Who handles your information
This policy describes how Madu River Safari uses personal information for this website and its safari booking service in Balapitiya, Sri Lanka. In this policy, “we”, “us” and “our” mean Madu River Safari.
For a privacy question or request, call +94 75 900 3003 or contact us on WhatsApp. Include your booking reference if your request relates to a booking.
Information we collect
- Contact details: your name, email address and phone or WhatsApp number.
- Lead guest identification: a passport number for a Foreign booking or an NIC number for a Local booking, entered in the dedicated booking field.
- Trip details: your Local or Foreign nationality selection, package, safari date and start time, numbers of adults and children, and children’s ages when children are included.
- Optional arrangements: hotel pickup and drop-off addresses, requested vehicle, luggage information, organisation name and requests you choose to add.
- Booking and payment records: your reference, quotation and acceptance, prices, currencies, conversion rate, payment references and states, cancellations and booking updates.
- Service and technical information: enquiries and messages you send, and technical information processed by hosting and sign-in services, such as IP address, browser information and access or security logs. A signed-in hosting account identifier may be linked to your booking.
The booking form identifies required details. Without the information needed for your booking or a selected service, we may be unable to arrange it. We use the lead guest’s passport or NIC number to identify the booking; access to the full number is limited to authorised staff. Enter the number in its dedicated field. We do not require a passport or NIC image upload. Do not put card numbers, security codes, passwords, document copies or detailed medical records in the booking notes.
Why we use it
We use your information to answer enquiries; calculate the price for your selected package, nationality and guest ages; identify the lead guest’s booking using the required passport or NIC number; prepare quotations; record and manage reservations; arrange selected hotel transport or other agreed services; communicate about your visit; verify payments; and handle changes, cancellations, refunds and complaints.
We also use relevant records for accounting, meeting legal obligations, maintaining service security, preventing misuse and resolving disputes. The basis for use depends on the purpose and applicable law: taking steps you request before a booking, performing the booking agreement, complying with legal duties, protecting legitimate service and security interests, or your permission where required.
Prices are calculated from your choices. Eligible fixed-price reservations confirm automatically when submitted; quote-based bookings confirm when the current quotation is accepted. You can contact us for help correcting information or understanding a quotation or automated booking result. We have not added advertising profiling or a marketing mailing list to this website.
Children and other guests
The adult arranging a family or group booking should be authorised to provide the other guests’ information and should share this policy with them. A parent or guardian should provide or authorise children’s information.
We ask for children’s ages to assess pricing and suitable arrangements. The booking form does not require children’s full names. Share only the information needed for your trip, and contact us directly to discuss an assistance need without adding unnecessary sensitive detail to general booking notes.
Payments and private booking links
When Genie online checkout is available on your private booking page, payment details are entered on the payment provider’s hosted checkout. This website does not collect or store your card number or card security code. We keep transaction identifiers, amounts, currencies, the agreed exchange rate and verified payment states to reconcile your booking. Bank-transfer records may include the payment reference and evidence needed to check credited funds.
Your private booking link contains an access token. Anyone you share the complete link with may be able to view the booking and its available actions. Keep it private, particularly on shared devices, and contact us if you think it has been disclosed to someone unintended.
Browser storage, cookies and overseas services
This website uses browser session storage to remember your nationality selection, access to your private booking and a payment retry identifier. Clearing session storage may remove these remembered details. Keep your booking reference and private link separately if you need them later.
Staff sign-in uses an essential, secure session cookie that expires after eight hours or when the staff member signs out. We store a salted password hash, rather than the password itself, and temporary sign-in attempt records to protect the staff area. Staff passwords are not stored in browser storage.
We have not added analytics scripts or advertising pixels to this booking website. Hosting, security, sign-in and payment providers may use cookies or similar technologies for their own services. You can manage cookies and website storage in your browser; blocking necessary storage may affect sign-in, booking access or payment functions.
The site loads fonts from Google Fonts, so your browser makes requests to Google that include technical request information. External providers, including hosting, fonts, messaging and payment services, may process information in countries outside Sri Lanka. Their policies explain their own processing.
How long information is kept
The retention period depends on the type of record and why it is needed. Booking, correspondence and payment records may remain after your trip for accounting, refunds, complaints, fraud prevention, disputes and applicable legal requirements. There is no single fixed retention period for all these records.
You can ask what information we hold, why it is still needed, or request deletion. We assess the request against the purposes and obligations that still apply and explain if some information needs to be kept. This website does not promise automatic deletion when your trip ends. External providers apply their own retention rules to information they handle.
Protecting your information
The website uses HTTPS, restricts staff booking tools to authorised access and checks the private token before returning booking details. These measures help protect information; no internet service can guarantee complete security.
Use a trusted device when viewing booking or payment details. Do not send payment passwords or card security codes by phone, WhatsApp or booking notes. Tell us promptly if your contact details are wrong or you suspect unauthorised access to your booking.
Your choices and privacy requests
Contact us to request access to your information, correction of inaccurate details, deletion, or restriction or objection to a particular use, where applicable. If processing relies on your permission, you can ask to withdraw it; this does not undo earlier lawful use or remove records we need for other valid purposes. Requests and available rights are considered under applicable law.
We may need enough information to verify your identity and locate the record before disclosing or changing it. Start with your booking reference and the contact details used for the booking. We will explain the outcome or any reason a request cannot be met. If you remain concerned, consult the Data Protection Authority of Sri Lanka about the guidance and complaint routes available to you.
Changes to this policy
We may update this notice when our services, providers or applicable requirements change. The date at the top identifies the current version. Where a change requires additional notice or permission, we will provide or seek it as required. Read the current notice before giving us new information.
Need help with your river day?
Have your booking reference ready so we can find the right details.
Chat on WhatsApp Safari packages