Privacy Notice

About this notice

This notice explains how Ruhunu Tourist Bureau handles personal data through the Ruhunu NextGen Tourism website at https://nextgentourism.lk. It is written for teachers, principals, parents, students and anyone else who uses the site.

We follow Sri Lanka's Personal Data Protection Act, No. 9 of 2022, as amended by the Personal Data Protection (Amendment) Act, No. 22 of 2025. In this notice we call it "the Act".

Our Cookie Policy explains the small amount of information stored in your browser. Our Child Safeguarding and Media Consent page explains how we handle students' names and photos.

Who we are and how to contact us

Ruhunu Tourist Bureau runs Ruhunu NextGen Tourism. We decide how and why personal data collected through this website is used, so under the Act we are the controller of that data. Our address is No. 153 B, S. H. Dahanayaka Mawatha, Galle, Sri Lanka.

For any question about your personal data, or to use your rights, contact the person responsible for data protection at Ruhunu Tourist Bureau:

Email: [email protected]
Phone: +94 91 222 4072
Post: No. 153 B, S. H. Dahanayaka Mawatha, Galle, Sri Lanka, marked "Data protection"

You can also use our enquiry form and choose the topic "Privacy / data request".

Information we collect

We collect personal data only through two forms, plus a small amount of technical data that every website needs.

School tourism club registration. This form is for teachers and principals only. It asks for:

the school's name and education zone
the coordinator's name and role at the school
a phone or WhatsApp number
an email address (optional)
the approximate number of club members (optional)
the sections taking part: Primary, Secondary or Tertiary
a message (optional)
a tick box to confirm your consent

General enquiries. This form asks for your name, email address, phone number (optional), the topic of your enquiry, your message and a tick box to confirm your consent.

Technical data. When you visit the site, our hosting server and Cloudflare receive your IP address and details of each request, such as the page requested, the time and your browser type. This is needed to deliver pages, keep the site secure and prevent abuse.

Facebook. If you send a message or comment to our Facebook page at https://www.facebook.com/ruhunu.nextgentourism, we receive what you send and your public profile name.

What we do not collect or do

We do not collect students' personal data through this website. The registration form asks you not to include students' names or contact details.
We do not ask for sensitive information such as health, religion or ethnicity. Please do not include it in messages.
We do not use analytics or advertising cookies of our own. The Facebook feed on some pages lets Meta set its own cookies; you can switch it off (see our Cookie Policy).
We do not profile you or make decisions about you by automated means.
We never sell personal data.
Competition entries and innovation proposals are not uploaded through this website at present. They are handled through schools, youth clubs and our programme processes.

Why we use your information

To register a school's tourism club and keep a record of it in the programme.
To contact the club coordinator about programme activities, competitions and awards.
To answer your enquiry and keep a record of our reply.
To handle requests from people using their rights under the Act, and to show that we did so properly.
To keep the website secure, prevent spam and abuse, and limit repeated form submissions.
To publish competition results, as explained in the section on students and children.

We will not use your information for a new, unrelated purpose without telling you first.

Our legal grounds under the Act

The Act allows personal data to be processed only on certain grounds, which it lists in Schedule I. We rely on the following:

Consent. When you send a form, you tick a box to give your consent. This is our ground for club registrations and enquiries. You can withdraw your consent at any time. This does not affect anything we did before you withdrew it.
Public interest and our functions. Ruhunu Tourist Bureau promotes and develops tourism in the Southern Province. Running Ruhunu NextGen Tourism, keeping programme records and publishing results are part of that public work. Where we rely on this ground, you can ask us to stop.
Legal obligation. We keep records of rights requests, and respond to them, because the Act requires it.
Legitimate interests. We process IP addresses and request details because this is necessary and proportionate to keep our network and information secure. The Act recognises this as a legitimate interest. We also show our Facebook feed so that visitors can follow programme news; you can object by switching it off in Privacy settings. We give extra weight to the interests of anyone who may be a child.
Emergencies. In rare cases we may use or share information to respond to an emergency that threatens someone's life, health or safety.

Students and children

The Act defines a child as a person under 16. It treats personal data about a child as a special category that needs extra protection, and where consent is needed it must come from a parent or legal guardian. For safeguarding, we treat every student under 18 as a child.

Students do not register or send personal data through this website.
Students take part through their school. The school's teacher coordinator is our point of contact.
We publish a student's name or photo only with the school's approval and the consent of a parent or legal guardian.
Results may name schools. Winners' names appear only where that consent has been given.
A parent or legal guardian can use a child's rights under the Act, including asking us to remove a name or photo.

If a child's personal data has been sent to us through this site by mistake, tell us at [email protected] and we will delete it. Our Child Safeguarding and Media Consent page gives more detail.

Who sees and receives your information

Form submissions are stored in the website's database. Only authorised Ruhunu Tourist Bureau programme staff who sign in to the admin area can see them, and each person's access depends on their role.

We share personal data outside Ruhunu Tourist Bureau only in these cases:

With the service providers who host and protect the website (see the next section). They act on our instructions.
If we contact you on WhatsApp, or you contact us on Facebook, Meta processes those messages under its own terms.
If the law requires it, for example a court order.
To respond to an emergency that threatens someone's life, health or safety.

Facebook feed. Some pages show a feed from our Facebook page, which loads automatically. You can switch it off at any time by choosing "Necessary only" in the privacy banner or in Privacy settings; after that, your browser does not connect to Facebook from this site. While it is on, Meta can collect data such as your IP address and set its own cookies, under its own policies: https://www.facebook.com/privacy/policy/

We do not give your details to sponsors, advertisers or other organisations for their own use.

Storage outside Sri Lanka

The website is hosted by Vibe Hosting on a server in Germany, in the European Union, provided by Contabo. Cloudflare, Inc., a company based in the United States, provides network, security and content delivery services through a global network of data centres. Requests to the site pass through Cloudflare.

This means personal data sent through this website is stored and processed outside Sri Lanka. The Act allows this where the controller continues to meet the Act's requirements and puts appropriate safeguards in place. Our safeguards are:

providers bound by contract to protect personal data
HTTPS encryption for all traffic between your browser and the site
sign-in and role-based access controls, so only authorised staff can see submissions
collecting only what we need and deleting it on time

Germany is covered by the European Union's General Data Protection Regulation. We will adopt any safeguards that the Data Protection Authority of Sri Lanka specifies for transfers outside Sri Lanka, and we will update this notice if our arrangements change.

How long we keep information

Enquiries: up to 12 months after the enquiry is closed.
Club registrations: while the club takes part in the programme and for up to 2 years after, then deleted or anonymised.
Records of rights requests: as long as needed to show that we handled them lawfully.
Server logs: a short period, normally no longer than 90 days.
IP addresses used for rate limiting: held in memory only, not saved to the database.
Your privacy choices stored in your browser: 12 months (see our Cookie Policy).

Published results and news may stay on the site as a record of the programme, unless you ask us to remove a name or photo. We keep information longer only if the law requires it.

Keeping information secure

We use technical and organisational measures suited to the risks, including:

HTTPS encryption for all pages and forms
sign-in and role-based access for staff
Cloudflare security services to block attacks and automated abuse
rate limits on forms
collecting only the data we need

No website can be completely secure. If a personal data breach happens, we will notify the Data Protection Authority and, where required, the people affected, as the law requires.

Your rights and how to use them

Under the Act you have the right to:

ask whether we hold personal data about you, and receive a copy with the information set out in this notice
withdraw your consent at any time, where we rely on consent
ask us to stop processing your data, where we rely on public interest or legitimate interests
ask us to correct or complete data that is inaccurate or incomplete
ask us to erase your data, for example after you withdraw consent or if it was processed unlawfully
ask us to review a decision made solely by automated means (we do not make such decisions)
appeal to the Data Protection Authority if we refuse your request

Send your request in writing to [email protected] or by post to No. 153 B, S. H. Dahanayaka Mawatha, Galle, Sri Lanka, or use the enquiry form with the topic "Privacy / data request". A parent or legal guardian can make a request for a child, and you can authorise someone in writing to make a request for you.

We may ask for information to confirm your identity before we act.
We do not charge a fee.
We will tell you in writing, within one month of receiving your request, whether we have granted it. If we need more time, we will tell you before that month ends. The total time will not exceed three months.
If we refuse, we will give our reasons unless the law prevents it, and tell you how to appeal.

The Act allows us to refuse a request only in limited cases, for example where acting on it would affect other people's rights, or where another law requires us to keep the data.

Complaints

Please contact us first at [email protected] or +94 91 222 4072 so we can try to put things right.

If you are not satisfied with our answer, you can complain or appeal to the Data Protection Authority of Sri Lanka:

Website: https://dpa.gov.lk
Email: [email protected]
Address: First Floor, Block 5, BMICH, Bauddhaloka Mawatha, Colombo 07

Changes to this notice

We will update this notice when the website, our service providers or the law change. If we make an important change, we will highlight it on the website.

Last updated: 4 October 2026