Privacy Policy

Last updated: 13 August 2026

Who controls your data

The controller of personal data collected through this website is Rang-e-Rah, registered at [address], tax ID [NIP], company number [REGON] (“Rang-e-Rah”, “we”).

For anything concerning your personal data, write to hello@rangerah.com.

What we collect

We only collect what you type into one of the three forms on this site. Nothing is gathered in the background.

Enquiry form (expedition pages and “Ask”)

• your name,
• email address,
• phone number (optional),
• the expedition and departure date you are interested in,
• your message.

Registration form (“Apply”)

• the expedition and departure date,
• for each participant: name, email, phone and date of birth,
• number of participants and any notes,
• your data-processing consent (required) and marketing consent (optional).

Trip planner (“Plan your trip”)

• the places, travel style, difficulty, length and preferred month you choose,
• group size, budget and priorities,
• your description of the trip you have in mind,
• your name, email and phone.

What we do not collect: we do not store IP addresses or browser information, we use no analytics or tracking pixels, and we do not profile you or make automated decisions about you.

Why we use it, and on what legal basis

• Answering your enquiry and preparing a quoteArt. 6(1)(b) GDPR (steps taken at your request before entering a contract).
• Organising and running the trip (bookings, transport, insurance, visa paperwork), Art. 6(1)(b) GDPR (performance of a contract).
• Accounting and tax obligationsArt. 6(1)(c) GDPR.
• Marketing messages, if you tick that box, Art. 6(1)(a) GDPR (consent), which you can withdraw at any time.
• Defending against claimsArt. 6(1)(f) GDPR (our legitimate interest).

How long we keep it

• Enquiries that do not lead to a booking: [e.g. 12 months].
• Participant records for trips that ran: for as long as tax and accounting law requires (generally 5 years from the end of the accounting year).
• Data held on marketing consent: until you withdraw that consent.

Who we share it with

We do not sell your data. We pass it only to those needed to run your trip:

• our local partners in Pakistan: guides, hotels and transport operators, only as far as bookings require,
• airlines (the internal Skardu – Islamabad flight),
• the insurer, where insurance is included in the trip price,
• the hosting provider whose servers run this site,
• public authorities, where the law requires it.

Transfers outside the European Economic Area. Running the trip means sending some data (name, date of birth, and passport details supplied separately) to our partners in Pakistan, outside the EEA. We do this under Art. 49(1)(b) GDPR, as it is necessary to perform the contract with you.

Cookies and third parties

This site sets no analytics or marketing cookies. The only cookie (RANGERAH_ADMIN) is a technical session cookie for the admin panel, set only for staff who log in.

The site loads Google Fonts. Typefaces are fetched from Google’s servers, which means your IP address is transmitted to Google LLC.

The WhatsApp, Instagram and Facebook buttons are ordinary links. Nothing loads from those services unless you click them.

Your rights

You have the right to access your data, correct it, have it erased, restrict how we process it, receive it in a portable format, object to processing, and withdraw consent at any time (which does not affect processing carried out before you withdrew it).

To exercise any of these, write to hello@rangerah.com. We reply within one month.

You may also complain to the Polish data protection authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

Security

Form submissions travel over an encrypted connection and are stored on our server. Only authorised staff can reach the admin panel, and only after logging in with a password.

Children

The forms on this site are not intended for anyone under 16. Details of minors travelling with us are provided by a parent or legal guardian.

Changes to this policy

We may update this policy. The current version always lives on this page, and the date it last changed is shown at the top.