Privacy Policy

How LIM Travel Company Limited collects, uses, and protects your data when you use sapanomad.com. We never sell your information.

✓ GDPR-Compliant ✓ Your Data, Your Rights ✓ Never Sold to Third Parties
📧 Email Privacy Team 💬 WhatsApp Us

🔒 The short version: We only collect what we need to book your trip and keep you safe in Sapa. We never sell your data. We use trusted processors (PayPal, Google, Cloudflare) under strict contracts. You can request to see, correct, or delete your data anytime by emailing [email protected].

SECTION 1

Who We Are

This Privacy Policy applies to the website sapanomad.com and all related services (the “Service”). The Service is operated by:

LIM Travel Company Limited
Business Registration No. 0109215229
International Tour Operator License No. 01-2452/2023

📮 Registered office (legal correspondence):
No. 88, Lane 328 Nguyen Trai Street, Thanh Xuan Trung Ward, Thanh Xuan District, Hanoi, Vietnam

🏢 Customer-facing office (Sapa Nomad):
4th Floor, 536 Điện Biên Phủ Street, Sa Pa town, Lào Cai Province, Vietnam
Hours: 7:00 AM – 11:00 PM (GMT+7), open daily

Contact for all inquiries: [email protected] · +84 964 900 120

For the purposes of the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), LIM Travel Company Limited is the data controller responsible for your personal information. Sapa Nomad is the trading name under which LIM Travel Company Limited operates its travel services in Sa Pa.

SECTION 2

What Information We Collect

🧳 Booking Information

What you provide directly when you book a service:

  • Full name
  • Email address
  • Phone number (for WhatsApp coordination)
  • Travel dates and pickup details
  • Number of passengers and any special needs (allergies, mobility, dietary)
  • Passport number — only for train tickets and certain accommodation bookings that require it by Vietnamese law

💳 Payment Information

Processed entirely by trusted payment partners — we do not see or store your card details:

  • PayPal — for PayPal payments
  • OnePay — for Vietnamese card payments
  • Tazapay — for Southeast Asia local payments

We only receive a confirmation of the payment (amount, method, transaction ID) — not your full card number, CVV, or PIN.

📊 Technical & Usage Data

Automatically collected when you visit the website:

  • IP address (anonymized for analytics)
  • Browser type and version
  • Device type and operating system
  • Pages visited, time on page, referral source
  • Approximate location (country/city only, from IP)

SECTION 3

Why We Collect Your Information

Under GDPR Article 6, we process your personal data for these specific purposes:

  • To fulfil your booking (legal basis: contract performance) — sending tickets, coordinating pickups, handling cancellations and refunds.
  • To comply with Vietnamese tax and tourism law (legal basis: legal obligation) — keeping booking records for 7 years as required by tax authorities.
  • To improve our service and prevent fraud (legal basis: legitimate interest) — analyzing aggregated booking patterns, protecting against payment fraud.
  • To send you marketing emails (legal basis: your consent) — only if you have opted in. You can unsubscribe at any time.
  • To respond to your enquiries (legal basis: legitimate interest) — when you contact us via email, WhatsApp, or the contact form.

SECTION 4

Who We Share Your Information With

We share the minimum data necessary with trusted processors, each bound by data-protection contracts. We do not sell your personal information to any third party — ever.

Service providers we use:

  • PayPal (US) — payment processing. PayPal Privacy
  • OnePay (Vietnam) — Vietnamese card payment processing
  • Tazapay (Singapore) — Southeast Asia local payment processing. Tazapay Privacy
  • Google (US) — we use Google Analytics 4 (anonymized analytics), Google reCAPTCHA (spam protection on forms), and Google Workspace (email service for [email protected]). Google Privacy
  • Cloudflare (US) — website security and content delivery network. Cloudflare Privacy
  • WhatsApp / Meta (US) — when you contact us via WhatsApp, your messages are stored by Meta in accordance with their terms. WhatsApp Privacy
  • Akismet / Automattic (US) — comment and form spam detection. Automattic Privacy

Local service providers:

To deliver your booking, we share only the minimum data required — typically your name, phone number, and pickup location — with the specific supplier(s) you have booked with:

  • Train operators (named in full because they receive your passport number): Chapa Express, King Sapa, Damitrain.
  • Bus, limousine, and private car operators such as Sao Việt, HK Bus, G8, Strip VN, and Eco Limousine, and other licensed transport partners listed on our product pages.
  • Local services including independent tour guides, drivers, and accommodation partners (homestays, hotels, lodges) across Sapa and Northern Vietnam.

The specific partner(s) handling your booking are shown on your booking confirmation. For a list of the partners we may share data with on your specific booking, email [email protected].

We do not share your email address or payment information with any local supplier.

📌 Legal disclosures: We may disclose your information when required by Vietnamese law, court order, or government request — for example, tax audits or police investigations. We will tell you when this happens unless legally prohibited.

SECTION 5

How Long We Keep Your Information

  1. Booking records — kept for 7 years from the booking date, as required by Vietnamese tax and accounting law.
  2. Marketing data (email lists, preferences) — kept for 2 years from your last interaction, or until you unsubscribe.
  3. Contact form submissions — kept for 3 years to allow follow-up.
  4. WhatsApp conversations — managed by WhatsApp’s own retention; we keep our copy for 3 years for service-quality review.
  5. Website analytics (Google Analytics 4) — anonymized and aggregated; retained per Google’s default 14-month setting.
  6. Inactive customer accounts — deleted after 3 years of no activity, unless you ask us to keep them.

SECTION 6

International Data Transfers

Sapa Nomad operates from Vietnam, and several of our processors are based outside the European Economic Area (EEA). When we transfer your data internationally, we rely on:

  • Standard Contractual Clauses (SCCs) approved by the European Commission for transfers to processors in the United States (Google, PayPal, Cloudflare, Akismet, Meta/WhatsApp) and other non-adequate countries.
  • Each processor’s own data-protection certifications (most are GDPR- and CCPA-compliant by design).

Vietnam is not currently covered by an EU adequacy decision. By using our Service, you understand that your data may be processed in Vietnam — which has its own data-protection law (Decree 13/2023/NĐ-CP on Personal Data Protection, effective 1 July 2023) — and that we will protect your data with the same care required by GDPR.

SECTION 7

Your Rights

Whatever country you live in, you have the following rights regarding your personal data. To exercise any of these rights, simply email [email protected] from the email address linked to your booking. We respond within 30 days (free of charge for the first request per year).

  • Right to access — request a copy of all personal data we hold about you.
  • Right to correction — ask us to fix any inaccurate or incomplete data.
  • Right to erasure (“right to be forgotten”) — ask us to delete your data, unless we are legally required to keep it (such as tax records).
  • Right to restrict processing — ask us to pause processing while we resolve a dispute or update.
  • Right to data portability — receive your data in a machine-readable format (CSV or JSON) to take to another service.
  • Right to object — to specific processing such as marketing emails or fraud-prevention profiling.
  • Right to withdraw consent — for anything we process based on your consent (e.g., marketing).
  • Right to complain — to a supervisory authority. EU residents can complain to their national Data Protection Authority. California residents can complain to the California Attorney General.

💚 California residents (CCPA): You have the additional right to opt out of the “sale” of personal information. We do not sell personal information, so there is nothing to opt out of — but the right exists.

SECTION 8

Cookies & Tracking

Cookies are small text files stored on your device. We use them sparingly:

  • Strictly necessary cookies — for the website to work (session management, shopping cart, security). Cannot be disabled.
  • Performance cookies — Google Analytics 4 with IP anonymization. Helps us understand how visitors use the site so we can improve it.
  • Security cookies — Cloudflare bot management and reCAPTCHA, to protect against spam and abuse.

We do not use:

  • Advertising cookies (no Facebook Pixel, Google Ads remarketing, or similar)
  • Third-party social media trackers (no LinkedIn Insight Tag, TikTok Pixel, etc.)
  • Profile-building cookies for marketing

You can clear or block cookies through your browser settings. Blocking strictly necessary cookies may stop the website from working properly.

🍪 Cookie consent banner: A consent banner is being added to the site (estimated rollout: Q3 2026). Until then, by using our Service you consent to the cookies described above. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

SECTION 9

Children’s Privacy

Our Service is intended for adults aged 18 and over. We do not knowingly collect personal data from children under 16. When a family books a trip together, the parent or legal guardian provides the booking on behalf of any minor children, and we treat that data the same as adult data (under the parent’s account).

If you believe we have collected data from a child without parental consent, please contact us at [email protected] and we will delete it promptly.

SECTION 10

Updates to This Policy

We may update this Privacy Policy from time to time — for example, when we add a new payment processor, change our retention period, or respond to a change in law. When we make a material change, we will:

  • Update the “Last updated” date at the top of this page
  • Notify customers with an active booking by email
  • Post a notice on our homepage for at least 30 days

We encourage you to review this page periodically. Continued use of the Service after changes means you accept the updated policy.

SECTION 11

Contact Us About Privacy

For any questions about this Privacy Policy or to exercise your rights, contact our privacy team:

📧 Email: [email protected] — please use “Privacy Request” in the subject line
💬 WhatsApp: +84 964 900 120
📮 Postal mail: Privacy Team, LIM Travel Company Limited, No. 88, Lane 328 Nguyen Trai Street, Thanh Xuan Trung Ward, Thanh Xuan District, Hanoi, Vietnam
⏱ Response time: Within 30 days (most requests handled in 1 – 2 business days)

Privacy — Frequently Asked Questions

Quick answers to the questions we hear most often

Do you sell my personal information?
No. We never sell your personal data to any third party. We share only the minimum data needed with trusted processors (PayPal, Google, Cloudflare) and local suppliers (drivers, guides) under strict contracts.
How do I request a copy of my data?
Email [email protected] from the email address linked to your booking, with “Privacy Request — Data Access” in the subject. We will send you a CSV or JSON file containing all data we hold within 30 days (usually within 1 – 2 business days).
How do I delete my data?
Email us at [email protected] with “Privacy Request — Erasure” in the subject. We will delete your data unless we are legally required to keep parts of it (booking and payment records must be kept for 7 years for Vietnamese tax law). We will tell you exactly what we kept and why.
Do you share my data with bus operators and drivers?
Yes — but only the minimum needed to deliver your trip: your name, phone number for pickup coordination, and meeting location. We never share your email, payment details, or other personal information with drivers or operators.
Why do you need my passport for a train booking?
Vietnamese rail operators (Chapa Express, King Sapa, Damitrain) require passenger passport numbers to issue tickets — this is a legal requirement under Vietnamese transport law, not something we choose. The passport number is shared only with the rail operator and used only to print your ticket. We do not store an image of your passport on our servers.
Can I opt out of marketing emails?
Yes — every marketing email we send has an “Unsubscribe” link at the bottom. Click it to opt out instantly. You can also email us at [email protected] and we will remove you. Unsubscribing does not affect booking-related emails (confirmations, refund updates) — those are essential to deliver the service you booked.
How is my data protected when I message you on WhatsApp?
WhatsApp messages are end-to-end encrypted between your phone and ours. WhatsApp (Meta) stores them under its own privacy policy. We treat WhatsApp messages like any other booking communication — kept for 3 years for service-quality review, then deleted.
What happens to my data if I never book anything?
If you only browse the website without booking, we collect only anonymized analytics (Google Analytics 4 — no name or email). This data is aggregated and used to improve the site, retained for 14 months, then deleted automatically.
Are children’s data protected differently?
We do not knowingly collect data from anyone under 16. When children travel with their parents on a Sapa Nomad booking, the parent or guardian provides all data and acts as the data controller for the child. If you believe we have collected children’s data by mistake, contact us immediately and we will delete it.
I am an EU citizen. Where do I complain if I am unhappy with how my data is handled?
First, contact us at [email protected] — most concerns are resolved within 1 – 2 days. If you remain dissatisfied, you have the right to lodge a complaint with the Data Protection Authority in your EU country of residence. A full list is available on the European Data Protection Board website.

Questions about your data?

Our team responds to privacy requests within 30 days (most within 1 – 2 business days).

📧 Email Privacy Team

Use subject "Privacy Request"

[email protected]

💬 WhatsApp

Fastest channel, 8 AM – 10 PM GMT+7

+84 964 900 120

📜 Terms & Conditions

Read our full terms of service

Read T&C

Last reviewed: 2026-05-28 · Reviewed quarterly by LIM Travel Company Limited.