Privacy policy.

Who we are

Lakpura Leisure (Pvt) Ltd ("Lakpura", "we", "us") operates www.lakpura.com and is the controller of the personal data described in this policy. We are registered in Sri Lanka.

• Email: [email protected]
• Telephone: +94 115 747474
• Registered office: [[REVIEW: registered street address — `companies.street_address` is NULL in the database]]
• Company registration number: [[REVIEW: `companies.registration_number` is NULL in the database]]

[[REVIEW: if an EU/UK representative or a Data Protection Officer has been appointed, name them here. If not, say so explicitly.]]

What we collect

When you make a booking

To take and fulfil a booking we collect and store:

• Your first name and surname
• Your email address
• Your telephone number
• The service booked, the date and start time you chose, the number of travellers, and any pick-up location or notes you give us
• The amount paid, the currency, and the time of payment

When you pay

Payments are processed by Stripe. We never see or store your full card number, expiry date, or security code — these are entered directly with Stripe. We retain only Stripe's identifiers for the checkout session and payment, plus the amount and status, so we can match a payment to your booking and process refunds.

Automatically, when you browse

• Your IP address and browser user-agent string, recorded against a booking for fraud prevention and troubleshooting
• The page you arrived on, the site that referred you, and any campaign parameters in the link you followed (including Google click identifiers), so we can tell which marketing brought you to us

[[REVIEW: confirm the cookie/consent position. This policy currently describes analytics and advertising identifiers but makes no consent claim, and the storefront's cookie banner behaviour was not verified while drafting.]]

Why we use it, and our legal basis

• To perform your booking contract — your name, contact details and booking details. Without these we cannot deliver the service.
• Legitimate interests — fraud prevention, security logging, and understanding which marketing works.
• Legal obligation — retaining transaction records for tax and accounting.
• Consent — marketing messages, where we rely on consent. [[REVIEW: confirm whether marketing email/SMS/WhatsApp is consent-based or legitimate-interest with opt-out, and align with what the review-request flow does.]]

Who we share it with

We share only what each party needs to do its job:

• Stripe — payment processing.
• The supplier delivering your service — the hotel, driver, guide or operator needs your name, contact number and booking details to serve you.
• Hotelbeds — where your accommodation is booked through their inventory.
• Twilio — SMS and WhatsApp messages about your booking.
• Microsoft — our email is hosted on Microsoft 365, so correspondence with us is stored there.
• Cloudflare — content delivery and security in front of our website.
• Google — website analytics and advertising measurement.

We do not sell your personal data.

Where your data is held

Our systems are operated from Sri Lanka and the United States, and the processors above operate globally. If you are in the EU or UK, this means your data is transferred outside your home jurisdiction.

[[REVIEW: state the transfer safeguard actually relied on — Standard Contractual Clauses, or otherwise. This is a specific legal commitment and must not be asserted without confirmation.]]

How long we keep it

[[REVIEW: retention periods must be set by the business. Nothing in the codebase defines one — booking rows are retained indefinitely today. State a period for booking records (commonly tied to the tax-record retention requirement), for marketing contacts, and for server logs.]]

Your rights

Depending on where you live, you may have the right to request a copy of the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format. To exercise any of these, email [email protected].

If you are in the EU or UK you also have the right to complain to your national data protection authority.

[[REVIEW: confirm the response window you commit to — one month is the GDPR default.]]

Security

Our website is served over HTTPS, payment card details never reach our systems, and access to booking data is restricted to staff who need it.

[[REVIEW: do not add further security claims (certifications, encryption-at-rest, penetration testing) unless they are true and can be evidenced.]]

Children

Our services are sold to adults. We do not knowingly collect personal data from children except the traveller details an adult provides when booking on their behalf.

Changes to this policy

We may update this policy. The date shown at the top of this page is when it last changed.

Contact

Questions about this policy or about your data: [email protected], or +94 115 747474.