Privacy Policy

English only. This page is available in English only.  ·  Diese Seite ist nur auf Englisch verfügbar.  ·  Esta página está disponible únicamente en inglés.

Language of this Policy

This Policy is drafted in English. The Spanish and German versions of this page are machine translations provided for convenience only. If there is any conflict or difference in meaning between the English text and a translation, the English text governs and prevails.

1. Who Is Responsible for Your Data

The Data Fiduciary under India's DPDP Act, 2023, and the data controller under the GDPR, responsible for your personal information, is Aryan Ladakh Tour & Travel, the registered business entity that owns and operates the Ladakh Bikers brand. Registered address: Karzu Rd, Leh, Ladakh 194101, India. Contact: grievance@ladakhbikers.com

2. Personal Documents Collected for Permits

Due to the strategic border location of Leh Ladakh, visiting areas such as Nubra Valley, Pangong Lake, Hanle, and Umling La requires official military and administrative permit clearance. We collect the following identification documents solely for permit processing:

• Indian Citizens: Aadhaar Card, Voter ID, Passport, or Driving Licence copies.
• Foreign Nationals: Passport bio-data page, Indian Tourist Visa / e-Visa, and port-of-entry immigration stamp images. These are mandatory for Protected Area Permit (PAP) applications submitted to the Leh Deputy Commissioner.

3. How We Use and Share Your Data

Your identification and contact information is used exclusively for the following purposes:

• Official Permit Portals: Uploaded directly to government permit systems (e.g., LAHDC Leh permit portal, Deputy Commissioner Leh office).
• Military Checkpoints: Printed and submitted to verification officers at army and police checkpoints (South Pullu, North Pullu, Tangtse, Loma, Nyoma).
• Tour Logistics: Contact details (phone, WhatsApp, email) are used only for expedition coordination, booking confirmations, and emergency communication during the tour.
• Zero Commercial Sharing: Aryan Ladakh Tour & Travel does not sell, rent, trade, or distribute your personal documents or contact information to any third-party commercial marketing agency, advertiser, or data broker.

4. Document Retention & Deletion Policy

To protect your identity and ensure maximum security, we enforce a strict data retention timeline. All digital copies of your identification documents (passports, visas, Aadhaar, driving licences) are permanently and securely deleted from our servers, email accounts, and messaging platforms within 30 days of the completion of your tour or rental period. Contact information (name, phone, email) may be retained for up to 12 months for warranty, feedback, and service continuity purposes, after which it is also deleted.

5. Payment & Financial Information Security

All credit card, debit card, or international bank transfer transactions are processed through secure, PCI-DSS compliant third-party payment gateways (Razorpay, Wise, or authorised bank SWIFT channels). Aryan Ladakh Tour & Travel (Ladakh Bikers) does not collect, capture, or store your credit card numbers, CVV codes, or bank account credentials on our servers at any point.

6. Website Analytics & Your Choice

Nothing on this list runs until you allow it. When you first visit ladakhbikers.com we ask, and if you decline or simply ignore the banner, none of it starts. You can change your mind at any time using the Cookie Settings link in the footer of every page.

• Microsoft Clarity (only with your consent): Records how pages are used — clicks, scrolling and session replay — so we can find the parts of the site riders get stuck on. It is operated by Microsoft, who act as a processor for us. It is not started before you consent.
• Visit log (only with your consent): When analytics is allowed we store one record per browsing session containing your IP address, the country it resolves to, the currency shown to you, and your browser's user-agent string. We use it to understand which countries our riders come from. An IP address is personal data, which is why it is behind the same consent.
• Visitor counter (always on): A single number that increases by one per session. It is not linked to you, your device or your IP, and it stores nothing about you.
• Essential storage (always on): Your language, the currency prices are shown in, your consent choice itself, and the session marker that stops the counter double-counting one visit. These are needed for the site to function and are not used to profile you.

We do not run advertising or re-targeting pixels, and we do not use Google Analytics, Google Tag Manager or any social-media tracking pixel on this site.

7. Your Rights Under the DPDP Act, 2023

For visitors and riders in India, the Digital Personal Data Protection Act, 2023 applies. Under it we are the Data Fiduciary and you are the Data Principal. You have the following rights, and exercising any of them is free:

• Right to information: To be told what personal data of yours we hold, what we are doing with it, and who we have shared it with.
• Right to correction and completion: To have inaccurate or incomplete data corrected or completed — which matters most for permit paperwork, where a wrong passport number gets an application rejected.
• Right to erasure: To have your data deleted once the purpose it was collected for is served, or when you withdraw consent, unless we are required by law to keep it.
• Right to withdraw consent: To withdraw at any time, as easily as you gave it. Withdrawal does not undo processing already carried out lawfully, and it cannot retrieve a permit application already submitted to the authorities.
• Right to grievance redressal: To complain to us first, through the officer named in section 8, before approaching the Data Protection Board of India.
• Right to nominate: To nominate another person to exercise these rights on your behalf in the event of your death or incapacity.

Why we are allowed to hold your documents. Your identity documents are processed on the consent you give when you book, for the specific purpose of obtaining permits and running your trip. Where a government body or a checkpoint requires them by law, we process them to comply with that law. We do not use them for anything else, and we do not use them to build a profile of you.

8. Grievance Officer

If you have a complaint about how your personal data has been handled, contact our Grievance Officer. You do not need to give a reason, and there is no charge.

• Name: Thinlas
• Designation: Grievance Officer, Aryan Ladakh Tour & Travel
• Email:grievance@ladakhbikers.com
• Postal address: Karzu Rd, Leh, Ladakh 194101, India

We acknowledge every complaint within 48 hours and aim to resolve it within 30 days. If you are in India and are not satisfied with our response, you may complain to the Data Protection Board of India.

9. If Something Goes Wrong

If personal data we hold is lost or exposed, we will notify the Data Protection Board of India and every affected person, without undue delay, describing what happened, what data was involved, and what you should do about it. We will not wait to be asked.

10. Where Your Data Goes

Your data is stored on Google Firebase infrastructure and, where you have consented to analytics, processed by Microsoft. Both may store data on servers outside India. Your permit documents are submitted to Indian government portals and checkpoints only. We do not transfer personal data to any country the Government of India has restricted for this purpose.

11. International Visitor Rights (GDPR / UK GDPR)

If you are a resident of the European Economic Area (EEA), United Kingdom, or another jurisdiction with comprehensive data protection laws, you hold the following rights regarding your personal data held by Aryan Ladakh Tour & Travel:

• Right of Access: Request a copy of all personal data we hold about you.
• Right to Rectification: Request correction of any inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): Request immediate deletion of your personal data at any time — including before our standard 30-day retention window expires.
• Right to Object: Object to the processing of your personal data for any purpose beyond permit compliance and tour logistics.
• Right to Data Portability: Request that your data be provided to you in a structured, machine-readable format.

To exercise any of these rights, contact us at grievance@ladakhbikers.com. We will respond to all verified requests within 30 days. Note: As an Indian-registered business, our primary regulatory framework is the Digital Personal Data Protection Act, 2023 (DPDPA). We honour EEA/UK GDPR rights as a courtesy to our international clientele.

12. Children's Data

Riding with us requires you to be 18 or older. A pillion passenger may be younger, and a permit application for a minor needs the same identity documents as an adult, so we do sometimes process a child's data.

Under the DPDP Act a child is anyone under 18 — not under 16 as in some other countries. Where a minor is travelling with a group, we collect their documents only for the permit, and only on the verifiable consent of a parent or lawful guardian, which we take from the adult making the booking. We do not use a child's data for analytics, profiling, advertising or any form of behavioural tracking, and we delete it on the same 30-day timetable as everyone else's.

13. Changes to This Policy

Aryan Ladakh Tour & Travel reserves the right to update this Privacy Policy at any time. Material changes will be communicated via our website and, where required, via email to active booking holders. Continued use of our services after the effective date of any revision constitutes acceptance of the updated policy.

14. Contact & Data Safety Requests

For any privacy queries, immediate data deletion requests, or security concerns, contact our data safety coordinator at:
Aryan Ladakh Tour & Travel (Ladakh Bikers)
Karzu Rd, Leh, Ladakh 194101, India
Email: grievance@ladakhbikers.com |  WhatsApp: +91-8491838966