Privacy Policy

This policy explains what we do with your personal information when you enquire with us or book a package. We keep it deliberately short and specific, because a policy you cannot read is no use to you.

1. Who We Are

Gulmarg Snowline, Forest Block, Gulmarg, Jammu and Kashmir 193402, India.
For any privacy question, contact info@gulmargsnowline.com.

We are the data controller for the information described here.

2. What We Collect

When you send an enquiry we collect your name, phone number, WhatsApp number, email address, the package you're interested in, and anything you write in the additional requirements field.

Where relevant to your safety on the mountain, we may collect information about medical conditions or injuries you disclose. This is sensitive information and we only use it to plan your instruction safely.

If you book, we also hold your travel dates, the details of the people in your booking, and a record of payments made to us. We do not collect or store your card or bank details — payment is made by direct transfer, and the transaction record sits with your bank, not with us.

We may also hold photographs or video of you taken during sessions, as described in section 13 of our Terms & Conditions.

This website uses Google Analytics 4 to understand how people find and use the site. It records things like the pages you visit, roughly how long you stay, the type of device and browser you use, the approximate location your visit came from (city level, derived from your IP address and not stored by us), and the site or search that referred you.

Google Analytics uses cookies and an anonymous identifier to recognise a returning browser. We use it in aggregate — to see which packages people look at and where visitors come from. We do not use it to identify you personally, and we do not link it to your enquiry.

3. Why We Collect It

To respond to your enquiry, to deliver the package you book, to plan safely around your ability and health, and to keep records we are legally required to keep.

4. Legal Basis

Where the UK GDPR or EU GDPR applies to you, these are the legal bases we rely on:

• To answer your enquiry — our legitimate interest in responding to someone who has contacted us about our services.
• To deliver a booking — performance of our contract with you.
• Health and medical information — your explicit consent, which you give by choosing to tell us. You can withdraw it at any time, though we may then be unable to run your sessions safely.
• Photographs used in our marketing — your consent, which you can withdraw at any time.
• Keeping financial and booking records — compliance with our legal obligations under Indian tax and accounting law.
• Website analytics — our legitimate interest in understanding how the site is used so we can improve it. If you are in the EEA or UK, analytics cookies require your consent, and you can refuse or remove them as described in section 9.

5. Who We Share It With

We do not sell your data, and we do not share it for anyone else's marketing.

We share the minimum necessary with:

• Web3forms — delivers the enquiry form on this website to our inbox.
• Our email provider — stores the messages you send us.
• Cloudflare — hosts this website and serves it to your browser.
• Google Analytics — measures how the site is used, as described in sections 2 and 9.
• Hotels and transport providers — only where you have asked us to arrange accommodation or transfers, and only the details they need, such as a name and arrival date.
• Our instructors and guides — the ability and health information relevant to keeping you safe on the mountain.

We may also disclose information where the law requires it.

6. International Transfers

The business operates from India. If you contact us from the EU or UK, your data leaves the EEA.

India has not been granted an adequacy decision by the European Commission or the UK Government. Where we transfer your data to ourselves in India, we rely on Article 49(1)(b) of the GDPR — the transfer is necessary to perform the contract you have asked us to enter into, or to take steps at your request before entering it. Our service providers named above operate their own transfer safeguards, typically standard contractual clauses.

7. How Long We Keep It

• Enquiries that do not become bookings — 12 months, then deleted.
• Booking and payment records — 8 years from the end of the relevant financial year, to meet Indian tax and accounting requirements.
• Health and medical information — deleted within 3 months of your package ending, unless it relates to an incident we are required to keep a record of.
• Photographs used in marketing — until you ask us to stop using them, or until they are no longer in use.
• Google Analytics data — retained for 14 months, then deleted automatically by Google.

8. Your Rights

You have the right to access, correct, delete or export your data, to object to processing, and to complain to a supervisory authority. Contact info@gulmargsnowline.com to exercise any of these.

We will respond within 30 days. We do not charge for this. If you are in the UK or EU and are unhappy with our response, you can complain to your national data protection authority — in the UK, the Information Commissioner's Office at ico.org.uk.

9. Cookies

This website uses Google Analytics 4, which sets cookies in your browser to measure how the site is used. These are the _ga and _ga_<container> cookies, which last up to two years and hold a randomly generated identifier for your browser, not your name.

We set no advertising cookies, run no remarketing, and do not sell or share this data with advertisers.

You can refuse or delete these cookies in your browser settings at any time, or install Google's Analytics opt-out browser add-on. The site works exactly the same either way.

Apart from analytics, your browser only contacts another service when you submit the enquiry form, which goes to Web3forms for delivery to our inbox, or when you choose to open WhatsApp from one of our links.

10. Security

This website is served over HTTPS, so anything you send through the enquiry form is encrypted in transit.

Access to enquiries and booking records is limited to the people at Gulmarg Snowline who need it, on password-protected accounts. Health information is shared only with the instructor working with you.

No system is perfectly secure. If a breach affects your data and puts you at risk, we will tell you and the relevant authority without undue delay.

11. Children

Our packages are open to participants aged 8 and over. We do not knowingly collect information directly from children.

Where a participant is under 18, we expect the booking and any health information to be provided by a parent or guardian, who is also the person we will contact about the booking.

If you believe a child has sent us personal information directly, contact info@gulmargsnowline.com and we will delete it.

12. Changes to This Policy

If we change this policy we will update the "last updated" date at the top of this page, and the current version will always be published here.

If a change materially affects how we use information you have already given us, we will contact you directly rather than relying on you to notice.