hold about you and have it deleted.
13. Data securityAll data on this website is transferred with SSL/TLS encryption (recognisable by “https://”). Only staff who need enquiries to plan your trip have access to them.