Last updated: March 2026
Kiyul Odyssey (“we”, “us”, “our”) is a licensed tour operator registered in Bhutan. We are committed to protecting the personal information of everyone who enquires about, books, or travels with us. This policy explains what data we collect, how we use it, who we share it with, and what rights you have.
We serve clients from Ireland, the United Kingdom, Singapore, India, and other countries. Where applicable, this policy is designed to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, and other applicable data protection laws.
What data we collect
We collect personal data in the course of providing our services. This includes:
- Full name, date of birth, nationality, and passport details (required for visa processing)
- Contact information: email address, phone number, postal address
- Dietary requirements, medical conditions, and mobility needs (where voluntarily provided for tour planning purposes)
- Payment information: bank transfer details or payment confirmation records. We do not store credit card numbers.
- Travel preferences, itinerary choices, and correspondence with our team
- Website usage data: pages visited, browser type, approximate location, via cookies (see below)
We collect this data directly from you via our inquiry forms, email correspondence, WhatsApp, and payment processes.
Why we collect it and our legal basis
| Purpose | Legal basis |
|---|---|
| Processing your booking and visa application | Performance of a contract |
| Communicating about your tour | Performance of a contract |
| Processing payments | Performance of a contract |
| Submitting visa and SDF documentation to the Tourism Council of Bhutan | Legal obligation |
| Sharing relevant details with accommodation and service providers | Performance of a contract |
| Sending marketing communications (only with consent) | Consent |
| Improving our website and services | Legitimate interest |
Who we share your data with
We share your personal data only where necessary to deliver your tour. This includes:
- The Tourism Council of Bhutan (TCB): required for visa processing and SDF collection
- Druk Air and Bhutan Airlines: where flights are booked through us
- Hotels, guesthouses, and homestays included in your itinerary
- Licensed local guides and drivers assigned to your tour
- Payment processors for transaction handling
We do not sell, rent, or share your personal data with third parties for marketing purposes. All service providers we work with are required to handle your data responsibly.
Where data is transferred outside your home country (for example, to Bhutan for visa processing), this is done solely for the purpose of fulfilling your booking. Such transfers are necessary for the provision of the service you have requested.
How long we keep your data
- Booking and visa records: 7 years, in compliance with Bhutanese tax and regulatory requirements
- Marketing communications records: until you unsubscribe
- Enquiry data (where no booking resulted): 12 months
- Website analytics data: 26 months
Cookies
Our website uses cookies to understand how visitors use the site and to improve your experience. These include:
- Essential cookies: required for the website to function
- Analytics cookies: help us understand which pages are visited and how (we use anonymised data only)
- No advertising or tracking cookies are used
You can manage cookie preferences via your browser settings. Declining analytics cookies will not affect your ability to use the site.
Your rights
Depending on where you are based, you may have the following rights regarding your personal data:
- Right to access: request a copy of the data we hold about you
- Right to rectification: ask us to correct inaccurate data
- Right to erasure: ask us to delete your data, where we are not legally required to retain it
- Right to restriction: ask us to limit how we use your data
- Right to data portability: receive your data in a portable format
- Right to object: object to processing based on legitimate interest
- Right to withdraw consent: where processing is based on consent (e.g. marketing emails), you may withdraw at any time
To exercise any of these rights, email us at privacy@kiyulodyssey.com. We will respond within 30 days.
If you are based in the EU or UK and believe we have not handled your data correctly, you have the right to lodge a complaint with your national data protection authority.
Marketing communications
We will only send you marketing emails if you have explicitly opted in. You can unsubscribe at any time by clicking the unsubscribe link in any email or by emailing us directly. We do not send unsolicited marketing.
Data security
We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or disclosure. These include:
- Encrypted email and file storage for sensitive documents
- Restricted access to booking data on a need-to-know basis
- Secure payment processing through reputable third-party providers
- Regular review of our data handling practices
In the event of a data breach that affects your rights, we will notify you promptly and in accordance with applicable law.
Children’s data
Our tours are available to travellers of all ages when accompanied by a responsible adult. Where a child’s data (passport details, dietary needs) is provided to us, it is provided by a parent or guardian who is responsible for consenting on the child’s behalf. We do not knowingly collect data from children without parental consent.
Changes to this policy
We may update this policy from time to time. The current version will always be available on this page with the date it was last updated. Material changes will be communicated to active clients by email.
Contact
For any privacy-related queries or to exercise your rights, contact us at:
Kiyul Odyssey privacy@kiyulodyssey.com Thimphu, Bhutan