Last updated: May 28, 2026. We review this policy periodically and when our services or providers change. For how we handle personal data more generally, see our Privacy Policy.
About this policy
This Cookie Policy explains how Xclusive Adventures uses cookies and similar technologies on this website, and how you can control them. It is written to align with the EU/UK General Data Protection Regulation (GDPR) and the ePrivacy rules, and with Sri Lanka's Personal Data Protection Act (PDPA). It sits alongside our Privacy Policy, which explains how we handle personal data more generally.
By default the site sets only strictly-necessary cookies.
Analytics and marketing technologies load only after you accept them in the consent banner.
You can change or withdraw your choice at any time — see "How to accept, decline, or withdraw consent" below.
What cookies and similar technologies are
Cookies are small text files placed on your device when you visit a website. They let a site remember your actions and preferences for a period of time. Similar technologies — such as browser local storage, tags, and tracking pixels — work in comparable ways. We use a mix of these, but only the strictly-necessary ones run automatically.
First-party items are set by this website; third-party items are set by services such as Google or Meta.
Session items last only while your browser is open; persistent items remain for a set period or until you delete them.
We store your cookie consent choice in your browser's local storage so the banner does not appear on every page.
Strictly necessary (always on)
These are required for the website to work and to remember your privacy choices. They do not track you for marketing and cannot be switched off in our banner, because the site cannot function properly without them. Under GDPR and the PDPA these do not require consent, as they are necessary to provide the service you have asked for.
Storing your accept or decline consent choice so we respect it on later visits.
Basic security, load-balancing, and form-submission integrity, including spam protection.
Legal basis: legitimate interest / necessity to provide the website you requested.
Analytics (only with your consent)
Analytics technologies help us understand which Sri Lanka planning pages and campaigns lead to useful enquiries, so we can improve the website. We use Google Analytics 4, loaded through Google Tag Manager. These load only after you click "Accept analytics" in the consent banner, and not before.
Measures page views, traffic sources, approximate location, device and browser type, and interactions such as enquiry submits and WhatsApp clicks.
Set by Google as a third party; data is processed in aggregated form.
Legal basis: your consent. You can withdraw it at any time.
Marketing and retargeting (only with your consent)
Marketing technologies let us measure advertising and, where enabled, show relevant content to people who have visited the site. We use the Meta (Facebook/Instagram) Pixel, which loads only after you accept in the consent banner and only if it has been switched on for the site.
Helps measure ad performance and build retargeting audiences across Meta platforms.
Set by Meta as a third party.
Legal basis: your consent. You can withdraw it at any time.
How to accept, decline, or withdraw consent
When you first visit, a banner lets you accept or decline analytics and retargeting. If you decline, only strictly-necessary cookies are used — enquiry and booking forms, the planning newsletter, WhatsApp links, and normal browsing all keep working. You can change your mind at any time.
Accept: click "Accept analytics" in the banner to allow analytics and retargeting.
Decline: click "Decline" to keep only strictly-necessary cookies.
Withdraw or change: clear this site's stored choice and cookies in your browser settings; the banner will appear again so you can choose afresh.
Browser controls: most browsers also let you block or delete cookies site-by-site, though blocking strictly-necessary items may stop parts of the site working.
Third-party providers
Some technologies are set by third parties who act as independent controllers for their own services. We do not control their cookies directly, but they only load on this site after you give consent. You can read how each provider uses data in their own policies.
Google (Analytics and Tag Manager): see policies.google.com/privacy and policies.google.com/technologies/cookies.
Meta (Facebook/Instagram Pixel): see www.facebook.com/privacy/policy and www.facebook.com/policies/cookies.
These providers may process data outside Sri Lanka and the EU/UK; appropriate safeguards apply, as described in our Privacy Policy.
How long cookies last
Retention depends on the cookie. Some expire when you close your browser; others persist for a defined period set by us or the relevant third party.
Your stored consent choice persists until you clear it, so we can keep respecting it.
Analytics and marketing items follow the retention periods set by Google and Meta respectively.
You can delete any cookie at any time through your browser settings.
Contact
If you have any question about how we use cookies, or want to exercise your data-protection rights, contact us by email or WhatsApp. See our Privacy Policy for full detail on the personal data we handle, the legal bases we rely on, and your rights.