Privacy policy

In short

• We collect only what we need to answer your request, prepare your quote and, if you go ahead, hire you a car.
• We do not use advertising or analytics cookies, and we do not sell your information.
• A few service providers help us run the service: hosting, email, and payments. They are listed below.
• You can ask to see, correct or delete your information at any time. Write to hello@kinway.co.

1. Who we are

Kinway offers self-drive car hire in Sri Lanka. In this policy, "we" means Kinway. We are responsible for the personal information described here. You can reach us at hello@kinway.co or on +44 7768 787 119 (United Kingdom) or +94 11 000 0000 (Sri Lanka).

This policy applies to our website, to our messages with you by email, phone and WhatsApp, and to the information we collect when you collect or return a car. It does not cover other websites that we link to.

2. The information we collect

What you give us

• When you ask for a price or make a provisional booking: your name, email address, phone or WhatsApp number, arrival and departure dates, flight number (optional), the number of adults and children travelling, where you are flying from, the vehicle type you prefer, the currency for your quote, and anything you add in the notes box.
• When you write or call us: the content of your messages and calls, and your contact details.
• When you confirm a hire and collect the car: your driving licence and passport details, and any permit you hold, which we note on the rental agreement. We keep a copy of the driving licence of you and of every additional driver. If you pay by card, a payment provider takes your card details. We do not see or store your full card number.

Please do not put sensitive information in the notes box, such as health details, unless you want us to act on it. For example, you might tell us about a mobility need so that we can plan your hire. If you do, we use it only for that.

What we collect automatically

• Technical data. When you visit the site, our hosting provider records your IP address, browser and device type, the pages requested, and the date and time. We use these logs to keep the site secure and working.
• Spam checks. The enquiry form includes a hidden field and measures roughly how long the form took to complete. We use these only to filter out automated submissions. We do not build a profile from them.

What we do not do

We do not use advertising cookies, analytics cookies or tracking pixels. We do not run user accounts or passwords. See our Cookie Policy.

3. How we use your information, and why

• To answer your request, prepare your quote and manage your provisional booking. We do this to take steps you ask for before a contract, and because it is necessary to run our business.
• To provide your hire, take payment and look after you during your trip. We do this to carry out our contract with you.
• To keep records for tax, accounting and legal claims. We do this to meet our legal obligations and protect our legitimate interests.
• To keep the site secure and prevent spam and fraud. This is in our legitimate interests.
• To improve our service and this website. This is in our legitimate interests, and we use the minimum information needed.
• To send you reminders or offers. We do this only if you ask us to or opt in. You can withdraw your consent at any time.

We do not make decisions about you by automated means that have a legal or similarly significant effect.

4. Who we share your information with

We share information only where we need to, and only with:

• Technology providers: companies that host our website, deliver our email and help keep our systems secure. They act only on our instructions.
• Messaging services: if you contact us through a messaging app such as WhatsApp, that service handles your messages under its own privacy policy.
• Payments: the payment provider that processes your payment when you confirm a hire.
• Insurance and recovery: our insurer, or a recovery or repair service, where an incident requires it.
• Professional advisers: our accountants and lawyers, who must keep your information confidential.
• Authorities: the police, courts or regulators, where the law requires it or an incident such as an accident makes it necessary.
• A buyer of the business, if we ever sell it. They would have to honour this policy.

We do not sell your information, and we do not share it for third-party advertising.

5. Where your information goes

We operate in Sri Lanka, and our customers live in the UK, Canada, Australia, Italy and elsewhere. Our service providers may process information in other countries, including the United States. Where the law requires safeguards for such transfers, we use them. These include standard contractual clauses or an equivalent approved mechanism.

6. How long we keep it

• Enquiries that do not become a hire: 12 months, then we delete them.
• Hire records, including the rental agreement and payment records: 7 years, for tax, accounting and legal claims.
• Marketing consent records: until you withdraw consent, plus a short period to prove it.
• Server logs: a short period, set by our hosting provider.

7. Your rights

Depending on where you live, you may have the right to:

• ask for a copy of the information we hold about you;
• ask us to correct information that is wrong;
• ask us to delete your information, or restrict how we use it;
• object to our use of your information where we rely on our legitimate interests;
• receive your information in a portable format;
• withdraw consent at any time, where we rely on consent.

To use any of these rights, write to hello@kinway.co. We may ask you to confirm who you are. We will reply within one month. There is normally no charge.

If you are unhappy with how we have handled your information, please tell us first so that we can put it right. You also have the right to complain to the authority where you live:

• United Kingdom: the Information Commissioner's Office.
• European Union, including Italy: your national data protection authority. In Italy, this is the Garante per la protezione dei dati personali.
• Canada: the Office of the Privacy Commissioner of Canada.
• Australia: the Office of the Australian Information Commissioner.
• Sri Lanka: the Data Protection Authority, under the Personal Data Protection Act, No. 9 of 2022, as it comes into force.

8. Security

We use reasonable technical and organisational measures to protect your information. This includes encrypted connections (HTTPS) to our website and limiting who can see your enquiry. No system is completely secure, so please tell us at once if you think your information has been misused.

9. Children

Our service is for adults. You must be at least 21 years old to hire a car from us. We do not knowingly collect information from children.

10. Links to other websites

Our site links to other websites, such as government travel advice and our social media profiles. We are not responsible for their privacy practices. Please read their policies.

11. Changes to this policy

If we change this policy, we will update the date at the top of the page. If the change is important, we will tell you more directly, for example by email if you have an open booking.

12. Contact

Questions about this policy, or a request about your information: hello@kinway.co, or +44 7768 787 119 (United Kingdom) or +94 11 000 0000 (Sri Lanka).