Privacy & Data Protection Policy

To facilitate your tour bookings, airport logistics, hotel check-ins, and high-altitude permits, we collect the following personal data:

• Primary Contact Details: Full name, telephone/WhatsApp number, email address, and billing address.
• Passenger Manifest Information: Names, ages, and genders of all co-travellers in your group, required for hotel rooming rosters and vehicle seat allocations.
• Identification Documents (where mandated): Government-issued ID numbers (Aadhaar, Passport, or Voter ID) exclusively when required by local mountain district magistrates (e.g. Leh Inner Line Permits, Sikkim border checkpoints).
• Special Requests: Voluntary dietary requirements, medical acclimatization concerns, or room configuration preferences.
• Device & Session Logs: IP address, device type, and browser user-agent used for transaction security, rate-limiting, and fraud prevention.

We process your personal information strictly for legitimate travel operational purposes:

Security of your funds and payment details is our highest priority:

• We operate under the PCI-DSS SAQ-A scope. Card numbers, expiration dates, and CVVs are entered directly on the tokenized payment gateway modal and never transit or reside on our servers.
• Online transactions are settled via authorized payment aggregators (e.g. Razorpay, Cashfree) using 256-bit TLS encryption and mandatory Two-Factor Authentication (OTP / 3D Secure).
• We retain only non-sensitive transaction metadata: gateway transaction reference, date, payment method type (e.g. UPI, NetBanking, Card), and the amount paid.

We never sell, rent, or trade your personal data to advertisers or data brokers.

Information is shared only with confirmed operational partners necessary to fulfill your booked tour:

• Allocated hotels, chalets, and wilderness camps for room bookings.
• Assigned transport operators, taxi unions, and mountain guides for trip execution.
• District Magistrate or wildlife forest departments for mandated Inner Line and adventure permits.
• Statutory authorities when compelled by court orders or Indian law enforcement.

We use essential cookies and browser storage solely for core site functionality:

• Essential Session Cookies: Maintaining your active booking session, seat hold countdown, and CSRF security tokens.
• Browser Local Storage: Storing your saved tour Wishlist and cookie consent preference on your device without transmitting it to third parties.
• Analytics: Anonymous aggregated performance metrics to improve site loading speed and user experience.

As a data principal, you have the following statutory rights under the Digital Personal Data Protection Act, 2023:

• Right to Access: Request a copy of all personal information held about you and your booking history.
• Right to Correction: Update outdated traveller names, contact numbers, or dietary notes.
• Right to Erasure: Request the deletion of your personal data after the conclusion of your trip, subject to statutory GST tax invoice retention periods mandated by Indian law (minimum 6 years).
• Right to Withdraw Consent: Opt out of promotional WhatsApp or email communications at any time.

For any privacy questions, data access requests, or grievance redressal, please contact our Data Protection Officer: