1. Introduction & Commitment

Simsime Travels & Tours Pvt. Ltd. ("Simsime", "we", "our", or "us"), registered under the laws of Nepal and officially accredited by the Nepal Association of Tour & Travel Agents (NATTA Member ID: 778/19), is dedicated to protecting the privacy, security, and personal integrity of our travelers, website visitors, and authorized editorial users.

This Privacy Policy governs our practices concerning data collection, transmission, processing, storage, and retention across our primary public web properties (simsimetravels.com) and our administrative editorial management systems.

2. Information We Collect

We collect only information essential to providing reliable travel coordination, ticketing, and secure editorial administration:

Travel Inquiries & Booking Information: Full name, email address, contact phone/WhatsApp number, nationality, travel destinations, desired departure dates, group size, and specific expedition preferences submitted via our concierge inquiry forms.
Ticketing & Regulatory Documentation: When issuing flight tickets or securing mandatory Himalayan trekking permits (TIMS, National Park permits), we securely receive passenger passport biodata, date of birth, emergency contact details, and travel insurance credentials as mandated by civil aviation and tourism authorities of Nepal.
Technical & Log Data: IP addresses, request timestamps, user-agent details, and rate-limiting counters to safeguard against automated brute-force attacks, spam submissions, and Denial of Service (DoS) attempts.

3. Google OAuth 2.0 / OIDC Limited Use Disclosure

Simsime Travels & Tours implements Google OAuth 2.0 / OpenID Connect (OIDC) exclusively as a secure, zero-password authentication mechanism for our private blog publishing dashboard.

Strict Compliance with Google API Services User Data Policy: Simsime's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Requested Scopes: We request only standard profile scopes (openid, email, profile).
Scope Purpose: These credentials are strictly utilized to verify whether an authenticated identity matches our server-side whitelist of authorized editorial staff (prem.simsime@gmail.com and joshishabdikraj@gmail.com).
Zero Data Selling: We do NOT sell, rent, monetize, or transfer Google user data to third parties, advertising exchanges, or data brokers under any circumstances.
Zero Surveillance: We do NOT access personal Gmail inboxes, Google Drive files, search history, contact lists, or non-identity Google services.

4. How We Use Collected Information

All collected data is utilized exclusively for legitimate business and travel fulfillment purposes:

Facilitating international and domestic flight reservations directly with accredited airline Global Distribution Systems (GDS).
Organizing bespoke mountain treks, heritage excursions, and vehicle logistics with verified mountain guides and hospitality partners.
Transmitting booking confirmations, itineraries, schedule advisories, and emergency weather contingency notices.
Enforcing server-side rate limits (1 inquiry per 45s, 3 login attempts per device freeze window) to protect infrastructure security.

5. Information Sharing & Third-Party Disclosures

We strictly limit disclosure of client information. Data is shared exclusively with:

Airlines & Aviation Authorities: Direct passenger manifest data required for ticketing (e.g. Buddha Air, Yeti Airlines, Qatar Airways, Nepal Airlines).
Governmental Tourism Regulators: Nepal Tourism Board (NTB) and Trekkers' Information Management System (TIMS) counters as strictly required by Nepali law.
Emergency Rescue Coordinators: In high-altitude emergencies, medical biodata and insurance policies are provided directly to helicopter rescue and emergency medical teams.

6. Data Security & Storage Protocols

We implement defense-in-depth security standards consistent with OWASP recommendations:

All transmissions are protected via 256-bit Transport Layer Security (TLS/HTTPS).
Database operations use parameterized PDO prepared statements to completely eliminate SQL injection vectors.
Administrative sessions are secured with cryptographically generated HTTP-only, SameSite cookies.
Sensitive credentials, database secrets, and OAuth keys reside strictly in server-side configuration environments.

7. Data Retention & Traveler Rights

Travelers retain full rights to request access to, correction of, or permanent deletion of their personal contact records following completion of their travel arrangements, subject to mandatory accounting and taxation compliance requirements under the laws of Nepal.

To request data deletion or inquire about your stored travel records, please reach out directly to our Data Protection Liaison at info@simsimetravels.com.

8. Contact & Legal Inquiries

Simsime Travels & Tours Pvt. Ltd.
Naagpokhari, Naxal, Ward No. 1, Kathmandu, Nepal
Official NATTA Membership ID: 778/19
Managing Director: Mr. Suraj Shahi | Direct Inquiries: Prem Kumar Danuwar
Telephone: +977 9851202359 / +977 9742506555
Email: info@simsimetravels.com