Privacy Policy

1. Data Controller

Safari Yetu Adventures Limited
Cianda House, Koinange Street, Nairobi, Kenya
Registration: Kenya Companies Registry
Email: info@safariyetuadventures.com
Phone: +254 794 000 555

For data protection matters, contact our designated Data Protection Contact at info@safariyetuadventures.com with the subject line "Data Protection".

2. Scope

This policy applies to all personal data processed by Safari Yetu Adventures Limited when you:

• Visit our website at safariyetuadventures.com
• Submit an enquiry, booking request, or contact form
• Communicate with us by email, phone, or social media
• Book or participate in any of our safari services

3. Personal Data We Collect

3.1 Data You Provide Directly

• Full name, email address, phone number
• Country of residence, nationality, passport details (for bookings)
• Travel dates, group size, dietary requirements, medical conditions relevant to travel
• Payment information (processed by our secure payment partners — we do not store card details)
• Communications and correspondence with us

3.2 Data Collected Automatically

• IP address and approximate location
• Browser type, device type, operating system
• Pages visited, time on site, referring URLs
• Cookie identifiers (see Section 8)

3.3 Special Categories of Data

We may collect health-related information (e.g. dietary needs, medical conditions) only where necessary for your safari safety. This is processed under your explicit consent and handled with heightened security.

4. Legal Basis for Processing

Under the Kenya DPA 2019 (Section 30) and GDPR (Article 6), we process your data on the following lawful bases:

Purpose	Legal Basis (Kenya DPA)	Legal Basis (GDPR)
Processing safari bookings and enquiries	Performance of contract (s.30(1)(b))	Art. 6(1)(b) — Contract
Sending booking confirmations and itineraries	Performance of contract (s.30(1)(b))	Art. 6(1)(b) — Contract
Responding to enquiries	Legitimate interest (s.30(1)(f))	Art. 6(1)(f) — Legitimate interest
Marketing communications	Consent (s.30(1)(a))	Art. 6(1)(a) — Consent
Analytics and website improvement	Consent (s.30(1)(a))	Art. 6(1)(a) — Consent
Legal and regulatory compliance	Legal obligation (s.30(1)(c))	Art. 6(1)(c) — Legal obligation
Health/safety data for safari operations	Explicit consent (s.30(1)(a))	Art. 9(2)(a) — Explicit consent

5. How We Use Your Data

• Process and manage safari bookings and travel arrangements
• Communicate about your booking, itinerary, and travel updates
• Provide customer support and respond to enquiries
• Send marketing communications (only with your consent)
• Improve our website, services, and user experience
• Comply with legal, regulatory, and tax obligations
• Prevent fraud and ensure security

6. Data Sharing and Disclosure

We do not sell your personal data. We share data only as necessary:

Recipient	Purpose	Safeguards
Safari lodges, parks, and ground operators	Fulfilling your booking	Contractual obligations
Payment processors	Secure transaction processing	PCI-DSS compliance
Email service providers (Brevo)	Sending confirmations and communications	Data processing agreement
Analytics providers (Google Analytics)	Website usage analysis	Anonymised data, consent-gated
Legal authorities	When required by law or court order	Minimum necessary disclosure

7. International Data Transfers

Safari Yetu Adventures is based in Kenya. When we transfer personal data outside Kenya, we ensure appropriate safeguards are in place as required by Section 48 of the Kenya DPA 2019 and GDPR Chapter V:

• Transfers to countries with adequate data protection laws
• Standard Contractual Clauses (SCCs) where required
• Explicit consent where other safeguards are not available

8. Cookies

We use cookies in accordance with the Kenya DPA 2019 and the EU ePrivacy Directive. You can manage your preferences via our cookie banner.

Type	Purpose	Consent Required
Essential	Site functionality, security, session management	No — strictly necessary
Analytics	Understanding visitor behaviour (Google Analytics)	Yes
Marketing	Personalised advertising and campaign tracking	Yes

9. Data Retention

Data Type	Retention Period	Basis
Booking and transaction records	7 years	Kenya Tax Procedures Act, legal obligation
Enquiry and contact data	2 years from last contact	Legitimate interest
Marketing consent records	Until consent withdrawn	Consent
Website analytics	26 months (anonymised)	Consent
Health/special category data	Duration of booking + 1 year	Explicit consent

10. Your Rights

Under the Kenya Data Protection Act 2019 (Part IV) and GDPR (Chapter III), you have the following rights:

Right	Description	How to Exercise
Right of Access (s.26 DPA)	Request a copy of your personal data	Email us with "Data Access Request"
Right to Rectification (s.27 DPA)	Correct inaccurate or incomplete data	Email us with corrections
Right to Erasure (s.28 DPA)	Request deletion of your data	Email us with "Erasure Request"
Right to Restriction	Limit how we process your data	Email us with your request
Right to Data Portability (s.29 DPA)	Receive your data in a portable format	Email us with "Portability Request"
Right to Object (s.31 DPA)	Object to processing based on legitimate interest	Email us with your objection
Right to Withdraw Consent	Withdraw consent at any time	Use unsubscribe link or email us

We will respond to all requests within 30 days as required by the Kenya DPA 2019. To exercise your rights, contact us at info@safariyetuadventures.com.

11. Data Security

We implement appropriate technical and organisational measures under Section 41 of the Kenya DPA 2019 and GDPR Article 32:

• HTTPS/TLS encryption for all data in transit
• Access-controlled, encrypted databases
• Role-based access controls for staff
• Regular security assessments and updates
• Staff training on data protection obligations

12. Data Breach Notification

In the event of a personal data breach, we will:

• Notify the Office of the Data Protection Commissioner (ODPC) within 72 hours of becoming aware, as required by Section 43 of the Kenya DPA 2019
• Notify affected individuals without undue delay where the breach is likely to result in high risk to their rights and freedoms
• Document all breaches in our internal breach register

13. Children's Privacy

Our services are not directed at children under 18. We do not knowingly collect personal data from minors without verifiable parental consent. If you believe we have collected data from a child, please contact us immediately and we will delete it promptly.

14. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

15. Complaints

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with:

• Office of the Data Protection Commissioner (ODPC), Kenya
  Website: www.odpc.go.ke
  Email: info@odpc.go.ke
• Your local data protection authority if you are located in the EU/EEA

We encourage you to contact us first so we can resolve your concern directly.

16. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. We will notify you of material changes by posting the updated policy on this page with a new effective date. For significant changes, we will provide additional notice (e.g. email notification).