Privacy Policy

Last updated: 4 November 2026

WAVE ENTERTAINMENT LANKA (PVT) LTD ("Wave.lk", "we") runs this website and the Wave.lk mobile app. This policy explains what personal information we collect and how we use it.

Information we collect

  • Account details: your full name, email address, phone number and password. Passwords are stored only in hashed form.
  • Booking details: the services you book, dates, time slots, number of guests, amounts, coupon codes and booking status.
  • Messages: what you send us when you contact us.

Payment information

Payments are processed by our payment provider, OnePay. Card details are entered with and handled by OnePay. We do not receive or store your full card number or CVV. We keep only the payment status and the amount of each transaction.

How we use your information

  • To create and manage your account
  • To take, confirm and manage your bookings and payments
  • To process cancellations and refunds
  • To send you messages about your bookings and answer your questions
  • To prevent fraud and meet our legal obligations

Who we share it with

We do not sell your personal information. We share it only as needed with:

  • The boat, activity and rental operators who deliver your booking
  • OnePay, to process payments and refunds
  • Technical service providers who host our systems
  • Authorities, where the law requires it

Website and cookies

This website does not set its own cookies. It loads fonts from Google Fonts, which means Google receives your IP address when you visit. The Wave.lk app stores your sign-in token securely on your device so that you stay logged in.

How long we keep it

We keep your account information while your account is active. We keep booking and payment records for as long as we need them for accounting, tax and legal purposes.

Your rights

You can ask us to access, correct or delete your personal information, subject to the records we must keep by law. We handle personal information in accordance with applicable Sri Lankan law, including the Personal Data Protection Act, No. 9 of 2022. To make a request, email info@wave.lk.

Security

We use reasonable technical and organisational measures to protect your information. No system is completely secure, so please keep your password private.

Changes to this policy

We may update this policy from time to time. The latest version is always on this page, with the date it was last updated.

Contact

Questions about privacy can be sent to info@wave.lk. See all our details on the Contact page.