Privacy Policy

Acorn Travels (Private) Limited ("Acorn Travels", "we", "us", "our") places the highest priority on safeguarding your personal data. This Privacy Policy outlines how we collect, use, disclose, protect, and manage your personal information in compliance with the General Data Protection Regulation (GDPR), the Sri Lankan Personal Data Protection Act, and other relevant international data protection laws.

By accessing our website, booking our services, or providing your data to us, you consent to the practices described in this Policy.

Acorn Travels is a leading travel services provider specializing in air travel, visa processing, hotel reservations, holiday packages, and corporate travel solutions. Our services are available both offline and online through our digital platforms and social media.

We may collect the following categories of personal data:

• Identifiers: Name, date of birth, gender, nationality, address, email, and phone number.
• Government-issued IDs: Passport, NIC, visa, or driver’s license details.
• Travel details: Flight, hotel, and tour preferences; frequent flyer and loyalty program details.
• Payment data: Card type, card number, expiry, and CVV (processed securely).
• Health information: Dietary restrictions or medical conditions (with consent).
• Technical data: IP address, browser type, device identifiers, usage data.
• Visual and Audio Data: CCTV footage at our premises and recorded calls (where applicable).
• Employment details: If applying for jobs with us.

We may also collect Special Categories of Personal Data (e.g., religious or medical data) only with explicit consent.

Your data is collected in various ways, including:

• Directly via bookings, forms, emails, or phone calls
• Through our website, social media platforms, or mobile apps
• Via third parties, such as travel agents, airlines, or referral platforms
• Automatically via cookies, analytics tools, and device tracking technologies

Your data is processed for the following purposes:

Where required, we will request your explicit consent before processing your data. You have the right to withdraw consent and request to delete your personal information at any time by contacting us at: customercare.travels@acorn.lk

We may share your data without your explicit consent (since you have already given consent by sharing the data with us) with the parties below:

• Airlines, visa authorities, hotels, and insurance providers
• Payment processors, marketing tools, and CRM service providers
• Government and regulatory bodies (e.g., immigration, customs)
• Internal departments or subsidiaries within the Acorn Travels group

We ensure that all third parties are contractually bound to protect your data and comply with applicable data protection laws.

We do not and shall not sell or rent your personal data.

Where required for bookings or technical support, your data may be transferred outside Sri Lanka. We ensure these transfers are protected by contractual safeguards or are made to countries with adequate protection laws.

Our website uses cookies to enhance your browsing experience. These may track user behavior, preferences, and device data. You may control cookie preferences via your browser settings.

You may choose to receive updates on our services, offers, or destinations. You can opt out at any time using the unsubscribe link in our emails or by contacting us directly.

Your data is stored securely on encrypted servers with firewall and access control measures. We use:

• Secure Sockets Layer (SSL) encryption
• Password-protected systems
• Up-to-date antivirus and intrusion prevention
• Data minimization and retention controls

CCTV cameras are used in our offices for safety and security. Footage may be shared with law enforcement where necessary.

Our services are not targeted at children under 16. Where required (e.g., family travel), parental consent shall be obtained before providing such data.

We retain your personal data only as long as needed:

• Enquiry data: Retained for the duration of inquiry validity
• Booking data: Retained per financial, legal, and audit requirements
• Marketing data: Retained until you unsubscribe
• CCTV footage: Retained for a limited operational period unless needed longer for investigations

You have the right to:

• Request access to your data
• Request correction or deletion
• Object to or restrict processing
• Withdraw consent at any time
• Request data portability

To exercise any of these rights, please contact us via our Data Protection Officer at:

• Email: customercare.travels@acorn.lk
• Address: Hemas Building, 36 Sir Razik Fareed Mawatha, Colombo 00100

Our website may contain links to third-party websites. We are not responsible for their privacy practices. Please review their policies before submitting data.

We reserve the right to update this policy at any time. Revised versions will be posted on our website with an updated "Effective Date." You are encouraged to review it periodically.

For any privacy-related queries, requests, or complaints, please contact: