Privacy Policy

2 · Scope

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our Site or use our services, including room reservations, contact forms, and newsletter subscriptions.

3 · Information We Collect

• Identity Data – full name, passport/ID number
• Contact Data – email, phone, postal address
• Booking Data – stay dates, flight details, preferences
• Payment Data – masked card info, transaction ID
• Technical Data – IP, browser, device, cookies
• Marketing Data – newsletter opt‑ins, survey responses
• Additional User Data – role, auth provider, profile photo

4 · How We Collect Data

We collect data directly from you (e.g., reservation forms), automatically via cookies and analytics, and from trusted third parties such as online travel agencies and payment processors.

5 · Cookies & Similar Technologies

We use strictly necessary cookies for authentication, functional cookies for language selection, and analytics cookies (Google Analytics 4). You may refuse non‑essential cookies via the on‑site banner.

6 · Purposes of Processing

1. Fulfil bookings and provide hotel services
2. Account creation & secure login
3. Payment processing
4. Site analytics & performance
5. Marketing communications (opt‑in only)
6. Legal & regulatory compliance
7. Security & fraud prevention

7 · Sharing & International Transfers

We only share your data with necessary service providers (AWS S3, Supabase, Stripe, Google LLC) and government authorities when required. All transfers observe Standard Contractual Clauses or equivalent safeguards.

8 · Data Retention

Booking‑related data is kept for seven years to meet tax obligations. Supabase user accounts inactive for 12 months are deleted. Marketing consent is stored until you withdraw it.

9 · Your Rights

Under GDPR and Sri Lankan PDPA, you may access, correct, erase, restrict or object to processing, and request data portability. Email us at reservations@skywingtransit.com to exercise your rights.

10 · Children

Our services are not directed to minors under 16. We do not knowingly collect their data.

11 · Third‑Party Links

The Site may contain links to external sites. We are not responsible for their privacy practices; please review their policies independently.

12 · Changes to This Policy

We update this Policy as needed and will post revisions with a new “Last updated” date. Material changes will be announced via email or banner at least 14 days before taking effect.

13 · Contact