Privacy Policy

1. Who We Are

Trekking Tour Sapa ("we", "us", "our") is a locally-operated travel company managed by Black H'mong guides based in Sapa, Lao Cai, Vietnam. We offer cultural and nature-based trekking experiences, homestays, and transportation services in the Sapa and Muong Hoa Valley region.

• Website: https://trekkingtoursapa.com
• Address: 105 Thach Son Street, Sapa, Lao Cai, Vietnam
• Business License: 5300817754
• Operator License: 10-078/2023/CDLQGVN-GP LHQT

This Privacy Policy explains what personal data we collect, how we use it, and the rights you have regarding your data when you use our website or book our services.

2. Personal Data We Collect

Information You Provide Directly

When you make a booking, submit a contact form, or communicate with us, we may collect:

• First and last name
• Email address
• Phone number / WhatsApp number
• Physical address (for billing or pickup purposes)
• Travel dates, group size, and tour preferences
• Payment information (processed securely via PayPal — we never store card details)
• Any additional information you voluntarily share in messages

Usage Data (Automatically Collected)

When you visit our website, we automatically collect certain technical data including:

• Device IP address
• Browser type and version
• Pages visited and time spent on each page
• Referring URL (the page you came from)
• Device type, operating system, and screen resolution
• Date and time of visit

Comments & User-Submitted Content

If you leave a comment on our website, we collect the data shown in the comments form, as well as your IP address and browser user agent string, to help with spam detection. Comments may be sent to an automated spam-detection service.

Commenters may opt in to save their name, email address, and website in cookies for convenience. These cookies last one year.

Media Uploads

If you upload images to our website (e.g., via a contact or review form), please be aware that uploaded images may contain embedded location data (EXIF GPS coordinates). Visitors can extract this information from images on the website. We recommend removing geolocation data from images before uploading if you wish to keep your location private.

3. Tracking Technologies & Cookies

We use cookies and similar tracking technologies to improve your experience on our website. Cookies are small text files stored on your device.

You may refuse cookies through your browser settings, however some parts of our website may not function correctly if you do so.

Web Beacons

Our website may use web beacons (also called clear GIFs or pixel tags) — small electronic files used to measure user engagement and gather site statistics such as page counts and email open rates.

Page-exit counter

To learn which pages visitors leave on, our pages send one short message to our own server when you close or leave a page, and one when you move on from one page of ours to another. The message contains only the page address (without anything after a "?"). It never contains your IP address, a cookie, or any ID, nothing is stored on your device for it, and it is not combined with any other data. It is added to a daily total for that page, which we use only for statistics about our own website. We delete these totals after 400 days. Checkout and the pages after payment are not part of it. If your browser sends Do Not Track or Global Privacy Control, nothing is sent.

OpenAI ad pixel (our ads in ChatGPT)

We advertise our tours in ChatGPT through OpenAI Ads. To see whether those ads bring visitors to our website, we use OpenAI's ad pixel. It is on by default: it starts when a page of ours loads, and you can turn it off below at any time.

On each page you open, your browser loads a script from OpenAI (bzrcdn.openai.com). It sends OpenAI the address of the page, the page you came from, technical details of your browser and device, and your IP address (every request to a server carries it), and it may keep an identifier in your browser. On the thank-you page after payment it also tells OpenAI that a booking was made, without your name, e-mail, phone or the amount. Our pages never hand your name, e-mail address or phone number to the pixel. But OpenAI's pixel has its own feature, "automatic advanced matching", which is on for our pixel and which we cannot switch off: it can detect the e-mail address and phone number you type in a form on our pages (for example when you book, send a booking request or contact us), turn them in your browser into a one-way code (an SHA-256 hash) and send that code to OpenAI, never the plain text. OpenAI may link this to your ChatGPT account, if you have one, to measure the results of our ads, and handles that data under its own privacy policy.

The pixel runs on every page of ours, including the checkout, contact, booking-request, transport-booking and gear-rental pages where you type your contact details. Do Not Track does not switch it off. It never runs when your browser sends Global Privacy Control, or after you turn it off below.

If you turn it off, your choice is stored in this browser and every page of ours respects it, from the next page you open. "Turn it on" undoes that.

Embedded Content from Third Parties

Pages on our website may include embedded content from other websites (e.g., YouTube videos, Google Maps). Embedded content from other sites behaves as if you had visited those sites directly. These third-party websites may collect data about you, use cookies, embed additional tracking, and monitor your interaction with that content. They operate under their own privacy policies, not ours.

4. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

• To provide and manage our services — process bookings, issue vouchers, coordinate guides and transport
• To communicate with you — send booking confirmations, pre-trip information, and respond to enquiries via email, phone, or WhatsApp
• To fulfil contractual obligations — process payments, issue refunds in accordance with our cancellation policy
• To send updates and offers — with your consent, we may send promotional emails about new tours, special offers, or travel tips. You can unsubscribe at any time.
• To improve our services — analyse usage patterns, identify common questions, and improve our website and tour offerings
• For legal compliance — retain records required by Vietnamese tax and business regulations
• For fraud prevention and security — detect, prevent, and address technical issues or fraudulent activity

5. Sharing Your Personal Data

We do not sell your personal data. We may share it in the following limited circumstances:

• Service Providers: Third-party vendors who assist us in operating our website or conducting our business — such as email services, payment processors (PayPal, OnePay), and analytics providers. These parties are contractually obligated to keep your information confidential.
• Business Partners: Where you have booked a tour involving a partner supplier (e.g., a specific homestay family or bus operator), we share the minimum necessary information (name, date, group size) to fulfil your booking.
• Legal Requirements: We may disclose your information if required to do so by law, court order, or in response to a valid request by public authorities in Vietnam or your home country.
• Business Transfers: In the event of a merger, acquisition, or sale of all or part of our business assets, your personal data may be transferred. We will provide advance notice before your data becomes subject to a different privacy policy.
• With Your Consent: We may share your information with any third party for any purpose with your explicit consent.

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and reporting requirements.

• Booking data — retained for 5 years after your travel date for accounting and tax compliance purposes.
• Communications (WhatsApp, email) — retained for up to 3 years.
• Comments and reviews — retained indefinitely unless you request deletion.
• Usage/analytics data — retained for up to 26 months in aggregated, anonymised form.
• Page-exit counter totals — daily totals per page, with no personal data, deleted after 400 days.

7. International Data Transfers

Your information may be processed and stored outside your country of residence, including in Vietnam and in countries where our service providers operate (e.g., the United States for PayPal, Google Analytics). These countries may have different data protection laws than your home country.

By using our services and submitting your data, you consent to this transfer, processing, and storage. We take all reasonably necessary steps to ensure your data is treated securely and in accordance with this policy.

8. Your Rights

Depending on your country of residence, you may have the following rights regarding your personal data:

• Right to access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data (subject to legal retention requirements)
• Right to restrict processing — request that we limit how we use your data
• Right to data portability — request your data in a machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may ask you to verify your identity before processing the request.

Managing Your Account Data

If you have created an account on our website, you can update or export your profile data at any time from the My Bookings section. To request full account deletion, contact us directly.

Unsubscribing from Marketing Emails

Every marketing email we send includes an unsubscribe link. You can also contact us directly to be removed from our mailing list at any time.

9. Children's Privacy

Our services are not directed at individuals under the age of 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately and we will take steps to delete that information.

10. Security

We implement commercially reasonable technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, alteration, or disclosure. These include HTTPS encryption on all web communications, secure payment processing via third-party certified gateways (we never store card numbers), and restricted internal access to personal data.

However, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security and encourage you to use strong, unique passwords for any accounts.

11. Third-Party Links

Our website may contain links to external websites — including Google Maps, TripAdvisor, Airbnb, and social media platforms. These sites are not operated by us and have their own privacy policies. We are not responsible for the content or privacy practices of any third-party website. We encourage you to review the privacy policy of any external site you visit.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you by email.

Your continued use of our services after the effective date of the revised policy constitutes your acceptance of the changes. We encourage you to review this page periodically.

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or want to report a privacy concern, please contact us: