Privacy Policy

1. Data Controller

The controller of your personal data is Real India Expeditions ("we"), which operates guided motorcycle expeditions and motorcycle rentals across India and Nepal for international riders.

• Legal name: Real India Expeditions
• Tax ID / RUT: 77.892.410-5 (Incorporation in progress)
• Website: realindiaexpeditions.com
• Privacy contact: info@realindiaexpeditions.com
• Data Protection Officer (DPO): reachable at the same address, subject line "Data Protection".

2. Personal Data We Process

• Identity & contact: full name, email address, phone/WhatsApp number, nationality, and country of residence.
• Travel & riding documents: passport number and expiry, nationality, driving licence number, and International Driving Permit (IDP).
• Health & emergency data: allergies, pre-existing conditions, medication, and special requirements, plus your emergency contact’s name and phone number.
• Transactional data: bookings, amounts, and references/identifiers from the payment gateways (Payku/Webpay for Chile, Razorpay for India). We never store full card numbers or CVV codes.
• Technical & usage data: IP address, user agent, access and error logs, and aggregated navigation events.
• Consent records: what you accepted, against which version of the text, when, and from which IP (stored as a hash).

3. Purpose and Legal Basis

Each processing activity rests on a specific legal basis, as required by article 12 of Law 21.719:

• Performance of the expedition and rental contract (bookings, itineraries, payments, invoicing).
• Compliance with legal obligations: issuance of government and military border permits (Ladakh, Sikkim) and tax obligations.
• Explicit consent for the processing of sensitive health data (see section 4).
• Vital interests: coordination of medical assistance, rescue, or evacuation in an emergency during the expedition.
• Legitimate interest: platform security, fraud prevention, and aggregated, non-identifying analytics.

4. Sensitive Data and Explicit Consent

Your health data (allergies, pre-existing conditions, medication) and identity-document numbers are sensitive personal data. We process them only with your explicit consent, given through a separate, unbundled checkbox when you book, and solely to obtain mandatory permits, verify your riding eligibility, and coordinate high-altitude medical assistance.

You may withdraw this consent at any time from the "Privacy & My Data" section of your profile. Withdrawing it immediately deletes your medical notes and your passport and licence numbers. Note that without this data we cannot obtain border permits or guarantee your medical safety, so we may be unable to operate your expedition.

5. Data Retention

• Sensitive data (passport, licence, medical notes): automatically deleted 24 months after your last completed expedition, unless an incident, claim, or dispute is open.
• Account and contact data: while your account remains active and for up to 12 months after your last activity.
• Invoicing and payment records: retained for the applicable tax periods even if you request erasure of your account.
• Consent records: retained as evidence of the consent given, for the duration of the contractual relationship.

6. Recipients and International Transfers

To operate the platform we use service providers that process data on our behalf. Some are located outside Chile, which constitutes an international data transfer:

• Vercel Inc. (United States) — website hosting and file storage.
• Neon Inc. (United States) — PostgreSQL database holding your profile, including sensitive data.
• Sentry (United States) — error monitoring, only when configured.
• Payku / Transbank y Razorpay — payment processing, under their own PCI-DSS certifications.
• Indian and Nepalese authorities — only the data required to issue border permits.

By accepting this policy you consent to the transfers described. We contractually require each provider to process data only on our instructions and with appropriate security measures.

7. Your Rights

Law 21.719 grants you the following rights over your personal data:

• Access: know what data we process and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure (cancellation): request deletion of your data when it is no longer necessary.
• Objection: object to processing based on legitimate interest.
• Portability: receive your data in a structured, commonly used format.
• Not to be subject to automated decisions: we do not make decisions with significant effects on you on an exclusively automated basis.

You can exercise access and portability immediately using the "Download my data" button in your profile, and the rest from the "Privacy & My Data" section. We will respond within 30 calendar days of your request, extendable once for justified reasons. If you are not satisfied, you may lodge a complaint with Chile’s Agencia de Protección de Datos Personales.

8. Security

We use scrypt password hashing with individual salts, SHA-256 hashed session tokens at rest, enforced HTTPS with HSTS, role-based access control, rate limiting, and automatic masking of passport and licence numbers in staff-facing views.

If a security breach affects your personal data, we will notify the Agencia de Protección de Datos Personales without undue delay and, where it poses a high risk, we will also inform you directly.

9. Cookies and Analytics

We use one strictly necessary cookie to keep you signed in; it does not require consent. Our navigation analytics is first-party, aggregated, and uses no third-party cookies or advertising profiling. If we introduce non-essential cookies in future, we will ask for your prior consent through a dedicated notice.

10. Minors

Our services are intended exclusively for people aged 18 or over, as a driving licence and physical fitness are required for high-altitude expeditions. We do not knowingly collect data from minors.

11. Changes to This Policy

If we make a substantial change to this policy we will notify you by email and, where required, ask you to accept it again. The current version is identified by the date shown at the top of this document.

12. Contact Us

For any question about this policy or to exercise your rights, contact us at:

Real India Expeditions
Email: info@realindiaexpeditions.com
Website: realindiaexpeditions.com
Supervisory authority: Agencia de Protección de Datos Personales (Chile)