Privacy Policy — TrekYatra
TrekYatra Privacy Policy
TrekYatra collects your name, email, and usage data to operate its platform. We do not sell your data. You have full rights under India's DPDP Act 2023.
Last updated: May 2026. This policy explains what personal data TrekYatra collects, how we use it, and your rights under applicable Indian privacy law (the Digital Personal Data Protection Act 2023, or DPDP Act).
1. What Personal Data Does TrekYatra Collect?
We collect only what is necessary to provide and improve our services:
- Account data: email address, full name, and display name when you register
- Usage data: pages visited and search queries (aggregated and anonymised)
- Saved content: bookmarks and trek alerts linked to your account
- Payment data: handled entirely by Razorpay or Stripe — we never store card details or bank information
- Newsletter: email address if you subscribe to the Trail Letter
- Enquiry data: name, email, phone, and trek interest when you contact an operator through our platform
- Trip planning data: trek preferences (region, duration, budget) when you use the Plan My Trek tool
2. How Does TrekYatra Use Your Personal Data?
We use the data we collect for the following purposes only:
- To provide and improve TrekYatra's content, features, and personalised recommendations
- To send the Trail Letter newsletter — only if you opted in; unsubscribe any time
- To route trek enquiries to the appropriate operators on your behalf
- To send transactional emails: purchase receipts, password reset links
- To personalise trek recommendations based on your bookmarks and profile preferences
- To process and deliver digital product purchases
3. What Does TrekYatra Not Do With Your Data?
We maintain clear limits on how your data is used:
- We do not sell your personal data to any third party
- We do not share your data with operators beyond what you explicitly submit in an enquiry form
- We do not use your data for automated profiling that produces legal or similarly significant effects
- We do not store payment card data — all payments are processed by PCI-compliant third parties
4. Does TrekYatra Use Cookies?
Yes, in limited ways:
- Session cookies: used for authentication only (HttpOnly, Secure flags set)
- Google Analytics: used for aggregated traffic analytics — no personally identifiable information is shared
You can disable cookies in your browser settings, but doing so will prevent you from remaining logged in to your TrekYatra account.
5. How Long Does TrekYatra Retain Your Data?
We retain data only for as long as necessary:
| Data type | Retention period |
|---|---|
| Account data | While active + 90 days after deletion |
| Enquiry data | 24 months |
| Payment records | 7 years (as required by Indian tax law) |
6. What Are Your Privacy Rights Under the DPDP Act 2023?
Under the Digital Personal Data Protection Act 2023, you have the right to:
- Access your personal data held by TrekYatra
- Correct inaccurate or incomplete data
- Erase your data from our systems
- Withdraw consent for processing at any time
To exercise any of these rights, write to [email protected]. We respond within 30 days.
7. How Does TrekYatra Keep Your Data Secure?
We apply technical safeguards across our platform:
- Passwords are hashed using PBKDF2-SHA256
- All data in transit is encrypted using TLS 1.2 or higher
- Production database access is restricted to authenticated application instances only
8. Frequently Asked Questions About TrekYatra's Privacy Policy
Does TrekYatra sell my personal data?
No. TrekYatra does not sell your personal data to any third party under any circumstances.
What data does TrekYatra collect when I register?
When you register, TrekYatra collects your full name, display name, and email address. No payment card details are stored by TrekYatra.
Is TrekYatra compliant with India's DPDP Act 2023?
Yes. TrekYatra processes personal data in accordance with the Digital Personal Data Protection Act 2023. You can exercise your rights (access, correction, erasure, withdrawal of consent) by emailing [email protected].
Does TrekYatra share my enquiry details with trek operators?
Only the information you explicitly submit in an enquiry form is shared with the relevant operator. No additional profile data is shared without your knowledge.
How do I delete my TrekYatra account and data?
Email [email protected] to request account deletion. Account data is retained for 90 days after deletion, then permanently removed. We respond within 30 days.
Does TrekYatra store my payment card details?
No. All payments are processed by Razorpay or Stripe. TrekYatra never stores card numbers or bank information. Both processors are PCI-compliant.
How does TrekYatra use cookies?
TrekYatra uses session cookies for authentication (HttpOnly, Secure) and Google Analytics for aggregated, anonymised traffic data. No personally identifiable data is passed to Google Analytics.
How long does TrekYatra keep my personal data?
Account data is kept while your account is active and for 90 days after deletion. Enquiry data is retained for 24 months. Payment records are kept for 7 years as required by Indian tax law.
9. Contact TrekYatra's Privacy Team
For any privacy-related queries, requests, or complaints:
Email: [email protected]
Address: TrekYatra, Gurgaon, Haryana, India
We aim to respond to all privacy requests within 30 days.