Privacy Policy

1. Introduction

Eightfold Travel Pty Ltd, trading as Eightfold ("we", "us", "our"), is committed to protecting the privacy of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at eightfold.travel, use our mobile application, or book tours and services through our platform.

We are based in Sydney, Australia, and operate in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where applicable, we also comply with the EU General Data Protection Regulation (GDPR) and the New Zealand Privacy Act 2020.

2. Information We Collect

We collect the following categories of personal information:

2.1 Information You Provide

• Account information: Name, email address, phone number, date of birth, nationality, and passport details when required for tour bookings.
• Booking information: Tour preferences, travel dates, dietary requirements, medical conditions relevant to trekking, emergency contact details, and travel insurance policy details.
• Payment information: Credit card and billing details are processed securely through our payment processor, Stripe. We do not store your full credit card number on our servers.
• Communications: Messages, enquiries, and feedback you send to us through our contact forms, email, or phone.
• Fitness and health data: Information you provide through our fitness assessment and medical questionnaire to ensure trip suitability and safety.

2.2 Information Collected Automatically

• Device and usage data: IP address, browser type, operating system, referring URLs, pages visited, time spent on pages, and click patterns.
• Cookies and similar technologies: We use cookies, local storage, and similar technologies to enhance your experience. See Section 5 for details.
• Location data: Approximate location based on your IP address, used to provide relevant pricing and content.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Providing services: Processing bookings, arranging tours, communicating travel details, and providing customer support.
• Safety and compliance: Assessing fitness levels for trek suitability, sharing necessary health information with guides, arranging travel permits with Nepali authorities, and fulfilling insurance requirements.
• Payment processing: Processing payments in AUD through Stripe, managing refunds, and maintaining financial records as required by Australian law.
• Communication: Sending booking confirmations, pre-departure information, trip updates, and responding to your enquiries.
• Improvement and analytics: Analysing usage patterns to improve our website, services, and tour offerings.
• Marketing: Sending newsletters, tour recommendations, and promotional material where you have opted in. You can unsubscribe at any time.
• Legal obligations: Complying with applicable laws, regulations, and legal processes.

4. Sharing Your Information

We may share your personal information with the following third parties:

• Payment processor: Stripe processes all payments on our behalf. Stripe's privacy policy is available at stripe.com/privacy.
• Local partners in Nepal: Licensed trekking guides, lodge operators, and transport providers receive only the information necessary to deliver your tour (name, nationality, dietary requirements, relevant medical information).
• Government authorities: Nepal Immigration, the Nepal Tourism Board, and national park authorities as required for trekking permits and visa processing.
• Insurance providers: In the event of an emergency or claim, relevant medical and personal information may be shared with your travel insurance provider.
• Analytics providers: We use privacy-focused analytics tools to understand how visitors use our website.
• Legal requirements: We may disclose information where required by law, court order, or government regulation.

We do not sell your personal information to third parties.

5. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to provide and improve our services. The types of cookies we use include:

• Essential cookies: Required for the website to function properly, including authentication, session management, and security. These cannot be disabled.
• Functional cookies: Remember your preferences such as language, currency, and recently viewed tours.
• Analytics cookies: Help us understand how visitors interact with our website, which pages are most popular, and where users experience issues.
• Marketing cookies: Used to deliver relevant advertisements and track the effectiveness of our marketing campaigns. These are only set with your consent.

You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of our website.

6. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including:

• Account data: Retained for as long as your account is active, plus 2 years after closure.
• Booking records: Retained for 7 years after the completion of your tour, as required by Australian tax law.
• Medical and fitness data: Retained for the duration of your booking plus 12 months, then securely deleted.
• Marketing preferences: Retained until you withdraw consent or close your account.
• Website analytics: Aggregated analytics data is retained indefinitely. Individual user session data is retained for 26 months.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Portability: Request a machine-readable copy of your data.
• Restriction: Request that we restrict processing of your information in certain circumstances.
• Objection: Object to processing of your information for direct marketing purposes.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including:

• SSL/TLS encryption for all data in transit
• Encryption at rest for sensitive data stored in our databases
• Regular security audits and vulnerability assessments
• Access controls limiting employee access to personal data on a need-to-know basis
• PCI-DSS compliant payment processing through Stripe

While we take reasonable steps to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9. International Data Transfers

As an Australian company operating tours in Nepal, your personal information may be transferred to and processed in Nepal and other countries where our service providers operate. When we transfer data internationally, we ensure appropriate safeguards are in place, including contractual protections with our partners and compliance with the APPs regarding cross-border disclosure.

10. Children's Privacy

Our services are not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will take steps to delete such information. Minors aged 16-17 may book tours with verified parental or guardian consent.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on our website and, where appropriate, by sending you an email notification. The "Last updated" date at the top of this page indicates when the policy was last revised. Your continued use of our services after any changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.