Privacy Policy

When you create an account we collect:

• Your name and telephone number, which identify your account and are how we reach you about a booking — for example if a trip is cancelled.
• Your email address, which is optional.
• A password, which we never store. Only a one-way cryptographic hash is kept, so nobody at Wijesiri Tours — including our own staff and administrators — can read or recover your password.

For each seat in a booking we collect the travelling passenger's:

• Name, so the operator's passenger manifest matches who is on board.
• National Identity Card (NIC) number, which is optional and provided only if you choose to enter it.
• Telephone number, so we or the operator can reach the travelling passenger directly if needed.
• Pickup and drop-off location, so the driver knows where to stop for that passenger.

You may book on behalf of another person. If you enter someone else's details, you confirm that you have their permission to share that information with us and with the bus operator.

We never see, receive or store your card details. Payments are handled entirely on the secure hosted payment page of our payment service provider, PayHere. Your card number, expiry date and CVV are submitted directly to them and never pass through our servers.

What we keep against a booking is limited to the transaction record we need in order to reconcile it and to support you: the amount, the currency, the payment status, and the reference identifiers issued by the payment provider for that transaction.

PayHere processes your payment data as an independent controller under its own privacy policy and its card-network security obligations.

To keep you signed in, we store your session tokens in your own browser's local storage. These stay on your device, are readable only by this website, and are erased when you sign out.

We do not use advertising cookies, analytics cookies, tracking pixels or third-party profiling tools. We do not build advertising profiles, and we do not track your activity across other websites. Our servers keep ordinary technical logs needed to operate and secure the service and to diagnose faults.

We use your information only to:

• Create and manage your account and keep you signed in securely.
• Reserve your seats, process your payment and confirm your booking.
• Send you a booking confirmation and the details you need in order to travel.
• Provide the driver and operator with the passenger manifest for the trip you booked.
• Contact you about a booking, including if a trip is delayed or cancelled.
• Investigate payment errors, respond to support requests and prevent fraudulent or abusive use of the service.
• Meet our legal, accounting and tax obligations.

We do not sell your personal information, and we do not send marketing messages unrelated to a booking you have made.

We share your information only where it is necessary, and only with:

• The bus operator for your trip — the passenger name, seat, pickup and drop-off point appear on the manifest for the departure you booked, so you can be carried.
• Our payment service provider — to take your payment and to process any refund due.
• Our hosting providers — who operate the servers and database on our behalf and are permitted to process your data only on our instructions.
• Authorities or legal advisers — where we are required to disclose information by law, or to establish or defend a legal claim.

We do not sell, rent or trade your personal information to anyone, and we do not disclose it for anyone else's marketing purposes.

Passwords are stored only as one-way hashes. Access to the site is authenticated with signed, expiring tokens, and every request for booking data is checked against the signed-in account so that one passenger cannot read another's bookings. Traffic between your browser and our servers is encrypted in transit, as is the connection to our database.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please keep your password confidential and sign out on shared devices. Tell us promptly if you believe your account has been accessed by someone else.

We keep your account information for as long as your account is open. Booking and payment records are kept after travel for as long as we need them to handle disputes and to satisfy accounting and tax requirements. Expired sign-in tokens are removed.

You may at any time:

• See the account details we hold on the Account page, and your bookings on My Trips.
• Update your name and email yourself at any time on the Account page. Ask us to correct any other information that is wrong or out of date — for example, your phone number.
• Ask for a copy of the personal information we hold about you.
• Ask us to delete your account and personal information.

Contact us using the details below to make any of these requests. Note that we may need to keep certain booking and payment records even after an account is deleted, where the law requires us to retain them.

The service is not intended for children. You must be at least 18 years old to hold an account, as set out in our Terms and Conditions. We do not knowingly collect information from anyone below that age. An adult may of course book travel for a child as a passenger.

We may update this Privacy Policy from time to time. Any change is published on this page with a revised “last updated” date. Please check back occasionally to stay informed.

For any question about this Privacy Policy, or to exercise any of the rights in section 8, contact us at: