Privacy Policy for the website www.thecinnamontours.pl
I. Personal Data Administrator

The administrator of the personal data of Website Users is:

Cinnamon Tours PVT Ltd
Registered office: Mehiliya Residencies, Kurunegala 60000, Sri Lanka
Registration number: PV 00208549
Tax Identification Number (TIN): 102908910
Contact email: kontakt@thecinnamontours.pl
(hereinafter referred to as “Controller” or “we”)

The Administrator processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), to the extent that it concerns the processing of data of persons staying in the territory of the EU.

II. Scope and purposes of data processing

The Administrator processes personal data provided voluntarily by the User via the contact form available on the Website, in particular:

  • name and surname (if provided),

  • e-mail,

  • telephone number (if provided),

  • other information voluntarily included in the content of the message.

These data are processed for the following purposes:

  1. responding to an inquiry sent via the contact form,

  2. conducting individual correspondence with the User,

  3. presenting a tourist offer if explicitly requested,

  4. possible pursuit of claims or defense against them, based on the legitimate interest of the Administrator.

III. Legal basis for processing

Data processing is based on:

  • article 6 act 1 a) in GDPR – User consent (by sending the form),

  • article 6 act 1 b) in GDPR – necessity to take action at the request of the data subject before concluding a contract,

  • article 6 act 1 f) in GDPR – legitimate interest of the Administrator (e.g. defense against claims).

IV. Voluntary provision of data

Providing personal data by the User is voluntary, but necessary for the Administrator to respond to the inquiry.

V. Transfer of data outside the European Economic Area (EEA)

Data provided via the contact form are processed by the Controller based in a third country (Sri Lanka), which does not ensure a level of personal data protection equivalent to European Union regulations.

Due to the fact that there is no decision of the European Commission stating the adequate level of protection of personal data for Sri Lanka, the data is transferred on the basis of:

  • article 49 act 1 a) in GDPR , i.e. the User’s voluntary, express consent to the transfer of data to a third country with full awareness of the risks.

By sending an inquiry via the contact form, the User consents to this.

VI. Data recipients

The Administrator does not transfer personal data to other entities unless:

  • this is due to a legal obligation,

  • it is necessary to protect the rights of the Administrator (e.g. legal services),

  • The user has consented to the transfer of data to a specific entity.

Data is not transferred or sold to third parties for marketing purposes.

VII. Data storage period

The User’s personal data will be stored for the period of:

  • conducting correspondence related to the inquiry,

  • and then for a maximum of 12 months,

  • or until the User withdraws consent.

If a contract is concluded, the data may be stored for the period specified in applicable regulations (e.g. tax regulations) or until the statute of limitations for any claims expires.

VIII. Rights of the data subject

The user has the following rights:

  1. access to your data,

  2. rectification of data,

  3. deletion of data (“right to be forgotten”),

  4. processing restrictions,

  5. data transfer,

  6. object to processing,

  7. withdraw consent at any time – without affecting the compliance of processing before its withdrawal,

  8. lodging a complaint with the supervisory authority (In Sri Lanka: Ministry of Technology, mot.gov.lk)

To exercise your rights, you may contact the Administrator by email: kontakt@thecinnamontours.pl

IX. Cookies and tracking technologies

The website may use cookies only for the following purposes:

  • ensuring the proper functioning of the website,

  • keeping anonymous visit statistics (e.g. Google Analytics).

The user can manage cookies through their browser settings.

X. Changes to the Privacy Policy

The Administrator reserves the right to update this Policy. The new version will be published on the Website and will be effective from the moment of its publication.