Privacy Policy

Last updated: January 15, 2026

Sky Ticketing (“we”, “us”, “our”) is an IATA-certified travel agency registered in Sri Lanka. This Privacy Policy explains how we collect, use, disclose, and safeguard the personal information of customers, leads, vendors, and site visitors who interact with our website, social channels, or travel consultants.

1. Information We Collect

  • Identity & contact data: name, email address, phone/WhatsApp number, nationality, passport numbers, and emergency contact details.
  • Travel documentation: visa copies, itinerary preferences, loyalty numbers, and special assistance notes required to fulfil bookings.
  • Payment data: we process card/cash information through PCI-compliant processors; no full card details are stored on our servers.
  • Communications: inquiry forms, WhatsApp chats, recorded calls (when applicable), and support tickets used for quality and compliance.
  • Website & device data: IP address, browser type, and analytics cookies that help us improve site performance and marketing attribution.

2. How We Use Your Information

We process personal data to:

  • Provide quotations, issue airline tickets, manage hotel and ground arrangements, and deliver tailored itineraries.
  • Prepare visa submissions or pilgrimage clearances requested by you.
  • Send booking confirmations, service updates, reminders, and regulatory notices.
  • Handle support requests, refunds, insurance claims, disputes, or chargeback evidence.
  • Comply with aviation, immigration, tax, and anti-fraud regulations in Sri Lanka and other jurisdictions.
  • Deliver marketing communications when you opt-in, with the choice to unsubscribe anytime.

3. Legal Bases for Processing

Depending on your location, we rely on the following legal bases: contract necessity (to fulfil travel services), legitimate interests (service improvement and fraud prevention), legal obligation (regulatory reporting), and consent (optional marketing).

4. Data Sharing & Disclosure

  • Travel suppliers: airlines, GDS partners, hotel consolidators, visa centres, and pilgrimage coordinators strictly for the services requested.
  • Technology & payment vendors: hosting providers, CRM, CRM, SMS/email gateways, and payment processors bound by confidentiality clauses.
  • Professional advisors: auditors, insurers, and legal counsel when necessary to protect our business or comply with law.
  • Law enforcement/regulators: when required by court order, lawful request, or to enforce our terms.

5. International Transfers

Sky Ticketing routinely works with airlines, hotels, and partners located outside Sri Lanka. Whenever personal data is transferred internationally, we ensure appropriate safeguards such as contractual clauses, secure transmission, and disclosure of purpose.

6. Data Retention

We retain personal information only for as long as required to fulfil bookings, satisfy regulatory requirements (e.g., aviation records), resolve disputes, and back up accounting entries. Archived data is securely stored and disposed of when retention periods lapse.

7. Information Security

Security measures include role-based access, encrypted channels for sensitive uploads, secure payment gateways, staff NDAs, and ongoing monitoring. Despite best efforts, no digital transmission is 100% secure, so we encourage customers to share files through our approved channels only.

8. Cookies & Third-Party Links

Our website uses essential cookies for functionality and analytics cookies to understand traffic. When WordPress blog content is embedded, additional cookies from wordpress.com or external publishers may load. You can manage preferences through your browser or consent banner.

9. Your Privacy Rights

Depending on your jurisdiction, you may request to:

  • Access or receive a copy of your personal data.
  • Correct inaccurate or outdated information.
  • Withdraw consent for marketing communications.
  • Request deletion, subject to legal or contractual limitations.
  • Lodge a complaint with the Sri Lankan Data Protection Authority or your local regulator.

10. Children’s Data

We offer family travel arrangements but do not knowingly collect data from children under 16 without parental or guardian consent. Please contact us immediately if you believe a child has submitted data without consent.

11. Policy Updates

We may update this Privacy Policy to reflect legal, technical, or service changes. Revised versions will carry a new “Last updated” date and take effect immediately once posted.

12. Contact Us

For privacy questions, data requests, or security notifications, please contact us: