Privacy Policy

Tibet Trails (tibettrails.com) is run by The Tibet Reserve LLC, a limited liability company registered in California, USA. We decide how the personal data described here is used, and we are the people to contact about it: info@tibettrails.com.

This policy explains what we collect, why, who else sees it, and the choices you have. We have tried to keep it short and plain.

• Enquiry form. When you send the form on our Plan My Trip page, we receive your name and email address, plus anything else you choose to give: country, phone number, the trip you are interested in, travel dates, group size and your message. The form also sends some context from your visit: the tour and departure date you picked (if any), the page on this site you came from, the page you first landed on, the website that referred you, any campaign tags in the link you arrived by, and the site language. We use all of this to reply to you and plan your trip.
• Messages you send us. If you email us, message us on WhatsApp or call us, we receive your contact details and what you send, and use them to answer and to plan your trip.
• Booking and permit documents. Once you book, we ask for copies of your passport and Chinese visa, and sometimes other travel details, by email — never through this website. We need them to apply for your Tibet Travel Permit and any other permits your route requires.
• Analytics. Google Analytics 4 tells us which pages are useful and how visitors find us. It uses cookies (see Cookies below). In the EEA, the UK and Switzerland it sets them only if you choose Accept analytics. If you decline, or before you choose, it sets no cookies, but it may still send Google a cookieless signal that a page was viewed (for example the page, time and browser type), which cannot be used to recognize you on a later visit. We also use Vercel Web Analytics and Speed Insights, which count visits and measure loading speed without cookies and show us only aggregated figures.
• Server and security logs. Our host, Vercel, processes technical data when you visit — such as your IP address, browser type and the pages requested — to deliver the site, keep it secure and find errors. If an enquiry cannot be delivered to us, its contents are written to these logs so that we can still recover it.

We do not sell your personal information, and we do not use it for advertising.

Where data protection law asks us to name a legal basis (for example the GDPR in the EEA, or the UK GDPR):

• Your request and our contract. Answering your enquiry, preparing quotes and itineraries, and arranging your booking and permits are steps you have asked us to take, and then part of our contract with you.
• Legitimate interests. Running the website, keeping it secure, fixing problems and understanding overall use through cookieless analytics. Outside the EEA, the UK and Switzerland, this is also our basis for Google Analytics, which you can switch off at any time.
• Consent. Google Analytics cookies in the EEA, the UK and Switzerland, and any marketing email. We only send marketing email to people who have asked for it.
• Legal obligation. Keeping the business, tax and accounting records the law requires.

• Service providers that process data for us: Vercel (website hosting, server logs and cookieless analytics), Google (Google Analytics), Resend (delivers enquiry-form messages to our inbox), HubSpot (keeps enquiries from the form in our customer records) and Microsoft (Microsoft 365, our company email).
• Our ground agency in Tibet. The licensed Tibet travel agency that applies for your Tibet Travel Permit receives the passport, visa and traveler details the application needs, and submits them to the authorities that issue the permit.
• The law. We will disclose information if we are legally required to.

WhatsApp, phone and email links on this site open other apps and services. What you send through them is also handled under those providers' own terms and privacy policies.

We are a US company, and our service providers process data in the United States and other countries. If you are in the EEA, the UK or Switzerland, your data is therefore transferred outside it. Where the law requires it, we rely on the transfer safeguards our providers offer, such as the European Commission's Standard Contractual Clauses.

To get a Tibet Travel Permit, your passport and visa details must go to the licensed agency in China and to the Chinese authorities that issue the permit. Data protection law in China differs from yours. We send only what the permit requires, and only because you have asked us to arrange your trip.

We keep enquiry and booking information for as long as we need it to answer you, plan and run your trip, and deal with anything that follows. We keep it longer only where tax, accounting or other legal rules require us to keep records. Cookies expire as shown in the table below.

Depending on where you live — for example under the GDPR in the EEA, the UK GDPR, Swiss law or California law — you can ask us to:

• give you a copy of your personal data;
• correct it;
• delete it;
• restrict or object to how we use it, or give it to you in a portable format.

Where we rely on your consent, you can withdraw it at any time; this does not affect what happened before. For analytics, use the Cookie settings link at the bottom of every page.

To make a request, email info@tibettrails.com. If you are unhappy with how we handle your data, you can also complain to the data protection authority where you live.

We use a few first-party cookies of our own, and Google Analytics cookies only as described here. We do not use advertising cookies.

In the EEA, the UK and Switzerland, Google Analytics cookies are set only after you choose Accept analytics. Elsewhere they are set unless you choose Decline. You can change your choice at any time with the Cookie settings link at the bottom of every page, and you can also delete or block cookies in your browser.

We also keep a few values in your browser's session storage (not cookies), which are deleted when you close the tab: how you arrived (the referring website, landing page and campaign tags) and the last page you viewed here. They leave your browser only if you send the enquiry form, as described above.

This website is not aimed at children under 16, and we do not knowingly collect personal data from them through it. If you think a child has sent us their details, contact us and we will delete them.

We update this policy when what we do with personal data changes, and change the date at the top of the page when we do. If a change is significant, we will say so clearly on this page.