Privacy Policy

Personal Information you provide directly:

• Full name, email address, phone number, and nationality when submitting a booking or contact form.
• Passport details (number, expiry date, nationality) required for permit applications.
• Emergency contact name and relationship.
• Dietary requirements and medical conditions relevant to your trek safety.
• Payment details (processed securely via our payment gateway — we do not store raw card data).

Information collected automatically:

• IP address, browser type, operating system, and device identifiers.
• Pages visited, time spent, referring URLs, and click-through paths.
• Cookies and similar tracking technologies (see Section 4).
• Geographic location (country/region level, derived from IP).

We use your personal information to:

• Process and confirm your trek bookings and payments.
• Obtain required trekking permits (TIMS Card, Sagarmatha National Park Entry Permit) on your behalf.
• Coordinate logistics including accommodation, guides, and porters.
• Send booking confirmations, itinerary details, and pre-departure information.
• Respond to enquiries and provide customer support.
• Send occasional newsletters and promotional offers (only with your explicit consent).
• Improve our website, services, and user experience through analytics.
• Comply with applicable legal and regulatory obligations.
• Protect against fraud, abuse, and unauthorized transactions.

Legal basis (GDPR): We process your data on the grounds of contract performance (booking fulfillment), legitimate interests (service improvement, fraud prevention), and consent (marketing emails).

We do not sell, rent, or trade your personal data. We may share it only with the following categories of recipients for the purposes listed:

Our website uses cookies and similar technologies to enhance your browsing experience and collect usage analytics. The types of cookies we use:

• Strictly Necessary — essential for the website to function (e.g., session management, CSRF protection). Cannot be disabled.
• Performance & Analytics — help us understand how visitors interact with the site (e.g., Google Analytics, anonymized). Can be declined.
• Functional — remember your preferences (e.g., currency selection, language). Can be declined.
• Marketing — used to show you relevant advertisements across the web. Disabled by default; enabled only with your consent.

You can control cookie preferences at any time through your browser settings or our on-site cookie banner. Note that disabling certain cookies may affect website functionality.

We retain your personal data for the following periods:

• Booking & payment records — 7 years (required for tax and financial compliance in Nepal).
• Trek participation records (permits, emergency contacts) — 5 years.
• Marketing & newsletter data — until you unsubscribe or request deletion.
• Website analytics data — 26 months (anonymized).
• Customer support communications — 3 years.

After these periods, data is securely deleted or anonymized. You may request early deletion subject to our legal retention obligations (see Section 6).

Depending on your country of residence, you may have the following rights regarding your personal data:

• Right to Access — request a copy of the personal data we hold about you.
• Right to Rectification — correct inaccurate or incomplete data.
• Right to Erasure — request deletion of your data ("right to be forgotten").
• Right to Restriction — request that we limit how we process your data.
• Right to Data Portability — receive your data in a machine-readable format.
• Right to Object — object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent — withdraw consent at any time for consent-based processing.
• Right to Lodge a Complaint — with your local data protection authority (e.g., ICO in the UK, CNIL in France).

To exercise any of these rights, contact us at msm47374@gmail.com. We will respond within 30 days.

Gokyo Explorer is based in Kathmandu, Nepal. When you provide information from outside Nepal (for example, from the EU, UK, or USA), your data may be transferred to and processed in Nepal or other countries where our service providers operate.

For transfers from the European Economic Area (EEA) or United Kingdom, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or the recipient's certification under recognized frameworks.

By submitting your information, you acknowledge and consent to this transfer. We take all reasonably necessary steps to ensure your data is treated securely in accordance with this Privacy Policy.

We implement industry-standard technical and organizational measures to protect your personal information:

• TLS/SSL encryption for all data transmitted to and from our website.
• Encrypted storage for sensitive personal data (e.g., passport numbers).
• Role-based access controls — only authorized staff can access personal booking data.
• Regular security audits and vulnerability assessments.
• Third-party payment processors handle card data; we never store raw payment credentials.
• Staff trained in data protection and privacy best practices.

While we strive to protect your information, no method of transmission over the internet is 100% secure. In the event of a data breach that affects your rights, we will notify you as required by applicable law.

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at msm47374@gmail.com and we will promptly delete such data.

For trekkers under 18 who participate in our treks with parental/guardian consent, we collect only the minimum personal information necessary and apply heightened protection measures.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or applicable laws. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Send a notification email to registered users and newsletter subscribers.
• Display a prominent notice on our website for at least 30 days.

We encourage you to review this policy periodically. Your continued use of our website after changes are posted constitutes your acceptance of the revised policy.

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out to our Privacy Team:

We aim to respond to all privacy-related enquiries within 3 business days.