Privacy Policy

1. Introduction

Welcome to Rapid Adventures (Private) Limited ("we," "us," "our," or "Rapid Adventures"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website www.rapidadventures.lk and use our services.

Who We Are:
Rapid Adventures (Private) Limited is a registered private limited company incorporated under the Companies Act No. 07 of 2007 and registered with the Registrar of Companies of Sri Lanka. We operate as a licensed online travel agent and comprehensive booking platform, specializing in adventure tourism, curated accommodations, and vehicle rentals across Sri Lanka.

We serve both local and international travelers by providing end-to-end travel solutions. Our services include adventure activities (operated both directly by us and through carefully vetted local partners), accommodation bookings with quality providers, and vehicle rental services. Safety and quality are paramount—every activity, operator, and accommodation partner on our platform undergoes rigorous evaluation to ensure compliance with our high standards for safety, professionalism, and customer satisfaction.

Registered Address:
No 24, Thoppuwa, Kochchikade, Sri Lanka, 11540

Contact Information:

• Email: hello@rapidadventures.lk
• Phone: +94 11 7699 733 / +94 77 3811 233

This policy applies to all users of our website and services, regardless of their location. By using our website or services, you acknowledge that you have read and understood this Privacy Policy.

2. Legal Compliance

This Privacy Policy complies with:

• Sri Lanka: Personal Data Protection Act No. 9 of 2022 (PDPA)
• European Union: General Data Protection Regulation (GDPR) for EU residents
• Other Jurisdictions: Applicable data protection laws where our customers are located

3. Information We Collect

3.1 Personal Information You Provide Directly

We collect information that you voluntarily provide when you:

• Book activities, accommodations, or rentals
• Create an account on our website
• Subscribe to our newsletter
• Contact us via email, phone, or contact forms
• Participate in surveys or promotions
• Provide reviews or feedback
• Premium package purchase details and preferences
• Emergency contact information (for 24/7 hotline service)
• Travel concierge service requests and communications

This information may include:

• Full name
• Email address
• Phone number
• Mailing address
• Date of birth
• Nationality and passport information
• Payment information (processed by third-party payment gateway)
• Emergency contact details
• Dietary requirements, allergies, or special needs
• Medical information relevant to activity participation (e.g., fitness level, health conditions)
• Group size and participant details
• Travel dates and preferences

3.2 Information Collected Automatically

When you visit our website, we automatically collect certain technical information:

• IP address
• Browser type and version
• Device information (type, operating system)
• Referring/exit pages
• Date and time stamps
• Clickstream data
• Pages viewed and time spent on pages
• Search queries within our site
• Geographic location data (approximate, based on IP address)

3.3 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your browsing experience and analyze website usage. These include:

Essential Cookies: Required for website functionality (e.g., shopping cart, login sessions)

Analytics Cookies: Help us understand how visitors use our site

• Google Analytics
• Google Tag Manager

Marketing Cookies: Used for targeted advertising and retargeting

• Facebook Pixel
• Mailchimp

Third-Party Cookies: Set by third-party services integrated into our website

You can control cookie preferences through your browser settings. However, disabling certain cookies may limit website functionality. For more information, please see our Cookie Policy.

3.4 Photos and Videos

During activities, our team or authorized partner operators may capture photos and videos for:

• Safety documentation
• Marketing and promotional materials
• Social media content
• Website galleries

For Activities Operated by Rapid Adventures:
By participating in our activities, you consent to being photographed/filmed. However, you may opt out at any time by informing our staff before or during the activity. If you wish to have your images removed from our marketing materials after the activity, please contact us at hello@rapidadventures.lk.

For Activities Operated by Third-Party Partners:
When you book activities operated by our partner suppliers, any photos or videos captured during those experiences are subject to the privacy policy and terms of the respective operator. While we encourage all our partners to maintain high standards of privacy and obtain appropriate consent, Rapid Adventures is not responsible for the photo/video practices of third-party operators. We recommend that you:

• Review the operator's photo/video policy before participating
• Inform the operator directly if you do not wish to be photographed or filmed
• Contact the operator directly for any requests regarding removal or use of your images

If you have concerns about a third-party operator's media practices, please contact us at hello@rapidadventures.lk and we will assist you in communicating with the operator.

3.5 Information from Third Parties

We may receive information about you from:

• Third-party accommodation providers
• Third-party activity operators
• Payment processors
• Travel agents or tour operators
• Social media platforms
• Online review platforms

4. How We Use Your Information

We use your personal information for the following purposes:

4.1 Providing Services

• Process and confirm bookings for activities, accommodations, and rentals
• Coordinate with third-party operators and accommodation providers
• Communicate booking details, confirmations, and updates
• Provide customer support and respond to inquiries
• Manage your account and preferences
• Deliver premium package benefits (cancellation protection, travel concierge, emergency support)
• Process booking transfers and date changes for premium members
• Coordinate merchandise delivery (branded t-shirts/souvenirs)
• Process payments through our third-party payment gateway

4.2 Safety and Legal Compliance

• Assess fitness and suitability for adventure activities
• Maintain emergency contact information
• Comply with legal obligations and industry regulations
• Respond to legal requests and prevent fraud
• Enforce our Terms and Conditions

4.3 Marketing and Communications

• Send newsletters and promotional offers (with your consent)
• Provide updates about new activities, destinations, and special offers
• Send personalized recommendations based on your interests
• Conduct customer satisfaction surveys
• Provide premium member exclusive offers and benefits notifications

Note: You can unsubscribe from marketing communications at any time by clicking the "unsubscribe" link in our emails or contacting us directly.

4.4 Website Improvement and Analytics

• Analyze website traffic and user behavior
• Improve website functionality and user experience
• Develop new services and features
• Conduct research and data analysis
• Test website features and content

4.5 Advertising and Retargeting

• Display relevant advertisements on third-party websites
• Retarget visitors who have shown interest in our services
• Measure advertising effectiveness

5. How We Share Your Information

We do not sell your personal information. However, we share your data with third parties in the following circumstances:

5.1 Service Partners

Third-Party Activity Operators: We share necessary booking information with operators who conduct activities on our behalf or in partnership with us.

Accommodation Providers: When you book stays through our platform, we share relevant reservation details with hotels, lodges, eco-lodges, and other accommodation partners.

Premium Service Providers: When you purchase our premium package, we may share necessary information with:

• Merchandise suppliers: For delivery of branded souvenirs and t-shirts (name, shipping address)
• Concierge partners: When assisting with third-party bookings (hotels, restaurants, transport) based on your requests
• Emergency response contacts: In case of genuine emergencies requiring our 24/7 support service

Vehicle Rental Partners: For motorcycle, tuk-tuk, and other vehicle rentals, we share booking information with our rental partners.

These partners receive only the information necessary to deliver the service you've booked.

5.2 Payment Processors

We use secure third-party payment gateways to process transactions. Your payment information is transmitted directly to these processors and is not stored on our servers. Our payment partners comply with PCI DSS (Payment Card Industry Data Security Standard) requirements.

5.3 Technology and Analytics Providers

We use third-party services to operate and improve our website:

• Google Analytics: Website traffic analysis (anonymized data)
• Facebook (Meta): Advertising and analytics through Facebook Pixel
• Email Service Providers: For sending newsletters and transactional emails
• Cloud Hosting Providers: For secure data storage

5.4 Legal and Regulatory Authorities

We may disclose your information when required by law or to:

• Comply with legal proceedings, court orders, or government requests
• Enforce our Terms and Conditions
• Protect our rights, property, or safety
• Protect the rights, property, or safety of our users or the public
• Detect, prevent, or address fraud or security issues

5.5 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you of any such change and your options regarding your information.

6. International Data Transfers

Rapid Adventures operates in Sri Lanka and serves customers worldwide. Your personal information may be transferred to and processed in countries outside your country of residence, including Sri Lanka.

For EU/EEA residents, please note that Sri Lanka does not have an adequacy decision from the European Commission. However, we ensure appropriate safeguards are in place through:

• Standard Contractual Clauses (SCCs) with data processors
• Data processing agreements with all third-party service providers
• Technical and organizational security measures

By using our services, you consent to the transfer of your information to countries outside your jurisdiction, including Sri Lanka.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

Security Measures Include:

• SSL/TLS Encryption: All data transmitted between your browser and our website is encrypted
• Secure Servers: Data stored on secure servers with restricted access
• Access Controls: Limited employee access to personal data on a need-to-know basis
• Staff Training: Regular training on data protection and privacy best practices
• Regular Security Audits: Periodic review of security measures and procedures
• Third-Party Payment Processing: We do not store credit card information on our servers

Important: While we strive to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but commit to addressing any potential vulnerabilities promptly.

Data Breach Notification: In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant authorities as required by law within 72 hours of becoming aware of the breach.

8. Your Rights

Under Sri Lanka's Personal Data Protection Act and GDPR (for EU residents), you have the following rights:

8.1 Right to Access

You can request a copy of the personal information we hold about you.

8.2 Right to Correction

You can request correction of inaccurate or incomplete personal information.

8.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal information, subject to legal and contractual obligations.

8.4 Right to Restrict Processing

You can request that we limit how we use your personal information.

8.5 Right to Data Portability

You can request your data in a structured, commonly used, machine-readable format.

8.6 Right to Object

You can object to processing of your personal information for direct marketing purposes or based on legitimate interests.

8.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

8.8 Right to Complain

You have the right to lodge a complaint with:

• Sri Lanka: Data Protection Authority of Sri Lanka (www.dpa.gov.lk)
• EU/EEA: Your local supervisory authority

How to Exercise Your Rights

To exercise any of these rights, please contact us at:

• Email: hello@rapidadventures.lk
• Phone: +94 11 7699 733
• Mail: No 24, Thoppuwa, Kochchikade, Sri Lanka, 11540

We will respond to your request within 30 days. We may require additional information to verify your identity before processing your request.

9. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention Periods:

• Booking and Transaction Data: 7 years (for accounting, tax, and legal compliance)
• Marketing Consent and Communications: Until you withdraw consent or request deletion
• Account Information: Until you request account deletion or after 3 years of inactivity
• Photos/Videos for Marketing: Until you request removal or up to 5 years
• Website Analytics Data: Typically anonymized after 26 months (Google Analytics default)
• Legal or Dispute-Related Data: As required by law or until disputes are resolved
• Premium Package Records: 7 years (for refund disputes and service delivery verification)
• Emergency Contact Information: Until booking is completed or account deletion requested
• Concierge Service Communications: 2 years (for quality assurance and dispute resolution)

After the retention period expires, we securely delete or anonymize your personal information.

10. Marketing Communications

10.1 Newsletter and Promotional Emails

With your explicit consent, we send:

• Newsletter with travel tips, destination guides, and adventure stories
• Special offers and promotional deals
• New activity and service announcements
• Personalized recommendations

10.2 How to Unsubscribe

You can opt out of marketing communications at any time by:

• Clicking the "Unsubscribe" link at the bottom of any marketing email
• Logging into your account and updating email preferences
• Contacting us at hello@rapidadventures.lk
• Calling +94 11 7699 733 or WhatsApp +94773811233

Note: Even if you unsubscribe from marketing emails, we may still send transactional emails related to your bookings, account, or customer service inquiries.

11. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children without parental consent.

For Family Bookings: If you are booking activities for minors, you (as the parent or legal guardian) are responsible for providing their information and consenting to this Privacy Policy on their behalf.

If we discover that we have collected personal information from a child without appropriate parental consent, we will delete that information promptly.

12. Third-Party Websites and Services

Our website may contain links to third-party websites, social media platforms, or services that are not operated by Rapid Adventures. These include:

• Accommodation booking sites
• Activity operator websites
• Payment processors
• Social media platforms (Facebook, Instagram, TripAdvisor, Trustpilot)
• Google Maps

Partner Activity Operators:

When you book activities through our platform that are operated by partner suppliers, those operators may have their own privacy policies, photo/video policies, and terms and conditions. While we carefully vet all partners for quality and safety standards, each operator is an independent business responsible for their own data handling and media capture practices. We encourage you to ask operators about their policies before participating in activities.

We are not responsible for the privacy practices or content of these third-party sites. We encourage you to review their privacy policies before providing any personal information.

13. Social Media

We maintain profiles on various social media platforms (Facebook, Instagram, YouTube, etc.). When you interact with our social media content or send us messages through these platforms, your interactions are governed by the privacy policy of that social media platform.

Information We Collect:

• Public profile information (if you follow, like, or comment)
• Messages sent to our business accounts
• Content you tag us in or share with us

We may use publicly available content (photos, reviews) in our marketing materials with proper attribution, unless you request removal.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.

How We Notify You:

• Post the updated policy on our website with a new "Last Updated" date
• Send an email notification to registered users for material changes
• Display a prominent notice on our website

Your Continued Use: Your continued use of our website and services after any changes indicates your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.

15. Contact Us and Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Rapid Adventures (Private) Limited

General Inquiries:

• Email: hello@rapidadventures.lk
• Phone: +94 11 7699 733 / +94 77 3811 233
• Address: No 24, Thoppuwa, Kochchikade, Sri Lanka, 11540

Privacy-Specific Inquiries:

• Email: hello@rapidadventures.lk

Data Protection Officer: Chathuranga Madurawala via mail chathuranga@rapidadventures.lk

We aim to respond to all inquiries within 5-7 business days, and formal data subject requests within 30 days as required by law.

16. Consent

By using our website, booking our services, or providing your personal information, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy.

For Marketing Communications: We will obtain your explicit opt-in consent before sending promotional emails or messages.

For EU/EEA Residents: Where required by GDPR, we rely on specific legal bases for processing your data:

• Contract Performance: To provide services you've requested
• Consent: For marketing communications and non-essential cookies
• Legitimate Interests: To improve our services, prevent fraud, and ensure security
• Legal Obligations: To comply with legal requirements

Thank you for trusting Rapid Adventures with your personal information. We are committed to protecting your privacy while delivering exceptional adventure experiences across Sri Lanka.

This Privacy Policy is effective as of 24th of November 2022 and was last updated on 01st of January 2026.