Privacy Policy | Kunlun Outdoors

Last updated: July 9, 2026 | Effective: July 9, 2026

1. Information We Collect GDPR Art. 13

1.1 Information You Provide Directly

We collect personal data that you voluntarily provide when interacting with our services:

Data Category	Specific Data Points	Collection Method
Booking Information	Full name, date of birth, nationality, passport number & scan, visa details, emergency contact name & phone	Booking form, email
Medical & Health Data	Medical conditions, allergies, medications, fitness level, dietary requirements relevant to trekking safety	Medical declaration form, booking form
Contact Details	Email address, phone number, mailing address	Booking form, contact form, account registration
Payment Information	Processed securely via third-party payment providers (PayPal, Stripe). We do not store full credit card numbers on our servers	Payment checkout
Travel Insurance	Insurer name, policy number, 24-hour emergency assistance number	Pre-departure form
Communication	Messages, inquiries, feedback submitted through contact forms or email	Contact form, email
Account Data	Username, hashed password, profile photo, booking history, saved preferences	Account registration

1.2 Information Collected Automatically

Data Type	Details	Legal Basis
Technical Data	IP address, browser type & version, operating system, device type & identifiers	Legitimate interest (security, service delivery)
Usage Data	Pages visited, time spent, referral URL, click patterns, search queries	Consent (analytics), Legitimate interest (service improvement)
Location Data	General location based on IP address (not precise GPS)	Legitimate interest (currency display, content localization)
Cookie Data	See Section 5 — Cookie Policy	Varies by category (see below)

2. How We Use Your Data GDPR Art. 6

We process your personal data for the following purposes, each with a clear legal basis under GDPR and PIPL:

Purpose	Data Used	Legal Basis (GDPR)	Legal Basis (PIPL)
Booking fulfillment	Name, passport, contact, medical, payment	Contract performance (Art. 6(1)(b))	Necessary for performance of contract (Art. 13)
Safety & emergency response	Medical data, emergency contacts, insurance	Vital interests (Art. 6(1)(d))	Necessary for life/health (Art. 13)
Legal & regulatory compliance	Booking records, payment records, passport copies	Legal obligation (Art. 6(1)(c))	Legal obligation (Art. 13)
Website analytics & improvement	Technical data, usage data	Legitimate interest (Art. 6(1)(f))	Legitimate interest (Art. 13)
Marketing communications	Email, name, trek preferences	Consent (Art. 6(1)(a))	Consent (Art. 13)
Fraud prevention & security	Technical data, payment verification	Legitimate interest (Art. 6(1)(f))	Legitimate interest (Art. 13)

Sensitive Data — Explicit Consent Required: We process health and medical data (necessary for your safety on high-altitude treks) only with your explicit, positive consent. You may withdraw this consent at any time, though doing so may affect our ability to safely accommodate your participation.

3. Data Storage & Security

3.1 Data Retention Periods

Data Type	Retention Period	Justification
Booking & travel records	7 years after trip completion	Legal/tax requirements under PRC law
Passport & visa copies	Duration of trip + 1 year	Regulatory compliance, dispute resolution
Medical declarations	Duration of trip + 2 years	Safety liability period
Account data	Duration of account + 2 years after deletion request	Legal compliance period
Marketing preferences	Until consent is withdrawn	Consent-based processing
Analytics data	26 months	Google Analytics default retention
Support communications	3 years after last contact	Customer service quality
Payment records	7 years	Financial regulatory compliance

3.2 Security Measures

Encryption: All data in transit is encrypted using TLS 1.2+; sensitive data at rest is encrypted using AES-256
Access controls: Role-based access with multi-factor authentication for administrative systems
PCI DSS compliance: All payment processing meets Payment Card Industry Data Security Standards through our certified payment providers
Infrastructure: Hosted on Tencent Cloud with DDoS protection, web application firewall, and automated security patching
Incident response: Documented data breach notification procedure compliant with GDPR 72-hour reporting requirement

4. Third-Party Services Disclosure

We share limited personal data with trusted third-party service providers who process data on our behalf or independently for their own purposes. Each third party operates under their own privacy policy.

4.1 Payment Processing

Provider	Data Shared	Privacy Policy
PayPal	Payment amount, name, email, billing address, card details (processed on PayPal's servers only)	PayPal Privacy Policy
Stripe	Payment amount, card token, billing details (we never see or store your full card number)	Stripe Privacy Policy

4.2 Analytics & Performance

Provider	Data Shared	Privacy Policy
Google Analytics	Anonymized IP, pages visited, session duration, device/browser info (IP masking enabled; data used for aggregate analytics only)	Google Privacy Policy

4.3 Cloud Infrastructure

Provider	Data Stored	Privacy Policy
Tencent Cloud	Website application data, booking records, uploaded documents (hosted on servers in Hong Kong)	Tencent Cloud Privacy Policy

Our Commitment: We require all third-party processors to maintain adequate data protection standards. No third party is authorized to use your personal data for purposes beyond those we have specified.

5. Cookie Policy GDPR Art. 6(1)(a)

We use cookies and similar tracking technologies to operate and improve our website. Below is a detailed breakdown:

Category	Purpose	Examples	Duration	Legal Basis
Strictly Necessary	Essential website functionality	Session management, security tokens, currency preference, cookie consent state	Session / 30 days	Legitimate interest
Analytics	Website performance monitoring	Google Analytics (_ga, _gid, _gat)	Up to 2 years	Consent
Functional	Enhanced functionality & personalization	Currency switcher, language preference, recently viewed treks	30 days	Consent
Marketing	Relevant advertising & retargeting	Facebook Pixel, Google Ads conversion tracking	Up to 1 year	Consent

Managing Your Cookie Preferences

Cookie banner: On your first visit, our cookie consent banner allows you to accept or decline non-essential cookies
Browser settings: You can configure your browser to block or alert you about cookies; some features may not function properly
Google Analytics opt-out: Install the Google Analytics Opt-out Browser Add-on

6. Your Rights GDPR Art. 15–22

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

Right	GDPR Article	Description
Right of Access	Art. 15	Request a copy of all personal data we hold about you
Right to Rectification	Art. 16	Request correction of inaccurate or incomplete personal data
Right to Erasure	Art. 17	Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations
Right to Restrict Processing	Art. 18	Request limitation of how we process your data in certain circumstances
Right to Data Portability	Art. 20	Request your data in a structured, machine-readable format for transfer to another service
Right to Object	Art. 21	Object to processing based on legitimate interests or for direct marketing purposes
Right to Withdraw Consent	Art. 7(3)	Withdraw consent at any time without affecting the lawfulness of prior processing
Right Not to Be Subject to Automated Decision-Making	Art. 22	Not be subject to decisions based solely on automated processing that produce legal effects

How to Exercise Your Rights

Email: kunlun@kl-outdoors.com
Response time: We will respond to all requests within 30 days (or 60 days for complex requests, as permitted under GDPR)
Verification: We may request proof of identity to protect against unauthorized access
No fee: Requests are free of charge, except for manifestly unfounded or excessive requests

Supervisory Authority: If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority in the EU/EEA member state of your habitual residence, workplace, or the place of the alleged infringement.

7. PIPL Compliance China PIPL

In addition to GDPR compliance, we adhere to the Personal Information Protection Law of the People's Republic of China (PIPL, effective November 1, 2021) for all processing of personal information of individuals within the PRC.

7.1 Data Localization

Personal information collected from users within China is stored on servers located in Hong Kong SAR, China (Tencent Cloud). We do not transfer PRC users' personal information overseas without completing the required security assessments or entering into standard contract clauses as required by the Cyberspace Administration of China (CAC).

7.2 Cross-Border Transfer Safeguards

Security assessment: For transfers exceeding CAC thresholds, we complete the mandatory security assessment
Standard Contract Clauses (SCCs): We use CAC-approved standard contract clauses for cross-border personal information transfers
Consent: Where required, we obtain separate informed consent for cross-border transfers (PIPL Art. 39)

7.3 Additional Rights Under PIPL

Right	PIPL Article	Details
Right to be informed	Art. 44	Know the name, contact, and purpose of the personal information handler
Right to restrict/refuse	Art. 44	Refuse processing that goes beyond the agreed scope
Right to explanation	Art. 48	Request explanation of automated decision-making rules affecting your rights
Right to deletion	Art. 47	Request deletion when processing purpose is achieved, consent withdrawn, or processing violates law

7.4 Delegated Processing & Joint Processing

We maintain a register of all third-party processors acting as our delegated personal information handlers under PIPL. This register includes the processing purpose, data categories, retention periods, and security measures. A summary is available upon request.

8. International Data Transfers GDPR Art. 46

As a trekking company based in China serving international clients, some data processing occurs outside the European Economic Area (EEA). We ensure appropriate safeguards for all international transfers:

8.1 Transfer Mechanisms

Standard Contractual Clauses (SCCs): We use EU-approved SCCs for transfers of EEA residents' data to China
Explicit consent: In limited circumstances where SCCs are not applicable, we obtain your explicit, informed consent for the specific transfer
Adequacy decisions: Where the European Commission has recognized a country as providing adequate data protection, transfers may proceed without additional safeguards

8.2 Transfer Impact Assessments

For each cross-border transfer, we conduct a Transfer Impact Assessment (TIA) to evaluate the legal framework of the destination country and ensure that the level of protection of your personal data is not undermined.

Primary Data Locations: Booking data and personal information are primarily processed and stored on Tencent Cloud servers in Hong Kong SAR. Payment data is processed by PayPal (Singapore/US) and Stripe (US/Ireland) under their respective data processing agreements.

9. Children's Privacy

Our trekking and adventure travel services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children under 18 without verifiable parental or guardian consent.

Minors aged 16–17 may participate in certain treks only with the written consent of a parent or legal guardian, who must also accompany the booking
If you believe a child under 18 has provided us with personal data without consent, please contact us immediately at kunlun@kl-outdoors.com and we will take steps to delete such information
Under PIPL, the personal information of minors under 14 is classified as sensitive personal information requiring guardian consent and a dedicated processing rule

10. Policy Updates

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. When we do:

Material changes: We will notify you via a prominent notice on our website and/or by email at least 14 days before the changes take effect
Minor changes: Updated "Last updated" date at the top of this page reflects the most recent revision
Consent requirements: If a change requires new consent, we will ask for your agreement before continuing processing under the updated terms
Version history: Previous versions are available upon request

AI Use Disclosure: Kunlun Outdoors does not use artificial intelligence to make solely automated decisions that have legal or similarly significant effects on individuals without appropriate human oversight. Any AI-assisted tools (e.g., chat support, content personalization) operate under human supervision and do not determine your eligibility, pricing, or legal rights.

Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or need to report a data protection concern:

Kunlun Outdoors
Email: kunlun@kl-outdoors.com
Website: kl-outdoors.com
Address: Kunming, Yunnan, China

For EU/EEA residents: You also have the right to lodge a complaint with your local data protection authority under GDPR.