Privacy policy
How we collect, use, and protect your data.
Plain-language notice for bookings, accounts, letters of invitation, and wanderingyaks.com — what we hold, why we hold it, and how to get a copy or ask for deletion.
- We never sell your data
- Stripe handles payments
- Export or delete on request
Version 1.2 · Effective · Cookie policy
What this policy covers
This privacy policy explains how Wandering Yaks collects, uses, shares, and protects personal information when you use wanderingyaks.com, book a journey, create an account, request a Pakistan letter of invitation, or contact our team in Gilgit and Hunza, Gilgit-Baltistan. Version 1.2 is effective from .
1. About this policy
We take data protection seriously. Please read this notice so you understand how we use personal information you provide — or that we receive — when you use our services, and the steps we take to safeguard it.
We may update this policy to reflect legal requirements or how we operate. Check back periodically. If we make significant changes, we will seek to inform you by notice on the website or, where appropriate, by email.
This is our principal external privacy notice for customers, enquirers, suppliers, and website visitors. It applies to information collected on wanderingyaks.com and related online flows we operate (accounts, booking, letter of invitation, contact forms).
2. Who we are
References to Wandering Yaks, “we”, “our”, and “us” mean the operating entity behind wanderingyaks.com — a host-led travel operator based in Gilgit-Baltistan, Pakistan. Our full legal name and registered address appear on your booking invoice.
For applicable data-protection laws, the Wandering Yaks entity that contracts with you (or operates the website service you use) is the primary controller of your personal information.
Privacy questions and rights requests: contact@wanderingyaks.com.
3. What information we collect
Depending on how you interact with us, we typically collect the following.
Enquiries and trip bookings
Full name, email, phone, date of birth, dietary needs, medical notes relevant to the journey, emergency contact, travel insurance details, and traveler details required to operate the trip (including passport name as shown on the document).
Passport and visa-support data
Passport number, nationality, expiry, and passport-page scans when needed for permits, NoCs, or a Pakistan letter of invitation. These fields are treated as sensitive travel documents and encrypted at rest with restricted staff access.
Account data
Name, email, phone, and authentication credentials (password hashes or sign-in via providers such as Google / magic link). Dashboard history for bookings and LOI downloads.
Financial information
Payments are handled by Stripe (PCI DSS compliant). We receive tokens and receipt references — not full card numbers. Do not email card details to us.
Website usage and marketing
Technical data such as IP address (country-level location), browser type, pages viewed, and referrer — for security and, if you consent, analytics. Newsletter sign-ups collect name and email. We do not run Google Ads remarketing or Google signals in analytics.
Personal information of others
If you book for a group, name an emergency contact, or request LOIs for other travelers, you must tell those people what you are sharing and that this policy applies. We may collect the same categories about them from you as booking contact.
4. Why we collect your information
We use personal information to:
- Provide travel products and services — administer bookings, permits, insurance checks, and customer communications before, during, and after a trip.
- Issue Pakistan letters of invitation and deliver PDFs by email and dashboard download.
- Operate your account and respond to enquiries or complaints.
- Improve the website and services (aggregate analytics only when you accept analytics cookies).
- Meet legal obligations (tax, permit reporting, lawful requests).
- Send marketing emails only where allowed — you can opt out at any time. We keep marketing volume low.
Where data-protection laws require a legal basis, we typically rely on: performance of a contract (bookings and LOI fulfilment); legitimate interests (service improvement, fraud prevention, essential communications) balanced against your rights; legal obligation; vital interests in a medical emergency; and consent (marketing and optional analytics, and sensitive health information where required).
Providing personal information is voluntary, but we may be unable to complete a booking, permit, or LOI if required details are missing.
5. How we collect your information
Information may come to us when you:
- Fill in online forms, create an account, check out a booking, or buy an LOI.
- Email, call, WhatsApp, or message us via on-site chat widgets.
- Are named on a booking or LOI by another traveler, or listed as an emergency contact.
- Browse our website (device and usage data; analytics only with consent).
We may also receive information from payment providers, insurance or medical partners in an emergency, and government or permit authorities when required to operate your journey.
7. Selling data
We do not and will not sell your personal information under any circumstances.
8. Cross-border transfers and storage
Our primary database is hosted with Supabase in a region appropriate to our operations (typically Singapore or Frankfurt — confirmed on booking materials). Data is encrypted at rest by the provider. Backups are retained on a nightly schedule with limited retention.
Because we work with travelers and suppliers internationally, personal information may be processed in Pakistan and in countries where our hosting or payment providers operate. Where transfer rules apply (for example EU/UK GDPR), we take steps to provide appropriate safeguards or rely on a permitted derogation.
Questions about where a specific booking’s data is processed: email contact@wanderingyaks.com.
9. Your rights
Subject to applicable law and certain exemptions, you can ask us to:
- Provide a copy of the personal information we hold about you (data export).
- Correct inaccurate or incomplete information.
- Delete personal information, subject to statutory retention (for example tax records for seven years).
- Stop or limit certain processing, including opting out of marketing.
- Withdraw consent where processing relies on consent.
- Where applicable, request portability of data you provided in a commonly used format.
Email contact@wanderingyaks.com. We may ask for information to verify your identity. We aim to respond within 30 days, usually sooner. If we cannot fulfil a request, we will explain why.
You may also complain to your local data-protection authority. We ask that you contact us first so we can try to resolve the concern.
10. Retention
We keep personal information only as long as needed for the purposes we collected it — including bookings, LOI fulfilment, customer support, and legal, tax, or accounting requirements. We may retain records longer where reasonably necessary for complaints, disputes, or litigation. When retention ends, we delete or anonymise data where practicable.
11. How we keep your information secure
We use physical, technical, and organisational measures to reduce the risk of loss, misuse, unauthorised access, modification, or disclosure — including encryption at rest for sensitive passport fields, role-based staff access, and secure payment handling via Stripe.
No method of transmission over the internet is completely secure. Please take care when sharing personal information online. If a personal-data breach occurs that we are legally required to notify, we will inform you and any applicable regulator as required.
13. Third-party links and widgets
Our site may link to third-party websites or include widgets (for example chat or social features). We do not control those services and are not responsible for their privacy policies. Read their notices before sharing personal information with them.
Related Wandering Yaks documents: Booking conditions · Cookies.
Common questions
Short answers for travelers, search engines, and answer engines researching Wandering Yaks data practices.
- Does Wandering Yaks sell personal data?
- No. Wandering Yaks does not sell personal information under any circumstances. We share data only as needed to fulfil bookings, issue permits or letters of invitation, process payments via Stripe, run the website, or meet legal obligations.
- What passport data does Wandering Yaks store?
- For trip permits and Pakistan letter-of-invitation services we may collect passport number, nationality, expiry date, and a passport-page scan. Passport fields are encrypted at rest. Access is limited to staff roles that handle permits or LOI fulfilment.
- How do I request a copy or deletion of my data?
- Email contact@wanderingyaks.com with your request. We verify identity, then provide an export, correct inaccurate details, or delete data subject to statutory retention (for example tax records kept for seven years). We aim to respond within 30 days.
- Who processes Wandering Yaks payments?
- Card payments are processed by Stripe. Wandering Yaks receives a token and receipt reference — we never store full card numbers on our systems.
- Does Wandering Yaks use advertising cookies?
- No advertising cookies. Essential cookies keep you signed in. Optional Google Analytics 4 cookies run only if you accept analytics. See the cookie policy for details and how to change your choice.
Contact us about privacy
Questions about this policy, a data export, a correction, or a deletion request — email our team in Gilgit and Hunza. We treat privacy matters seriously and aim to respond within 30 days.
Related: Booking conditions · Accessibility