Privacy

Who we are

Majeste is a trading name of Senific (Private) Limited, company no. PV 00355973, Sri Lanka. That company decides how your details are used.

What we do not collect

• No card or bank details.
• No passport numbers on the booking form.
• No account or password.
• No analytics or advertising trackers on this site.

Your booking record

When you press Book, the booking is saved in our database, on the server that runs this site. The record holds:

We use these details to confirm your booking, to arrange your trip and to run it. The site has no newsletter and we send no marketing.

Your private booking page opens only with its link. We keep a coded form of that link, not the link itself, so the database alone cannot open your page. Anyone who has the link can see your name and trip, so share it only with the people travelling with you.

Passport details for train seats

Reserved seats on the hill train are tied to passport numbers. If your trip includes one, we ask for each traveller's name and passport number after you book, by WhatsApp or email. We use them only to book those seats, and we pass them only to whoever issues the tickets. The booking form never asks for them. We keep them as we keep your other messages, and you can ask us to delete them after your trip.

Messages we send

We keep a log of the emails and text messages we send about your booking: who each went to, its text with private links hidden, and when it was sent. Your phone number or email address and the text are removed from the log after 13 months. The row stays, with its type and times, so our counts still add up.

Who sees your details

• The people who run Majeste, who see your booking on a signed-in admin page.
• The driver assigned to your trip. Our text messages give them the trip, the number of guests and the pickup area. We pass on what else they need to collect you, such as your name and meeting point.
• The hotels and activity operators on your plan, who get what they need to take your booking.
• Amazon SES sends our emails, and Dialog Axiata's eSMS service sends our text messages. Each receives your address or number and the message.
• Cloudflare, whose Workers and Email services can carry our emails: the alert about your booking to us, with your name, phone and email, and sometimes your confirmation to you.
• The company that hosts our server, where the database sits. They may store data outside Sri Lanka.
• If you message us on WhatsApp, WhatsApp handles that message under its own terms.
• Nobody else. We do not sell your details.

Where it is kept, and for how long

Your booking is stored in a database on the server that runs this site. We keep it for as long as it is needed to run the trip and to answer questions about it. We have not set a fixed period for keeping your booking and our messages about it, and nothing deletes them automatically, apart from the 13-month limit on the message log above. Database backups are kept on the same server and deleted once they are 30 days old, so a deleted detail can remain in a backup copy for up to 30 days. Companies that carry our email and text messages keep copies under their own rules. You can ask us to delete your details at any time, as set out below. If the law says we must keep a record, such as a receipt, we keep that record for as long as it says.

Cookies, your browser and spam limits

• The site uses no analytics and no advertising cookies. If that changes, we will update this page first.
• If you book without JavaScript and the form refuses something, one cookie carries what you typed back to the form. It is called majeste_booking_flash, it works only on the booking pages, and it is gone in a minute. The admin pages use a sign-in cookie of their own, for our staff only.
• The booking form keeps what you have typed in your own browser tab, so it is not lost if you go back to change the trip, and it notes the first page you opened in that tab. The typing is removed when the booking is saved or the tab is closed, and all of it reaches us only when you press Book. After you book, the tab remembers your reference and the private link to your booking until the tab is closed, so the form can tell you if you open it again.
• To stop spam, the server uses your connection's IP address to count how many forms it sends in a short period. That count is held in memory for a short time and is not written to the database, and the address is not saved with your booking.

The company that hosts this site may keep routine server logs, such as IP addresses and the pages requested. Links to other sites, such as WhatsApp, take you to services with their own privacy rules.

What you can ask us to do

You can ask us at any time to:

• show you the details we hold about you;
• correct them;
• delete them;
• stop using them.

There is no charge. If you ask us to delete your details before your trip, we may not be able to run it. We keep any record the law says we must keep.

The law

Sri Lanka's Personal Data Protection Act No. 9 of 2022, amended by Act No. 22 of 2025, covers companies in Sri Lanka such as ours. Gazette No. 2498/16 of 22 July 2026 sets 1 January 2027 as the date its core duties on organisations begin. Published reports say the parts on individual rights and on penalties had no start date when we checked on 7 Nov 2026. We offer the choices above regardless.

The GDPR and the UK GDPR can apply to a business outside Europe that offers services to people in the EU or the UK. If they apply to you, we rely on two grounds: the steps you ask us to take to arrange your trip, and our legitimate interest in stopping spam. You can complain to your local data protection authority.

This page describes what we do. No authority has reviewed it, and it is not a claim that we meet every rule in these laws.

Contact

For anything on this page, email hello@majeste.lk or message us on WhatsApp at +94 76 409 2662, 07:00 to 21:00 Sri Lanka time.