Welcome to Naturographers. By accessing our website or booking a photography tour/workshop with us, you agree to comply with the following Terms & Conditions. Please read them carefully before registering for any of our services.

1. Third-Party Sharing Disclosure

DPDPA places significant emphasis on transparency regarding the processing and sharing of personal data. While the current policy acknowledges that information may be shared with service providers, additional clarity regarding recipients and processing purposes would strengthen transparency.

Current Statement

“Naturographers does not sell, rent, or trade personal information to third parties. Information may only be shared with trusted service providers involved in tour operations, accommodations, safari bookings, or payment processing when necessary.”

Suggested Amendment

“We do not sell, rent, or trade personal information. We may share personal information with hotels, resorts, transportation providers, safari operators, forest authorities, payment processors, and other service providers solely for the purpose of processing bookings, delivering tour services, complying with legal requirements, facilitating payments, and ensuring customer safety and support. Such sharing is limited to information necessary for the relevant service.

We require such third parties to protect personal information and use it only for the purposes for which it was provided.”

2. Consent at Point of Collection/Booking/Registration

DPDPA requires consent to be free, specific, informed, unconditional, and unambiguous. It is recommended that all inquiry forms, contact forms, newsletter subscriptions, and booking forms include a consent acknowledgement immediately prior to submission.

Suggested Language

“I have read and understood the Privacy Policy and consent to the collection, processing, and use of my personal information for booking, communication, customer support, and service delivery purposes.”

Benefit for Naturographers

Provides a clear consent record and strengthens compliance with DPDPA notice and consent requirements.

3. Data Principal Rights

The Privacy Policy should contain a dedicated section outlining customer rights under DPDPA.

Suggested Rights Section

Customers should be informed of their ability to:

• Request access to personal information.
• Request correction or updating of inaccurate information.
• Request deletion of personal information/account, subject to legal and operational requirements.
• Withdraw previously provided consent.
• Submit privacy-related complaints or grievances.

Benefit for Naturographers::

Demonstrates transparency and supports DPDPA’s Data Principal Rights framework.

4. Data Retention and Deletion

The current policy would benefit from greater clarity regarding data retention periods and deletion practices.

Recommended Statement

“Personal information is retained only for as long as necessary to fulfil booking requirements, provide requested services, comply with legal and regulatory obligations, resolve disputes, and enforce contractual obligations. Information is deleted or anonymized when no longer required”.

Benefit for Naturographers:

Addresses transparency expectations regarding lifecycle management of personal data.

5. Data Protection and Security

The current security statement is generally appropriate; however, it may be enhanced to provide additional comfort to customers.

Current Statement

“We take reasonable technical and administrative measures to protect your personal information from unauthorized access, misuse, loss, or disclosure. However, no online transmission or storage system can be guaranteed to be 100% secure”.

Recommended Amendment

“We implement reasonable technical, administrative, and organizational safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, loss, or destruction. Access to personal information is restricted to authorized personnel and service providers who require such information to perform their duties.

We also require third-party service providers who process personal information on our behalf to maintain appropriate security measures. While we strive to protect personal information using commercially reasonable safeguards, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.”

Benefit

Provides a more comprehensive explanation of organizational safeguards while maintaining realistic expectations regarding cyber risks.

6. Children’s Personal Data

As DPDPA includes specific obligations relating to children’s personal data, it is advisable to include a dedicated section addressing:

• Whether services are intended for minors
• Parental consent requirements where applicable
• Handling of children’s personal information

Net of it, my recommendation is that we should not attempt to create a privacy policy that portrays us as “perfect.” Instead, the policy should be built around four key principles:

• Transparency – Clearly explain what personal data is collected, why it is collected, and how it is used.
• Reasonableness – Commit to reasonable safeguards, retention practices, and controls that are practical and proportionate to the nature of the business.
• Avoid Unrealistic Commitments – Refrain from using absolute terms such as ensure, guarantee, always, never, fully compliant, or completely secure, as these create obligations that may be difficult to substantiate.
• Operational Alignment – Only include statements that can be consistently implemented, evidenced, and demonstrated if questioned by customers, auditors, regulators, or legal authorities.

From a governance, audit, legal, and compliance standpoint, a Privacy Policy is far more than a website document—it is a formal representation of how the organization collects, uses, shares, protects, retains, and manages personal data.

If a regulator, auditor, customer, or court were to ask, “How do you process personal data?”, the Privacy Policy would likely be one of the first documents reviewed.

As a practical rule, every statement included in the Privacy Policy should be tested against a simple question: “Can we reasonably demonstrate and support this statement if challenged?”

If the answer is no, the statement should either be revised or omitted.

Contact Us

For any questions regarding these Terms & Conditions, please contact: