Privacy Policy

1. Who we are

Hike Lanka is a hiking marketplace operated by Harker International (Private) Limited, Sri Lankan company registration PV 00338032, registered office in Kandy, Sri Lanka. Throughout this policy “Hike Lanka”, “we”, “us” and “our” refer to that legal entity acting in its role as platform operator.

For privacy questions, contact: info@hikelanka.com.

This policy also covers the Hike Lanka Android app (package com.hikelanka.app) published on Google Play. The app is a secure wrapper around this same website, so it collects, uses and shares exactly the data described below and nothing more. It requests no device permissions such as location, camera or contacts, shows no advertising, and collects no payment information. You can request deletion of your account and the data attached to it at any time, without signing in, at hikelanka.com/delete-account/.

2. What we collect

From hikers

• Account details - name, email, password hash, billing address, phone (optional), language preference. Collected when you register a customer account or check out as a guest.
• Booking details - trip selected, dates, party size, special requirements you provide (dietary, medical relevant to the trip), the vendor you booked with.
• Payment details - collected and stored by Stripe, not Hike Lanka. We see the last four digits of the card, the card brand, billing country, and Stripe’s payment ID. Full card numbers never touch our servers.
• Messages - any messages you send through the platform to a vendor or to Hike Lanka support.
• Mailing list - if you ask us for the trekking checklist, we store your email address, the page you asked from, and a record of the consent you gave (the exact wording you agreed to, and when). We do not store your IP address for this, only a one-way hash of it. Ticking that box is optional and the rest of the site works without it. Every message we send carries an unsubscribe link.

From vendors

• Business profile - business name, registration number, contact details, the categories of trips you run, your store description and photos.
• Compliance documents - proof of liability insurance, guide certifications, and SLTDA / SLAITO registration where applicable. Stored encrypted in the WCFM vendor record.
• Payout details - bank account or Stripe Connect account used to receive vendor payouts.

From everyone visiting the site

• Analytics - anonymized usage via Google Analytics 4 with IP anonymization. Page views, referrer, device type, country-level location.
• Cookies - see our cookie policy for the live, auto-generated list.
• Server logs - IP address, request timestamp, user agent, requested URL. Retained for security and abuse investigation.

3. Why we collect it

We collect data only for these purposes:

• Fulfilling bookings - connecting hikers with vendors, sharing the minimum trip details the vendor needs to deliver the service.
• Processing payments and payouts - through Stripe, including fraud screening.
• Account management - login, password recovery, transactional email.
• Platform safety - detecting fake accounts, fraud, abusive behaviour, vendor non-performance.
• Improving the platform - anonymized analytics on what content and trips hikers find useful.
• Legal obligations - tax records, anti-money-laundering checks on vendor payouts, regulatory requests.

We do not sell your personal data. We do not share it with advertising networks for cross-site targeting. We do not use it to train AI models.

4. Third parties who process data for us

Where these processors are based outside Sri Lanka - most notably Stripe (US/Ireland), Automattic (US), Google (US), Cloudflare (US) - we rely on their standard contractual safeguards (Standard Contractual Clauses or equivalent) for cross-border transfer.

5. How long we keep it

• Account data - for as long as your account is active, then up to 7 years after closure for tax and audit purposes.
• Booking records - 7 years (Sri Lanka tax retention requirement).
• Vendor compliance documents - duration of vendor relationship plus 3 years.
• Analytics - 14 months (Google Analytics 4 default).
• Server logs - 90 days unless flagged for security investigation.
• Consent records - kept for as long as Sri Lankan / EU regulators may require us to demonstrate consent, typically 3 years from collection.
• Mailing-list subscription - until you unsubscribe, and we remove the address within 30 days of that. The consent record itself is kept under the line above, because it is the evidence that the subscription was lawful.

6. Your rights

Under Sri Lanka’s Personal Data Protection Act (No. 9 of 2022) and, where applicable, the EU GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request erasure of your data, subject to legal retention obligations.
• Receive your data in a portable format.
• Object to processing or restrict it where you contest its accuracy.
• Withdraw consent at any time, including for analytics cookies, via the consent banner.

To exercise any of these, email info@hikelanka.com. We respond within 30 days.

7. Cookies

The full, auto-generated list of cookies used on this site lives at /cookie-policy/. You can change your cookie preferences any time via the floating shield button at the bottom-right of any page.

8. Children

Hike Lanka is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you become aware that a minor has provided us data, email us and we will delete it.

9. Contact & complaints

For privacy questions or to exercise any right above, contact info@hikelanka.com.

If you believe we have not handled your data lawfully, you can complain directly to the Sri Lanka Data Protection Authority once it becomes operational under the PDPA, or - for EU residents - to your local supervisory authority. You also have the right to seek judicial remedy under applicable law.

This policy may change as Hike Lanka evolves. Material changes will be flagged on the homepage and notified by email to registered accounts at least 30 days before they take effect.