Privacy policy

Last updated 29 October 2026

Who is responsible

The data fiduciary is Ridge & River Sikkim, Gangtok, Sikkim 737101, India. For any privacy request or grievance, contact our grievance officer on WhatsApp at +91 62958 22358. We acknowledge within 48 hours and resolve within 30 days.

What we collect, and why

• Planner choices (month, places, days, group size, comfort tier) stay in your browser's local storage and in any share link you create. Nothing is sent to us until you submit a quote request or enquiry.
• Quote requests and enquiries: name, WhatsApp number, optional e-mail, travel date, message and your planner choices. We use these only to answer you, prepare the permits and bookings you ask for, and keep the records Sikkim Tourism requires of operators.
• Abuse protection: a one-way salted hash of your IP address (never the address itself) to limit repeat submissions, your browser's user-agent string, and a Cloudflare Turnstile check that tells us a human sent the form.
• Analytics: cookie-less page statistics through Cloudflare Web Analytics. No advertising trackers, no cross-site cookies.

By submitting a form you consent to this use. The forms say so next to the send button. We do not knowingly collect data from children; parents send trip details on their behalf.

How long we keep it

Enquiry and quote records are deleted 12 months after we receive them. Confirmed bookings keep the invoice-related details for the period Indian tax law requires (currently 8 years), nothing more. Planner choices in your browser are yours to clear at any time.

Who processes it

• Cloudflare (hosting, D1 database, KV store, Turnstile bot check, Web Analytics). Data is encrypted at rest and in transit.
• Brevo (e-mail alert to our desk when a lead arrives) and Telegram (instant alert to the desk phone), when enabled.
• WhatsApp when you choose to message us; Meta's own privacy terms apply to that chat.
• Permit applications are shared with the Sikkim Tourism & Civil Aviation Department, the Indian Army and police checkposts as the law requires.

We never sell or rent your details, and we do not send marketing messages unless you have opted in.

Your rights

Under the Digital Personal Data Protection Act, 2023 you may ask what we hold about you, have it corrected or erased, withdraw consent, and nominate someone to exercise these rights for you. Contact the grievance officer above; if unresolved, you may approach the Data Protection Board of India.

Breaches

If a breach affects your data we will inform you and the Data Protection Board as the Act requires, without undue delay.

Security

Lead data is protected by bot checks, rate limits, encrypted storage and a password-protected admin desk used only by our staff. See our terms.