Your information

Privacy Policy

Last updated: 21 October 2026

This policy explains how Tour with Cham handles personal information when you use this website or ask about a tour.

Who is responsible for your information

Tour with Cham, operated by E. N. Chamara Zoysa at No. 4/A, K. C. De Silva Mawatha, Thimbirigaskatuwa, Negombo, Sri Lanka, is responsible for the personal information collected through this website. For privacy questions or requests, email cnilanka87@gmail.com or contact Chamara on +94 75 482 1828.

Information we collect

When you submit an inquiry, we collect the details you provide, which may include:

• your name, email address, and WhatsApp number;
• travel dates or duration, group size, and travel interests;
• your message and basic first-visit attribution, when available, including campaign tags, the landing-page path, and an external referring page without its query string or fragment;
• a unique inquiry ID, status, and submission time.

We keep first-visit attribution in session storage while you browse the website and send it only when you submit an inquiry. We do not store the Cloudflare Turnstile token or your IP address in the inquiry database.

Customer reviews and photos

If you submit a review, we collect your chosen public name, review, optional country, and optional photo. Reviews and photos remain private until they are checked and approved. We publish them only with your explicit consent, and an additional consent is required for a photo.

Uploaded JPEG and PNG files are checked for type, size, and dimensions. Embedded metadata, including location metadata, is removed before storage. Approved reviews clearly identify whether they came directly through Tour with Cham, Google, or TripAdvisor. Reviews from other platforms remain subject to the original platform's terms and privacy information.

Why we use it

We use your information to answer your request, prepare and discuss a tour offer, arrange a booking when requested, prevent abuse, and keep the service reliable. Processing an inquiry is necessary to take steps at your request before entering into a contract. Security and service-integrity processing is based on our legitimate interests. Where local law requires another legal basis, we will use the basis available under that law.

Service providers and transfers

Cloudflare hosts the website, protects forms with Turnstile, stores inquiries and review records in D1, stores submitted review photos privately in R2, and forwards replies sent to our domain to the configured mailbox.

Resend sends inquiry confirmations and internal notifications about inquiries and review submissions. We do not collect an email address or send a confirmation email when you submit a review. For inquiry messages, Resend processes the email address and contact and travel details needed for the message. A review notification contains the pending review and its moderation reference.

If you choose the direct WhatsApp option, the prepared message is handled by WhatsApp under its own privacy terms. Replies and later email correspondence are also processed by the email providers used by you and Tour with Cham. These providers may process information outside your country and use the safeguards described in their applicable data-protection terms.

How long we keep inquiries

Inquiry records are automatically deleted 180 days after submission. Information needed for a confirmed booking, legal obligation, payment record, or dispute may be kept separately for the period required for that purpose.

Inquiry confirmations, internal notifications, and any later correspondence may be retained separately in email accounts for as long as reasonably necessary to answer an inquiry, moderate a review, arrange or manage a booking, meet a legal obligation, or resolve a dispute.

Rejected review submissions and their photos are deleted after moderation. Published reviews are retained until consent is withdrawn or they are no longer needed. You may request withdrawal and deletion at any time using the contact details above.

Your choices and rights

Depending on the law that applies to you, you may ask to access, correct, delete, restrict, or obtain a copy of your information, and you may object to certain processing. You may also complain to the data-protection authority where you live. Contact us using the details above. We may need to verify your identity before completing a request.

Cookies and similar technologies

We do not currently use advertising or analytics cookies. Cloudflare Turnstile is used for security. Session storage may temporarily keep basic first-visit attribution while you browse, as described above. For that reason, the website does not display a general cookie banner.

Changes to this policy

We may update this policy when the website or its services change. The date at the top shows the latest revision.