Privacy Policy
Lanka Tours protects your privacy under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what we collect, how we use it, and who we share it with. It covers this website, lankatours.com.au, and our charter, tour and school bus services.
What information we collect
We collect personal information only when it is reasonably necessary for our functions or activities. We collect it by lawful and fair means, with your knowledge. Where we can, we tell you why we collect it at the time.
- Your full name.
- Your contact details: phone number, email address and postal address.
- Payment and billing details.
- Booking and transport details, including pickup points, dates and group size.
- For the school bus service, the student name, the school and the boarding stop.
- Our correspondence with you.
We do not collect sensitive information as the Privacy Act defines it, unless you give it to us for a specific trip and we need it to carry you safely.
How we use your information
We do not use or disclose your personal information for a secondary purpose, unless the law requires it, the law permits it, or you consent to it. We do not sell your personal information, and we do not share it for advertising.
Website visits, cookies and analytics
This section describes what happens in your browser when you open a page on this site.
- This website sets no cookies of its own.
- We run no advertising or conversion tracking. There is no Google Ads tag, no Meta pixel and no remarketing code on any page.
- We do not build a profile of you, and we cannot recognise you across other websites.
Visitor analytics
We use Cloudflare Web Analytics to count how many people read each page. It is a privacy-first product. It sets no cookie, it does not fingerprint your device, and it does not track you from one website to another. We see totals: the number of views a page received, the country a visit came from, and the kind of device used. We cannot identify you from it.
Requests your browser makes to other companies
A web page is assembled from several sources. When your browser fetches one, that company receives your IP address and the technical details every web request carries. We do not control what they log. Each one is listed below with the reason the request happens.
| Provider | What it does | When your browser contacts it |
|---|---|---|
| Cloudflare | Serves the website, its images and its stylesheet | Every page |
| Google Fonts | Supplies the two typefaces the site uses | Every page |
| Web3Forms | Receives a form you submit and emails it to us | Only on a page with a form, and only when you send it |
| hCaptcha | Checks that a form was sent by a person, not a robot | Only on a page with a form |
hCaptcha and Web3Forms may set a cookie of their own on the pages that carry a form. Those cookies belong to them and serve their spam checks. The pages with a form are the contact page and the school bus waitlist pages.
What we changed, and when
We removed the Google Ads conversion tag from every page of this site in 2026. Nothing replaced it. If you read an earlier version of this policy, or an older cached page, treat this section as the current position.
Data retention and security
Who we share your information with
We disclose your personal information to service providers who help us deliver our services. Some of them operate outside Australia. We take reasonable steps to satisfy ourselves that each one handles your information consistently with the APPs.
| Provider | Purpose | Privacy policy |
|---|---|---|
| Cloudflare | Website hosting, DNS, caching and visitor analytics | Cloudflare |
| Web3Forms | Delivers the enquiry and waitlist forms to our inbox | Web3Forms |
| hCaptcha | Spam protection on those forms | hCaptcha |
| Google Fonts | Supplies the typefaces the site uses | |
| RollCall | School bus rider management and roll marking | RollCall |
| Xero | Accounting and invoicing | Xero |
| Pinch and B2BPay | Payment processing | Pinch and B2BPay |
| Microsoft 365 | Our email and document storage | Microsoft |
Overseas disclosure
Several of the providers above store or process data outside Australia, including in the United States. Where that happens, we take reasonable steps to ensure the overseas recipient does not breach the APPs. By giving us your information, you accept that it may be handled overseas on this basis.
Your rights under the Privacy Act
The Privacy Act gives us 30 days to respond to a request for access or correction. We do not charge for a request. We may ask you to confirm who you are before we release anything.
Complaints and contact
Write to us if you have a question about your privacy, or if you want to make a complaint.
Tell us what happened and what you would like us to do. We will look into it and write back to you.
If our answer does not satisfy you, you can take the matter to the Office of the Australian Information Commissioner (OAIC). The OAIC normally expects you to raise the complaint with us first, and to give us 30 days to respond.
Changes to this policy
We update this policy when the way we handle personal information changes. The effective date below tells you which version you are reading.