Your travel needs information. Your privacy still matters.

What this Privacy Policy covers

This Privacy Policy applies to personal data processed by Travel09 through travel09.com, customer accounts, enquiry and booking forms, communications, customer support and travel services.

It applies when you are a website visitor, prospective traveller, customer, passenger, account holder, person included in another traveller's booking, supplier contact or other person who interacts with Travel09.

Who handles your personal data

For personal data processed for Travel09's own website, account, enquiry, booking, customer-service, security and business purposes, Travel09 determines why and how that information is processed.

In some travel arrangements another business, such as a hotel, resort or transfer operator, determines its own processing purposes. Depending on the circumstances, that organisation may act independently or together with other parties.

Questions about Travel09's handling of personal data can be submitted through our Contact page .

Information we may collect

The information required depends on the service you request. We may process the following categories.

Where personal data comes from

We may obtain personal data directly from you when you browse the website, register, sign in, submit an enquiry, request an offer, make a booking, contact support or provide travel details.

We may also receive information from another person arranging travel on your behalf, from a corporate or group organiser, or from travel suppliers and service providers involved in a reservation.

If you provide information about another traveller, you should ensure you are authorised to provide it and that the traveller understands that the data will be used for the relevant travel arrangements.

Why Travel09 uses personal data

• respond to travel enquiries and quotation requests;
• search availability and build itineraries;
• make, administer, confirm and support bookings;
• communicate with hotels, resorts, tour providers, transfer operators and other travel suppliers;
• arrange airport, road, boat, domestic-flight or seaplane transfers where relevant;
• manage customer accounts and authentication;
• process and reconcile payments, refunds, balances and payment records;
• provide pre-travel, in-travel and post-travel customer support;
• handle changes, cancellations, complaints and service issues;
• personalise travel recommendations and website experiences where appropriate;
• secure the website, accounts, systems and transactions and prevent misuse or fraud;
• maintain operational, accounting, tax, audit and legal records;
• improve Travel09 services, website performance and customer experience; and
• send marketing where permitted and where appropriate preferences have been respected.

Legal bases and permitted reasons for processing

The legal basis depends on the processing activity and the law that applies. Travel09 may process personal data where processing is necessary to take steps at your request, perform a booking or other contract, comply with legal obligations, pursue legitimate business interests that are compatible with your rights, protect vital interests, or where valid consent is relied upon.

Where consent is the applicable basis, you may withdraw that consent for future processing, subject to any processing that remains necessary or lawful on another basis.

Hotels, resorts and other travel suppliers

Travel09 may need to provide personal data to suppliers so they can deliver a requested travel service. Relevant recipients may include:

The information shared should be limited to what is reasonably required to obtain availability, confirm the reservation, identify travellers, arrange the service, meet legal requirements or support the booking.

Suppliers may operate their own systems and may have their own privacy notices. Their independent processing is governed by their own obligations.

Payment information

Travel09 may process payment-related information needed to identify, reconcile and manage a booking, such as currency, total amount, amount paid, outstanding balance, payment status, method, due date and transaction or payment reference.

Where an external payment processor, bank, card network or payment gateway handles payment credentials, that provider may receive information directly from you and process it under its own terms and privacy obligations.

Account and authentication data

If you create or use a Travel09 customer account, we may process your account identifier, email, profile information, authentication data, login timestamps, IP information and account activity.

Passwords should be stored using secure one-way password hashing rather than in readable form. Travel09 staff should not require your customer account password to assist with a booking.

Customer account pages should expose only information associated with the authenticated customer. Staff-only or internal operational notes are not intended for display in customer accounts.

Artificial intelligence and automated assistance

Travel09 may use AI-assisted tools to help interpret travel requests, organise information, generate itinerary ideas, identify potentially relevant hotels, tours, transfers or experiences, summarise enquiries, or assist customer-service workflows.

Information submitted to an AI-enabled feature may be processed by technology service providers acting under their applicable terms and data-processing arrangements.

AI-generated recommendations can be incomplete, unavailable or unsuitable for your circumstances. Availability, prices, booking conditions, visa or immigration requirements and supplier rules should be verified through the appropriate booking or official process before you rely on them.

Travel09 does not intend to use an AI travel recommendation alone to make a legal or similarly significant decision about a traveller.

Cookies, logs and analytics

Travel09 may use cookies, local storage, server logs and similar technologies to operate the website, maintain sessions, remember preferences, protect accounts, prevent abuse and understand how the website performs.

Some technologies are necessary for website functionality or security. Other analytics, personalisation or advertising technologies should be used only in accordance with applicable law and any required consent choices.

Your browser may allow you to block or delete cookies. Blocking necessary cookies can prevent parts of the website, such as account login or booking-session features, from working correctly.

Marketing and travel updates

Travel09 may send promotional communications where permitted by applicable law and consistent with your choices. These may include destination inspiration, hotel or tour offers, travel content and service updates.

Service messages connected with an enquiry, account, payment or booking are not necessarily marketing and may still be sent where required to provide or administer the service.

You can request to stop optional marketing communications using an unsubscribe mechanism provided in the communication or by contacting us.

Children's personal data

Family bookings can require information about children, such as name, age, date-related travel information, room occupancy, child-age bands or passport information where required by a supplier or authority.

A parent, guardian or other authorised adult should provide children's information when arranging travel. Travel09 does not intend its customer account or enquiry services to invite children to independently provide unnecessary personal information.

Children's information should be used only to the extent reasonably necessary to plan, price, book and support the relevant travel service or satisfy applicable legal requirements.

When personal data may be shared

Depending on the service, Travel09 may disclose relevant personal data to:

• hotels, resorts and accommodation providers;
• tour, activity, guide and experience providers;
• transfer, vehicle, boat, aviation and other transport providers;
• payment processors, financial institutions and payment-service providers;
• website hosting, infrastructure, security, communications, customer-support and technology providers;
• analytics or measurement providers where used;
• AI or automation service providers where an AI-assisted feature is used;
• professional advisers, insurers, auditors and legal advisers where reasonably necessary;
• law-enforcement, courts, regulators, tax, immigration or other public authorities where disclosure is required or legally justified; and
• a buyer, investor or successor in connection with a genuine business reorganisation, financing, sale or transfer, subject to appropriate confidentiality and legal requirements.

Travel09 does not treat the disclosure of data necessary to perform a requested booking as a sale of your travel information merely because a supplier receives the information needed to provide its service.

International and cross-border transfers

Travel is inherently international. Personal data may need to be transferred to or accessed from countries other than the country where you live when this is necessary to arrange a hotel, resort, tour, transport service, experience, technology service or payment.

Data-protection standards can differ between countries. Where applicable law requires safeguards for an international transfer, Travel09 should use a legally permitted transfer mechanism or other appropriate safeguard for the relevant processing.

When you ask Travel09 to arrange an overseas travel service, some information must necessarily reach the supplier in the destination or the provider involved in the booking.

How long we keep personal data

We aim to keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including booking administration, customer support, accounting, tax, fraud prevention, dispute resolution and legal obligations.

Actual retention can differ where applicable law, supplier requirements, a dispute, investigation or legitimate business need requires a different period. Data that is no longer needed should be deleted, anonymised or otherwise handled appropriately.

How we protect information

Travel09 seeks to use reasonable technical and organisational measures appropriate to the nature of the information and processing.

No online service can promise absolute security. If you believe your Travel09 account or personal information has been compromised, contact us promptly.

Data-protection rights

Your rights depend on the privacy law that applies to you and to the particular processing. Subject to applicable conditions and exceptions, rights may include the ability to:

• ask whether Travel09 processes your personal data;
• request access to relevant personal data;
• request correction of inaccurate or incomplete data;
• request deletion or erasure in circumstances where the law provides that right;
• object to or request restriction of certain processing;
• withdraw consent where processing relies on consent;
• request data portability where the applicable law provides that right;
• object to certain direct marketing;
• obtain information about certain automated processing where legally required; and
• complain to an appropriate data-protection regulator or supervisory authority.

We may need to verify your identity before acting on a rights request. We may also need to retain certain information where required for bookings, financial records, fraud prevention, legal claims or other lawful purposes.

Privacy complaints

If you have a concern about how Travel09 has handled your personal data, please contact us first so we can understand the issue and respond.

Depending on the law that applies, you may also have the right to complain to the relevant data-protection authority or supervisory authority. For processing governed by Sri Lanka's data-protection framework, the Data Protection Authority of Sri Lanka is the national supervisory body.

If another organisation independently controls the processing you are concerned about, such as a hotel or payment provider, it may be appropriate to direct the request to that organisation.

Third-party websites and services

Travel09 may link to websites, maps, payment pages, supplier sites, social-media platforms or other third-party services.

A third party's website or service is governed by its own privacy practices. Travel09's Privacy Policy does not automatically control how an independent third party collects or uses information on its own service.

Review the relevant third party's privacy information before providing personal information directly to it.

Changes to this Privacy Policy

Travel09 may update this Privacy Policy when services, technology, suppliers, legal requirements or data practices change.

The current version will be published on this page with an updated revision date. Where a material change requires an additional notice or consent under applicable law, Travel09 should provide that notice or obtain that consent as required.

Contact Travel09 about privacy

For questions about this Privacy Policy, a privacy request, account-data concern or suspected privacy issue, contact Travel09 through the Travel09 Contact page.