No dark patterns
Privacy policy
This is an illustrative policy for a demonstration build. Have it reviewed against Nepal's data protection requirements — and the GDPR, if you market to the EU or UK — before publishing it.
What we collect, and why
When you send an enquiry we collect your name, email address, phone number and whatever you tell us about the trip. We need these to reply to you and to build a quotation; there is no other purpose.
When you confirm a booking we additionally collect passport details, date of birth, nationality, emergency contact details, insurance policy information and any medical or dietary information you choose to share. Permits, internal flight tickets and hotel registrations in Nepal legally require most of this.
We do not require an account to browse this site, and we do not collect payment card details on it.
What we do not do
We do not sell personal data. We do not share it with advertising networks or data brokers. We do not add you to a mailing list because you made an enquiry — if you want the newsletter you have to ask for it.
Medical information you give us is seen only by the planner handling your trip and, where it is relevant to your safety, by your guide. It is not stored in any general-purpose customer record.
Who we share it with
Only the parties who need it to deliver your trip: Nepal's Department of Tourism and the relevant conservation area or national park authority for permits, airlines for ticketing, hotels and teahouses for registration, and the overseas ground handler on an international itinerary. In each case we share the minimum required.
Where a supplier is outside Nepal, your data travels with the booking. We contract with our overseas handlers to use it only for your trip.
How long we keep it
Enquiries that do not become bookings are deleted after 24 months. Booking records are kept for seven years, which is what Nepali tax and company law requires, and then deleted.
Passport scans are deleted within 30 days of your return, as soon as permit reconciliation is complete. We do not archive them.
Cookies and analytics
This site sets no advertising or tracking cookies. Your currency preference is stored in your browser's local storage so the site remembers it; that value never leaves your device and we cannot read it.
If analytics are enabled on this domain they are configured without cross-site tracking and with IP addresses truncated before storage.
Your rights
Write to care@highpassholidays.com to ask for a copy of what we hold, to correct it, or to have it deleted. We respond within 30 days. Deletion requests during an active booking are honoured for everything that is not legally required to deliver or account for the trip.
If you are not satisfied with how we have handled a request, say so in writing and it will be reviewed by a director rather than by the person who answered you first.
Last reviewed 1 August 2026. Data controller: HighPass Holidays Pvt. Ltd., Basuki Marg, New Baneshowr, Kathmandu, Nepal. Contact care@highpassholidays.com.