Effective date: October 2026 · This English version is the governing text.
1. Who we are
Panda & Peppercorn is a travel operator based in Chengdu, Sichuan, China. For the purposes of the EU GDPR and UK GDPR, we act as the data controller for the personal data described below. You can reach us at the contact form on our website.
2. What we collect
When you send an inquiry or booking request
- Your name, email address, and anything you choose to tell us (travel dates, group size, dietary needs, interests, message content).
When you use the on-site chat
- Your chat messages, conversation history, and a randomly generated conversation ID stored on your device so your conversation survives a page reload.
Automatically, when you visit
- Your IP address and an approximate location derived from it (country / region / city), the pages you view, how you arrived at our site (referring website), your browser language, and a random visitor ID. This helps us understand where our travelers come from and keep our statistics honest.
When you travel with us
- Booking details: passport details required for hotels, train tickets and park entries, insurance information, emergency contacts, and any health or accessibility information you voluntarily share so we can look after you properly.
3. Why we use it, and our legal bases
- To answer your inquiry and plan your trip (including sending you an itinerary and quote) — necessary to take steps at your request before a contract (Art. 6(1)(b) GDPR).
- To operate your booked journey — performance of the booking contract.
- To keep basic visit statistics and secure our website — our legitimate interest in running and improving a small business (Art. 6(1)(f) GDPR).
- To comply with Chinese legal and regulatory obligations applicable to licensed travel operators.
We do not use your data for automated decision-making or profiling, and we do not send marketing emails unless you explicitly ask us to.
4. Cookies and local storage
We use no third-party advertising or tracking cookies. We store a small number of entries in your browser's local storage to make the site work:
| Key | Purpose | Removed |
|---|---|---|
pp_lang, pp_cur | Remembers your language and currency choice | When you clear browser data |
pp_conv | Keeps your chat conversation connected across page reloads | When you clear browser data |
pp_visitor | Random ID used to count visits (no name, no cross-site tracking) | When you clear browser data |
5. Who we share it with
- Accommodation, transport and activity providers — only the details they need to deliver what you booked (e.g. passport name for a train ticket).
- Our hosting provider, which stores our website and database.
- Payment providers, when you make a payment to us.
- Authorities where required by law (e.g. hotel guest registration, which is mandatory in China).
We never sell, rent, or trade your personal data, and we don't share it for advertising.
6. Where your data is stored
Our servers are located in Hong Kong, China. If you contact us from the EU, UK, or elsewhere, your data will be transferred to and stored in China. We treat it under the same standards described in this policy, and we only collect the minimum needed.
7. How long we keep it
- Unconverted inquiries and chat conversations: up to 24 months, then deleted.
- Booking records and trip documentation: kept for the period required by Chinese regulations for licensed operators.
- Visit statistics (aggregated, non-identifying): up to 12 months.
8. Your rights
Depending on where you live, you may have the right to:
- Ask what data we hold about you, and get a copy (access / portability).
- Correct inaccurate data.
- Ask us to delete your data (erasure / "right to be forgotten").
- Object to or restrict certain processing.
- Withdraw consent for optional processing at any time.
- Lodge a complaint with your local data protection authority.
To exercise any of these rights, email us — see the contact details in section 1. We answer every request ourselves, usually within 7 days. California residents: we do not sell or share personal information as defined by the CCPA/CPRA, and you may request deletion at any time.
9. Children
Our services are directed at adults. We don't knowingly collect data from children under 16 except as part of a family booking made by a parent or guardian.
10. Changes to this policy
If we make material changes we'll update the "effective date" above and, where practical, notify travelers with active bookings.