Privacy Policy
How we collect, store and use your personal data — and how to exercise your rights under UK GDPR.
Registered in England & Wales · Company No. [TO BE CONFIRMED ON LEGAL TRANSFER]
Data Controller: Charlie Knights · hello@catreks.com · +44 (0) XXXX XXX XXX
Who We Are
Community Action Treks Ltd, trading as CAT Himalaya, is a UK-registered adventure travel company offering guided Himalayan trekking and mountaineering holidays in Nepal. We are the data controller for all personal data collected through our website, booking process and communications.
Our designated contact for data protection matters is Charlie Knights, reachable at hello@catreks.com. If you have any questions about how we handle your data, please contact us.
We are committed to protecting your privacy and handling your data in an open and transparent way. We operate under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
What Data We Collect
We collect personal data that is necessary to deliver our services, process bookings and communicate with you. This includes:
- Identity and contact data: name, email address, telephone number, postal address, date of birth
- Booking and travel data: passport details, booking history, trip preferences, departure details, next of kin or emergency contact information
- Health and dietary data: dietary requirements, food allergies, medical conditions, reduced mobility needs, or other health information relevant to safe participation in your trip. This is special category data under UK GDPR and is processed only with your explicit consent or where necessary to protect your vital interests
- Payment data: payment details processed securely through our payment gateway. We do not store full card details once a transaction is complete
- Communications data: records of your correspondence with us including emails, enquiry form submissions and telephone call notes
- Marketing preferences: your preferences for receiving marketing communications from us
- Website usage data: IP address, browser type, pages visited and time on site, collected via cookies. See our Cookies section below
Lawful Basis for Processing
Under UK GDPR we must identify a lawful basis for processing your personal data. The table below sets out the purposes for which we process your data and the legal basis for each.
| Purpose | Lawful basis |
|---|---|
| Processing your booking and delivering trip services | Performance of a contract (Article 6(1)(b) UK GDPR) |
| Processing health, dietary and medical information | Explicit consent (Article 9(2)(a)) and/or protection of vital interests (Article 9(2)(c)) |
| Sending marketing emails to existing customers | Legitimate interests (Article 6(1)(f)) — soft opt-in under PECR, with opt-out on every communication |
| Sending marketing emails to new subscribers | Consent (Article 6(1)(a)) — explicit opt-in required |
| Responding to enquiries and providing quotes | Pre-contractual steps at your request (Article 6(1)(b)) |
| Sharing data with Nepal trip suppliers | Performance of a contract (Article 6(1)(b)) |
| Legal and accounting obligations | Legal obligation (Article 6(1)(c)) |
| Improving our services and website | Legitimate interests (Article 6(1)(f)) |
Who We Share Your Data With
We will never sell your personal data or share it with third parties for their own marketing purposes. We share your data only where necessary to deliver your trip or comply with legal obligations.
- Nepal trip suppliers: our ground operation partner in Kathmandu (Bhai B. Tamang and team), tea houses and lodges, domestic transport providers, Nepal Mountaineering Association (for peak permits), national park and conservation area fee bodies. These suppliers receive only the data necessary to deliver your trip
- Email marketing platform: we use Klaviyo to send booking-related communications and, where you have opted in, marketing emails. Your name and email address are stored within Klaviyo. You can unsubscribe at any time via the link in any email
- Website and forms: our website is hosted on Squarespace. Enquiry and booking forms are processed via Formspree. Both handle data in accordance with UK GDPR
- Payment processors: payment data is processed securely through our payment gateway. We do not store full card details
- Legal and regulatory authorities: we may share data with public authorities or regulators where required by law
- Professional advisors: accountants and legal advisors, where necessary for the conduct of our business
International Data Transfers
In order to deliver your trip to Nepal, we will share your personal data with suppliers in Nepal — a country outside the United Kingdom. Nepal does not currently have a UK adequacy decision. We take appropriate steps to protect your data in such transfers, including using standard contractual clauses where applicable.
By making a booking or requesting a quote, you acknowledge that your data will be shared with suppliers in Nepal as necessary to fulfil your arrangements. The data shared with our Nepal team is limited to what is strictly necessary: your name, dietary requirements, any relevant health information, and trip logistics.
Marketing Communications
We send marketing communications — including trip news, new destinations, departure availability and inspiration — by email. Your choices are always respected.
Existing customers: if you have booked with us previously, we may contact you by email about future trips and services that may interest you. This is permitted under the Privacy and Electronic Communications Regulations (PECR) soft opt-in rules. You can unsubscribe at any time via the link in any email.
New subscribers: if you sign up to our newsletter via our website, we will only send you marketing communications with your explicit consent. You can withdraw consent and unsubscribe at any time.
We will never share your email address with third parties for their own marketing purposes.
Cookies
Our website uses cookies — small text files stored on your device — to help us understand how visitors use our site and to improve your experience. We use cookies provided by Squarespace (our website platform) and, where analytics are enabled, standard analytics tools.
You can control or disable cookies through your browser settings. Please note that disabling cookies may affect the functionality of certain parts of our website.
We do not use cookies for advertising or tracking purposes beyond our own website analytics.
How Long We Keep Your Data
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting or reporting requirements.
- Booking and financial records: retained for 7 years from the date of the trip, in accordance with HMRC requirements
- Guest communications and trip records: retained for 3 years after your last trip with us
- Marketing data: retained until you unsubscribe or withdraw consent, whichever is earlier
- Enquiry data (no booking made): retained for 12 months from the date of the enquiry, then deleted
- Health and dietary data: deleted within 30 days of the completion of your trip
Your Rights
Under UK GDPR you have the following rights in respect of your personal data:
Request a copy of the personal data we hold about you (a Subject Access Request)
Ask us to correct inaccurate or incomplete data we hold about you
Ask us to delete your data where there is no legitimate reason to continue processing it
Ask us to suspend processing your data in certain circumstances
Request your data in a structured, commonly used format for transfer to another controller
Object to processing based on legitimate interests, including direct marketing
To exercise any of these rights, please contact us at hello@catreks.com. We will respond within 30 days. If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.
Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated “Last updated” date. We recommend reviewing this policy periodically. For significant changes, we will notify existing customers by email.
Questions about this policy should be directed to: hello@catreks.com