1. Who We Are
1.1 This policy is issued by MasaiMaraSafari.com, a tour operating business licensed by the Tourism Regulatory Authority of Kenya, licence number [insert number], with offices in Nairobi and Narok (“we”, “us”, “the Company”).
1.2 We are the data controller for personal data collected through this website and in the course of arranging safaris.
1.3 Our registered data protection contact is [insert name or role] at [insert email].
2. Scope
2.1 This policy applies to personal data we collect from prospective and confirmed clients through this website, by email, by telephone and messaging applications, and in the course of delivering a safari.
2.2 It should be read together with our booking terms and conditions.
3. Personal Data We Collect
3.1 Identity and passport data. Full legal names, date of birth, nationality, gender, passport number and scans of the passport bio-data page. These are required to issue accommodation vouchers in your name, to complete air carrier manifests, and to purchase park entry permits.
3.2 Contact data. Email address, telephone and messaging numbers, and billing address.
3.3 Health and dietary data. Dietary requirements, allergies, mobility limitations and relevant pre-existing medical conditions. This is special category data and is collected only where you provide it.
3.4 Payment data. Bank transfer confirmations, transaction references and records of card payments processed by our payment providers. We do not receive or store full card numbers or security codes.
3.5 Technical data. IP address, browser and device type, and pages visited, collected through cookies as described in clause 8.
3.6 Where you provide personal data about other travellers in your party, you confirm that you are authorised to do so and that they have been informed of this policy.
4. Purposes and Legal Basis
4.1 We process personal data on the following bases under the Kenya Data Protection Act:
| Purpose | Data used | Basis |
|---|---|---|
| Issuing accommodation vouchers in your name | Identity data | Performance of contract |
| Completing bush flight manifests, including passenger weights required by air carriers | Identity data | Performance of contract, legal obligation |
| Purchasing park entry permits | Identity data | Performance of contract |
| Registering emergency air evacuation cover | Identity, health data | Performance of contract, vital interests |
| Communicating dietary and medical needs to camps | Health data | Explicit consent |
| Coordinating transfers and field logistics | Contact data | Performance of contract |
| Accounting and tax records | Payment data | Legal obligation |
| Responding to quote requests | Identity, contact data | Legitimate interests |
4.2 We do not use personal data for automated decision-making or profiling.
4.3 We do not sell, rent or trade personal data, and we do not disclose it to advertising networks or marketing agencies.
5. Disclosure to Third Parties
5.1 We disclose personal data only where necessary to deliver a safari, and only the minimum required:
- Accommodation providers. Lodges, tented camps and transit hotels forming part of your itinerary receive names and, where you have provided them, dietary and accessibility requirements.
- Air carriers. Scheduled bush flight operators receive passenger names, passport details and weights.
- County and national authorities. The Narok County Government, through the eCitizen portal, for Masai Mara entry permits. Where an itinerary includes a national park such as Lake Nakuru or Amboseli, the Kenya Wildlife Service receives the equivalent details for those parks.
- Emergency medical providers. AMREF Flying Doctors, and receiving hospitals in the event of an evacuation.
- Payment providers and banks. Stripe, PayPal, Wise and our commercial banks, for processing payments.
- Professional advisers and authorities. Our accountants, auditors, and the Kenya Revenue Authority, where required by law.
5.2 We require third parties to process personal data only on our instructions and to keep it secure.
6. International Transfers
6.1 Personal data is stored in Kenya. Where our payment providers or communication tools process data outside Kenya, transfers are made under the safeguards those providers maintain.
6.2 If you are resident in the United States, Canada or the European Economic Area, your data will be transferred to Kenya in order for us to deliver the safari you have booked.
7. Payment and Security
7.1 This website is served over TLS encryption. Data submitted through enquiry and booking forms is encrypted in transit.
7.2 Card payments are processed by Stripe, which is certified to PCI DSS Level 1. Card details are entered directly with the payment provider and do not pass through or reside on our servers.
7.3 Bank transfers are received into accounts held at commercial banks regulated by the Central Bank of Kenya.
7.4 Passport scans and health information are held on access-controlled systems available only to staff who need them to deliver your booking.
7.5 No transmission over the internet is entirely secure. We maintain appropriate technical and organisational measures, but we cannot guarantee absolute security.
8. Cookies and Analytics
8.1 Essential cookies are required for the website to function, including form submission and session handling. These cannot be disabled.
8.2 Analytics cookies measure page performance and navigation patterns in aggregate. These are set only where you consent.
8.3 You can clear or block cookies through your browser settings. Blocking analytics cookies does not prevent you from submitting an enquiry.
9. Retention
9.1 Passport scans and bio-data used for permits and flight manifests are deleted from operational systems within 30 days of the end of the safari.
9.2 Health and dietary information is deleted within 30 days of the end of the safari.
9.3 Invoices, payment records and tax documentation are retained for seven years, as required by Kenyan tax law.
9.4 Enquiry correspondence that does not result in a booking is deleted within 24 months.
10. Your Rights
10.1 Under the Kenya Data Protection Act you have the right to be informed of the use of your data, to access it, to have inaccurate data corrected, to request deletion, to object to processing, and to request that we restrict processing.
10.2 Where you have given consent, including for health and dietary data, you may withdraw it at any time. Withdrawal does not affect processing already carried out, and may prevent us from delivering parts of the booking.
10.3 California residents. Under the CCPA you may request disclosure of the categories of personal information collected, request deletion, and opt out of sale of personal information. We do not sell personal information.
10.4 Canadian residents. Under PIPEDA you may request access to your personal information and challenge its accuracy.
10.5 To exercise any right, contact us using the details in clause 14. We respond within 30 days. We may ask you to verify your identity before acting on a request.
10.6 Requests for deletion cannot be met where we are required to retain records under clause 9.3.
11. Children
11.1 We collect data about minors only as part of a family booking made by a parent or guardian, and only to the extent required for permits, manifests and camp arrangements.
11.2 This website is not directed at children and we do not knowingly collect data from them directly.
12. Data Breaches
12.1 In the event of a breach likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and will notify affected individuals without undue delay where the risk is high.
13. Changes to This Policy
13.1 We may update this policy. The effective date above shows when the current version took effect, and the version in force at the time of your booking applies to that booking.
14. Contact and Complaints
14.1 Questions about this policy, or requests under clause 10, should be sent using the details on our contact page.
14.2 If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner of Kenya at odpc.go.ke.