The Himalayan Guru

Privacy & data protection

What we collect, why we collect it, how long we keep it, and how to ask us to delete it. Plain language. Last reviewed 13 May 2026.

Who we are

The data controller is The Himalayan Guru atelier, Srinagar, Jammu & Kashmir, India. For data-protection queries, write to hello@thehimalayan.guru with "Privacy" in the subject. EU and UK guests may also direct enquiries to the same address; we will respond within the GDPR-mandated thirty days.

What we collect — and why

What	Why	Lawful basis	Kept for
Name, email, phone	To answer your inquiry and compose your journey	Contract performance + legitimate interest	3 years after last contact, then deleted
Travel preferences (region, dates, budget, party)	To prepare a meaningful written response	Contract performance	3 years
Access requirements (if you choose to share)	To compose a journey that works for you	Explicit consent (special-category data)	Duration of journey + 30 days, then deleted
Hashed IP of inquiry sender	Rate-limiting and abuse prevention	Legitimate interest	10 minutes
Aggregate site analytics (no cookies)	Understand which content is read	Legitimate interest	12 months, aggregate only
Booking + payment records	Statutory accounting and tax records	Legal obligation	7 years (Indian Income Tax Act)

How we protect it

All site traffic is TLS 1.3 over HTTPS.
Inquiry submissions are validated server-side, rate-limited, and protected by Cloudflare Turnstile.
Atelier files are stored in encrypted-at-rest cloud storage with multi-factor authentication on every account.
Payments are processed by PCI-DSS certified providers (Razorpay India and Stripe internationally). We never see, store, or log full card numbers.
Access requirements and medical notes are restricted to your dedicated composer's working file; they are not stored on suppliers' systems and are deleted thirty days after your journey ends.

Who we share it with — and who we don't

We do not sell your data. Ever.

We share specific fields with specific parties only as required to deliver your journey:

Properties & ground partners — name, arrival date, party size, room preferences, dietary requirements.
Permit-issuing authorities — full legal name, date of birth, passport number for Inner Line Permits, Bhutan visas, restricted-area permits.
Payment processors — name, billing address, card details (handled by them, never seen by us).
Email infrastructure — your inquiry transits through standard SMTP servers; messages are encrypted in transit.

Your rights

You may, at any time and without giving reasons:

Access a copy of everything we hold on you.
Correct anything that is wrong.
Delete your data ("right to be forgotten") subject to our statutory retention obligations.
Object to any processing carried out under "legitimate interest".
Port your data to another travel composer in machine-readable form.
Withdraw consent for any special-category data at any time.
Complain to your local data-protection authority — in India, the Data Protection Board; in the EU, your national DPA; in the UK, the Information Commissioner's Office.

To exercise any of these rights, write to hello@thehimalayan.guru with "Privacy request" in the subject. We respond within thirty days.

Cookies and analytics

We do not use advertising cookies. We use a privacy-respecting analytics service (Plausible) that records aggregated page views, referrer domains, and country-level location without setting any cookies and without storing any personal identifier. You may opt out by enabling your browser's "Do Not Track" or by blocking plausible.io at the network level.

Functional cookies and localStorage entries we set: accessibility preferences (contrast mode + text-size), language selection, and the form-draft cache so a half-written inquiry survives a page refresh. None are shared with third parties.

International transfers

Data is processed in India and (for site infrastructure) in the European Union. Transfers to non-EU jurisdictions, where they occur, are protected by Standard Contractual Clauses approved by the European Commission.

Changes to this notice

We will update this page when our practice changes — and we'll record the "last reviewed" date at the top. Material changes are emailed to every active inquiry contact at least thirty days before they take effect.