Privacy Policy

Bhutan ShangriLaSteps
Operated by Diamond Bhutan Travel
Thimphu, Bhutan

Last Updated: September 1, 2026
Effective Date: September 1, 2026

1. Introduction

Bhutan ShangriLaSteps (“we,” “us,” “our,” “the Company”) is the exclusive experiential travel brand of Diamond Bhutan Travel, a fully licensed tour operator by the Royal Government of Bhutan (License No. 1053333).

This Privacy Policy describes how we collect, use, store, share, and protect your personal information when you:

Visit our website at bhutanshangrilasteps.com (the “Site”)
Submit an enquiry, custom itinerary planner request, or group departure booking
Communicate with our team via email, WhatsApp, phone, or in person
Travel with us or use any of our destination management services

By accessing our Site or using our services, you acknowledge that you have read, understood, and agreed to the practices described in this Privacy Policy. If you do not agree, please do not use our Site or services.

2. Who We Are (Data Controller)

The data controller responsible for your personal information is:

Diamond Bhutan Travel (operating as Bhutan ShangriLaSteps)
Registered Tour Operator — Royal Government of Bhutan
DoT License: #1053333
Head Office: Thimphu, Bhutan

Privacy Contact:
📧 office@diamondbhutan.com
📧 info@bhutanshangrilasteps.com

3. Information We Collect

3.1 Information You Provide Directly

Identity & Travel Data

Full legal name (as shown on passport)
Passport number, issuing country, issue date, and expiry date
Nationality and country of residence
Date of birth, gender (where required by Bhutanese immigration)
Travel dates, group size, and destination preferences
Dietary requirements, medical needs, and accessibility requirements
Emergency contact details

Contact Data

Email address
Phone number and WhatsApp number
Postal address
Preferred language of communication

Booking & Enquiry Data

Custom itinerary planner submissions (including itinerary JSON data)
Group departure booking details
Special requests, notes, and preferences
Chatbot conversation transcripts
Enquiry form submissions

Payment Data

Bank transfer details (SWIFT confirmations, transaction references)
Card payment tokens from our payment gateway (we do not store full card numbers, CVVs, or PINs)
Billing name and address
Refund bank account details (where applicable)

Documents You Upload

Passport scans or photographs (required for visa and SDF processing)
Travel insurance certificates
Any other documentation required by the Royal Government of Bhutan

3.2 Information Collected Automatically

When you visit our Site, we may automatically collect:

IP address and approximate geographic location
Browser type, version, and language
Device type, operating system, and screen resolution
Pages viewed, time spent, and referring URLs
Cookies and similar tracking identifiers (see Section 10)

3.3 Information from Third Parties

We may receive limited information from:

Payment processors and banks (transaction confirmation only)
Royal Government of Bhutan portals (visa and SDF clearance status)
Travel insurance providers you have authorized
Our website hosting, email, and IT service providers

4. How We Use Your Information

We process your personal data for the following purposes and legal bases:

Purpose	Legal Basis
Processing bookings, itinerary plans, and group departures	Performance of a contract
Arranging visas, SDF clearance, permits, and government registrations	Performance of a contract + Legal obligation
Booking hotels, certified guides, private transport, and cultural activities	Performance of a contract
Responding to enquiries and issuing personalized quotes	Legitimate interest
Processing deposits, payments, and refunds	Performance of a contract
Sending booking confirmations, itineraries, and trip updates	Performance of a contract
Complying with Bhutanese tourism, tax, immigration, and RMA regulations	Legal obligation
Marketing communications (newsletters, offers) — only with your opt-in consent	Consent
Website analytics, security, and service improvement	Legitimate interest
Fraud prevention and dispute resolution	Legitimate interest
Legal defense and regulatory compliance	Legal obligation

We do not sell, rent, trade, or lease your personal information to any third party for marketing purposes.

5. Passport & Sensitive Documents

Because Bhutanese law requires every international visitor to hold a valid passport and be registered under the Sustainable Development Fee (SDF) system, we are legally required to collect and process passport data.

How we protect passport data:

Stored in a private, non-public directory that is inaccessible from the public web
Encrypted filenames generated using secure cryptographic tokens
Accessible only to authorized staff directly involved in visa and SDF processing
Never displayed in admin dashboards to unauthorized personnel
Automatically deleted within 12 months after your trip completion, unless Bhutanese law requires longer retention
Transmitted to the Royal Government of Bhutan only over secure, official channels

You may request earlier deletion at any time by emailing privacy@bhutanshangrilasteps.com (see Section 8).

6. How We Share Your Information

We share your personal data only when strictly necessary:

6.1 Royal Government of Bhutan

Department of Tourism (DoT) — for tour operator compliance
Department of Immigration — for visa issuance
SDF Authority — for Sustainable Development Fee processing
Royal Monetary Authority (RMA) — for banking and forex compliance

This sharing is mandatory by Bhutanese law and cannot be opted out of if you wish to travel to Bhutan.

6.2 In-Country Service Providers

Hotels, resorts, and homestays in Bhutan (name, dates, dietary needs only)
Certified Bhutanese guides and drivers
Transport operators (private SUV, coaster, luxury vehicle providers)
Trekking and cultural activity organizers

We share only the minimum information needed to deliver your confirmed itinerary.

6.3 Payment & Financial Partners

Bank of Bhutan (BoB) — SWIFT wire transfers
RMA-regulated banking channels
Visa / Mastercard payment gateways (for card processing)

These processors receive only the data necessary to complete your transaction.

6.4 Service Providers

Website hosting and email infrastructure providers
IT support and security service providers
All operate under confidentiality agreements.

6.5 Legal Authorities

Bhutanese courts, police, or regulators when legally compelled
Any authority when necessary to protect our legal rights, prevent fraud, or ensure traveler safety

6.6 What We Never Do

We never sell your data
We never share your data with unrelated third-party marketers
We never transfer your data outside Bhutan except to regulated service providers under confidentiality obligations

7. Data Retention

Data Type	Retention Period	Reason
Booking & traveler records	7 years	Bhutanese tax & tourism law
Passport scans & documents	12 months post-trip	Immigration compliance
Enquiry & planner submissions	24 months	Business records
Group departure bookings	7 years	Financial compliance
Website analytics	26 months	Standard analytics period
Marketing consent records	Until withdrawn	Consent tracking
Payment records	7 years	RMA & tax requirements

After the retention period, data is securely deleted or anonymized.

8. Your Rights

Depending on your country of residence (including EU/UK GDPR, US state privacy laws, Canadian PIPEDA, and others), you may have the following rights:

Right of Access — obtain a copy of the personal data we hold about you
Right to Rectification — correct inaccurate or incomplete data
Right to Erasure (“Right to be Forgotten”) — request deletion, subject to legal retention obligations
Right to Restrict Processing — limit how we use your data
Right to Object — object to processing based on legitimate interest
Right to Data Portability — receive your data in a machine-readable format
Right to Withdraw Consent — at any time, for marketing or non-essential processing
Right to Lodge a Complaint — with your local data protection authority

To exercise any of these rights, email us at:
📧 privacy@bhutanshangrilasteps.com

We will respond within 30 days. For requests involving passport documents or government filings, we may need to coordinate with Bhutanese authorities — we will keep you informed of progress.

9. International Data Transfers

Our Site is operated from Bhutan. If you access our Site from outside Bhutan, your personal data will be transferred to and processed in Bhutan, where data protection laws may differ from your home country.

Where required, we implement safeguards such as:

Confidentiality agreements with all service providers
Encryption in transit (HTTPS/TLS)
Restricted access to sensitive documents
Contractual obligations mirroring GDPR standards where applicable

By using our Site and services, you consent to this transfer and processing.

10. Cookies & Tracking Technologies

Our Site uses the following types of cookies:

Essential Cookies

Session management
Form submissions (enquiry, planner, booking)
CSRF and security tokens
These cannot be disabled without breaking the Site.

Analytics Cookies

Anonymous traffic analysis (e.g., Google Analytics)
Page views, session duration, device type
Used solely to improve Site performance.

Functional Cookies

Language preferences
Chatbot state
Custom planner progress (temporary)

You can control cookies via your browser settings. Disabling analytics or functional cookies will not prevent you from using the Site but may reduce functionality.

11. Security Measures

We take data security seriously and implement:

HTTPS encryption across all Site traffic
Private, non-public storage for passport and sensitive documents
Role-based access controls for internal staff
Cryptographically random filenames for uploaded documents
Regulated banking channels (RMA-compliant SWIFT, Bank of Bhutan)
Secure payment gateways (PCI-DSS compliant)
Regular security reviews of our WordPress environment
Confidentiality agreements with all staff and partners

No online transmission or storage system is 100% secure. If you suspect a breach affecting your data, contact us immediately at privacy@bhutanshangrilasteps.com.

12. Children’s Privacy

Our services are designed for adult travelers. We do not knowingly collect personal data from children under 13 without verifiable parental consent.

For family bookings, children’s information (name, age, passport details) is provided by the parent or legal guardian, who is responsible for ensuring accuracy and granting consent.

If you believe we have inadvertently collected data from a child under 13, contact us immediately and we will delete it.

13. Marketing Communications

We will only send you marketing emails (newsletters, seasonal offers, travel inspiration) if you have:

Explicitly opted in via our Site
Submitted an enquiry with marketing consent ticked
Subscribed to our newsletter

You can unsubscribe at any time by:

Clicking “Unsubscribe” in any marketing email
Emailing privacy@bhutanshangrilasteps.com

Transactional emails (booking confirmations, itineraries, payment receipts) cannot be opted out of while you have an active booking.

14. Third-Party Links

Our Site may contain links to third-party websites (e.g., government portals, hotel partners, review platforms). We are not responsible for their privacy practices. We recommend reviewing their policies before submitting personal data.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in:

Bhutanese law or regulations
Our services or data practices
Industry best practices

The “Last Updated” date at the top indicates the most recent revision. Material changes will be highlighted on our homepage or communicated by email if you have an active booking.

Continued use of our Site after changes constitutes acceptance of the updated policy.

16. Contact Us

For all privacy-related questions, data requests, or concerns:

Bhutan ShangriLaSteps
Operated by Diamond Bhutan Travel
Thimphu, Bhutan

📧 Email (General): info@bhutanshangrilasteps.com
📧 Email (Corporate): office@diamondbhutan.com
💬 WhatsApp: Chat on WhatsApp
🌐 Website: bhutanshangrilasteps.com

Licenses:

DoT License: #1053333

For Bhutanese data protection matters, you may also contact:
Department of Tourism, Royal Government of Bhutan
Thimphu, Bhutan

17. Governing Law

This Privacy Policy is governed by the laws of the Kingdom of Bhutan, including:

The Information, Communications and Media Act 2018
The Tourism Act of Bhutan
The Rules on Sustainable Development Fee
Applicable regulations of the Royal Monetary Authority

Any disputes will be resolved under the jurisdiction of Bhutanese courts.

End of Privacy Policy