Who we are
LankaTransfers arranges private road transfers in Sri Lanka. LankaTransfers determines how personal data submitted through this site is used for transfer planning and acts as the controller of that data.
This notice is designed around Sri Lanka’s Personal Data Protection Act, No. 9 of 2022, as amended, and other privacy rules that may apply to a traveller. It describes the service as it operates today; it is not a promise that every law applies in every situation.
Data we collect
- Contact details: your name, email address and WhatsApp or phone number.
- Journey details: exact selected locations and map identifiers, dates, departure windows, passengers, separate large- and small-luggage counts, selected rides, sharing choices, rail-luggage requests, flight or port details, return and layover choices, any keep-driver day routes and mileage, and an optional message you submit with the plan.
- Request and payment records: a plan reference, request status, prices, the snapshotted LKR/USD exchange rate and version, USD payment amount and status, PayPal order and capture identifiers, refund or reversal state and audit timestamps, driver responses and related correspondence. We do not store your PayPal access credentials or raw card details.
- Customer app: when you sign in at app.lankatransfers.com, Cloudflare delivers a verification code to your email. We store a protected code hash for up to ten minutes, a sign-in session for up to 30 days, and the association between your verified email and app bookings. If you enable notifications, we store a browser push subscription to send generic trip-update alerts. You can turn off notifications or sign out in the app; signing out revokes that session and its subscriptions.
- Technical and security data: request metadata such as IP address, browser or device information and security logs that the site’s hosting infrastructure may process.
- Optional current location: when you choose “Use my current location” and grant permission, your coordinates are sent through our server to Photon, an OpenStreetMap-based service, to find a nearby pickup place. We do not track your location in the background. If selected, pickup coordinates are included in your journey draft and submitted booking.
- Approximate country: when you submit a plan, the server infers a two-letter country code from Cloudflare’s request metadata. This country statistic does not use precise GPS location. The code is stored with the internal plan and Airtable booking record, and is never shown in public ride requests.
- Spam prevention: plan submissions are rate-limited using short-lived, one-way hashes derived from the contact email and Cloudflare network address. The anti-spam table does not store the raw email or network address and removes inactive entries after 48 hours.
- Driver data: account, licence, insurance, vehicle, availability and pricing information supplied through the separate driver service.
For an eligible date-flexible fixed-price booking, payment begins only after you submit the plan and approve the locked amount in PayPal-hosted Standard Checkout. PayPal processes the payment and raw card details; LankaTransfers does not receive or store those raw card details. The booking is confirmed only after PayPal approval and server-side verification. Legacy private, sharing and other enquiry submissions remain unpaid when submitted.
Only a plan you submit is copied to Airtable. An unfinished draft remains in your browser and is not transmitted merely because you type or select a field.
Why and how we use it
We use personal data to:
- save, review and match a transfer plan;
- contact you about availability, pricing, changes, confirmation and payment instructions;
- coordinate with approved drivers while limiting what they receive to what they need;
- operate, secure, troubleshoot and improve the service;
- prevent duplicate or abusive submissions and keep operational records; and
- understand which countries generate service demand using country-level statistics;
- process, reconcile, refund and investigate eligible fixed-price payments; and
- meet legal, accounting, fraud-prevention, safety and dispute-handling obligations.
Depending on the situation, processing is necessary to take steps you request before entering an arrangement, to perform an arrangement, to meet legal obligations, for legitimate service and security interests, or with consent where the law requires it. We do not sell personal data or use it for unrelated advertising.
Retention and security
We keep data only while it is reasonably needed to manage the request or journey, provide support, reconcile payments and refunds, prevent fraud, protect the service, resolve disputes, and satisfy legal or accounting requirements. The period therefore depends on whether a plan is abandoned, remains under review, becomes a confirmed service, includes a payment or refund record, or is needed for a legal record. Data that is no longer needed should be deleted or anonymised during operational review.
We use access controls, restricted server-side configuration, data minimisation, validation and encrypted network connections. No online system is risk-free, so we review safeguards as the platform develops.
Your choices and rights
Subject to applicable law, you may ask whether we hold your personal data and request access, correction, deletion, restriction, objection or a portable copy. You may also withdraw consent where processing depends on consent. Some information may need to be retained for an active service, safety, legal claims or statutory records.
Use the contact channel in your booking or request correspondence and include your plan reference. We may need to verify your identity before acting. You may also raise a concern with the Data Protection Authority of Sri Lanka or another competent authority where applicable.
Children, automated decisions and changes
The person submitting a plan should be at least 18. Passenger counts can include children, but the form should not contain unnecessary information about them. We do not use automated profiling to decide traveller eligibility. An eligible fixed-price booking is confirmed automatically only after PayPal payment is verified against the locked server-side fare.
We will update this page when data practices materially change. See the cookie policy for browser-storage information.