Privacy Policy

1. Data Controller & Scope

Nepal Travel Guide (accessible at nepalfortourist.com) operates as an independent digital travel guide. For the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679 - "GDPR") and the UK Data Protection Act, the data controller is:

Please note: Nepal Travel Guide is an independent travel portal and is not the governmental Nepal Tourism Board (NTB) or Department of Immigration.

2. Information We Collect

We minimize data collection to what is strictly necessary to deliver high-quality, reliable travel advice. Depending on how you interact with our portal, we collect:

• Technical & Device Information: Automatically collected HTTP access logs, including anonymized IP address (with the final octet masked), browser vendor and version, operating system, referring URL, date and timestamp of access.
• Preferences Stored Locally: User preferences saved client-side on your device (in localStorage), such as your chosen language locale, dual currency selection (USD vs. NPR), and cookie consent status. This data remains on your browser and is not uploaded to our servers.
• Direct Communications: When you submit questions via our Help Center or subscribe to our newsletter, we collect your name, email address, planned travel dates, and inquiry message.
• Aggregated Anonymous Analytics: Aggregate statistics regarding page views, time spent on trekking routes, and interactive map usage.

3. Legal Bases for Processing (GDPR Article 6)

We only process your personal data when we have a legitimate legal ground under GDPR Article 6(1):

4. How We Use Collected Data

Your personal data is used solely for the following clear purposes:

• Delivering fast, localized guide content tailored to your language and region.
• Answering traveler questions submitted through our Support & Help Center desk.
• Detecting and mitigating automated spam, malicious bot traffic, and fraudulent requests.
• Analyzing aggregated trends (such as peak trekking seasons) to optimize our itinerary guides.
• We never sell, rent, or trade your personal information to third-party data brokers or commercial advertisers.

5. Cookies & Local Storage

We use cookies and HTML5 local storage to enhance your browsing experience. Detailed descriptions of all cookies, storage categories, and lifespans are available in our dedicated Cookie Policy.

You can inspect or update your cookie categories at any time using our interactive settings modal:

6. Third-Party Service Providers & Sub-processors

To provide high availability and fast content delivery, we partner with reputable cloud infrastructure providers who adhere to rigorous security standards (ISO 27001, SOC 2) and GDPR data processing agreements:

• Cloud Hosting & Edge CDN: Vercel Inc. and Cloudflare, ensuring DDoS mitigation and low-latency global delivery.
• Mapping Services: Leaflet and OpenStreetMap contributors for interactive hiking map tiles.
• Image Optimization: Unsplash and official image CDNs for high-definition photography.

7. International Data Transfers

As an international digital platform, some technical data may be processed on servers located outside the European Economic Area (EEA), such as the United States. In all such cases, we ensure appropriate safeguards are implemented, including standard contractual clauses (SCCs) approved by the European Commission.

8. Data Retention Policies

We do not keep personal data longer than necessary for the purposes for which it was collected:

• Server Access Logs: Automatically rotated and deleted within 30 to 90 days.
• Support Desk Inquiries: Retained for 12 months after resolution to handle follow-up queries, then securely purged.
• Cookie Consent Choices: Stored locally for 12 months, after which you will be prompted again.

9. Your Rights Under GDPR & Global Laws

Under Chapter III of the GDPR and equivalent international statutes, you have extensive legal rights regarding your personal data:

To exercise any of these rights, email us at privacy@nepalfortourist.com. We respond to all verified requests within 30 calendar days at no cost to you.

10. Technical & Organizational Security Measures

We enforce multi-layered defense to safeguard all transmission and storage of data:

• Transport Layer Security (TLS 1.3 / SSL) encryption on all incoming and outgoing connections.
• Strict Content Security Policies (CSP) and HTTP security headers (HSTS, X-Frame-Options, X-Content-Type-Options).
• Principle of least privilege access control to administrative systems.
• Regular automated vulnerability scanning and code audits.