MistyCurves Travel Privacy PolicyPRIVACY.

01 / The Data We Collect

To design your custom itineraries and secure travel logistics, we collect several categories of personal information, categorized below:

• Identity Data: Full names, dates of birth, gender, nationalities, passport numbers, and visa details (crucial for permit issuance and international/national flights).
• Contact Data: Residential addresses, billing addresses, email addresses, phone numbers, and WhatsApp handles.
• Travel & Preference Data: Preferred destinations, travel dates, flight numbers, accommodation choices, guides, and specific feedback on previous journeys.
• Financial Data: Bank account or payment card details. All online transactions are processed securely through PCI-DSS compliant third-party payment gateways; we do not store raw card numbers.
• Technical & Usage Data: IP addresses, browser types, session durations, and user interactions with our website via secure analytics.

02 / Special Category (Sensitive) Data

Unlike standard retail businesses, the nature of bespoke travel—specifically high-altitude expeditions in Spiti/Ladakh or sea activities in Andaman—requires us to collect information that is classified as **Special Category** or **Sensitive Personal Data**. This includes:

• Medical Conditions & Health Data: Information about physical mobility, asthma, heart conditions, or pregnancy, which is vital to verify if a high-altitude trek or adventure activity is safe for you.
• Allergies & Dietary Needs: Details of severe food allergies or medical dietary restrictions, which we share with hotels and kitchens to prevent life-threatening incidents.
• Religious Beliefs: Inferred dietary choices (e.g., requests for Kosher, Halal, or specific vegetarian meals) are only processed to respect and facilitate your choices.

> [!IMPORTANT] > We process sensitive data **only with your explicit consent**. By providing this information in > our inquiry forms or planning chats, you actively authorize MistyCurves to process it to protect > your health and customize your trip. You can withdraw consent at any time, but doing so may > mean we cannot confirm or support aspects of your booking.

03 / Lawful Bases for Processing

We process your data strictly under the following legally defined bases:

• Performance of a Contract: The primary basis for processing your data. Without your identity and contact details, we cannot book hotels, issue permits, or manage logistics.
• Explicit Consent: Required to process sensitive health details or to send you promotional newsletters and travel inspiration guides.
• Legitimate Interests: Necessary for business operations, improving our website, managing relations, and optimizing travel packages.
• Legal Obligation: Necessary to comply with local regulations, taxation audits, and police registrations (such as Foreigner Regional Registration Office requirements in India).

04 / Sharing & Cross-Border Data Transfers

To execute an expedition, your data must flow to third-party operators. We only share the minimum necessary information with:

• Logistics and Accommodation Partners: Hotels, resorts, car rental providers, airlines, and local ground handlers who coordinate your transfers.
• Permit Authorities: Government bodies issuing border clearances or park entry fees (e.g., Inner Line Permits for Kinnaur/Spiti/Nubra Valley).
• Emergency Services: In the event of high-altitude sickness or medical emergencies, we share your health and emergency contact data with hospitals or evacuation teams.

International & Regional Transfers: If your journey crosses national borders or enters remote locations operated by local Destination Management Companies (DMCs), your information will be transferred to those specific countries or regional operators. We ensure these providers operate under strict confidentiality standards.

05 / Data Retention Policy

We retain your personal data only for as long as is necessary to fulfill the purposes we collected it for. By standard travel regulation requirements:

• Booking Records: Identity, travel, and financial records are kept for **7 years** following the completion of your tour to satisfy taxation, financial auditing, and legal claim periods.
• Sensitive Medical Details: Health and dietary data is securely purged from our active files **within 90 days** after your trip concludes, unless you request us to keep it on file for future custom bookings.
• Marketing Preferences: Newsletter data is kept until you unsubscribe or request deletion.

06 / Your Legal Rights

Under international data protection regulations (such as GDPR), you possess clear rights over your data:

• Right of Access & Portability: You can request copies of all personal data we hold about you in a clean, readable format.
• Right to Rectification: You can ask us to update or correct inaccurate details.
• Right to Erasure ("Right to be Forgotten"): You can request that we delete your personal information, subject to our statutory retention requirements (such as tax compliance).
• Right to Object or Restrict: You can object to us processing your data for marketing or analytics.
• Right to Withdraw Consent: Where processing is consent-based (sensitive details or marketing), you can withdraw consent at any time.

07 / Contact & Administration

For any inquiries regarding your data, to execute your rights, or to submit feedback on our data practices, please write to our dedicated Data Protection Officer (DPO):

Attn: Data Protection Officer
Email: mistycurvesholidays@gmail.com
WhatsApp Support: +91 82190 08210
Corporate Address: MistyCurves Travel Studio, Shyam Nagar, Dharamshala, Himachal Pradesh 176215, India