Privacy Policy

Sun & Safari (“we,” “us,” “our”) is a Kenya-based travel planning and safari booking company operating at www.sunandsafari.co.ke. This Privacy Policy describes how we collect, use, store, share, and protect personal data belonging to the people who visit our website, contact us with an enquiry, or book one of our safari and beach packages through us. It also explains the choices and rights you have regarding that information.

We’ve tried to write this in language a traveller can actually read in one sitting rather than dense legal boilerplate, while still covering everything required under Kenya’s Data Protection Act, 2019, and the general principles reflected in international frameworks such as the EU’s GDPR, which many of our international clients are more familiar with. If anything below is unclear, our contact page lists the fastest way to reach us with a question.

Contents

• 1. Who We Are
• 2. What Information We Collect
• 3. How We Collect Information
• 4. Why We Use Your Information
• 5. Our Legal Basis for Processing
• 6. Who We Share Your Information With
• 7. International Data Transfers
• 8. Cookies and Website Tracking
• 9. How Long We Keep Your Information
• 10. How We Protect Your Information
• 11. Your Rights Over Your Data
• 12. Children’s Privacy
• 13. Marketing Communications
• 14. Links to Third-Party Websites
• 15. Changes to This Policy
• 16. How to Contact Us

1. Who We Are

Sun & Safari is a destination management and travel planning business operating out of Kenya, arranging safari itineraries across the country’s national parks and reserves — including the Masai Mara, Amboseli, Tsavo, and Samburu — alongside coastal extensions along the Indian Ocean in Diani, Watamu, Malindi, and Lamu. We are the data controller for the personal information described in this policy, meaning we determine why and how your data is processed in connection with our booking and travel-planning services.

This policy applies to everyone who interacts with us through the website, by email, by phone, by WhatsApp, or through any booking form, whether or not that interaction results in a confirmed trip. It sits alongside our Booking Conditions and our Terms & Conditions, both of which govern the contractual side of a confirmed booking. Where those documents address payment terms, cancellation rules, or liability, this Privacy Policy focuses specifically on data.

2. What Information We Collect

The information we collect depends on how far you are in the process of planning a trip with us — a casual visitor browsing our travel guide shares far less than a traveller finalising a confirmed booking. Broadly, the categories are as follows.

We generally collect only what is necessary to plan and deliver your trip, or to respond meaningfully to whatever you’ve asked us. If a piece of information seems unusual for us to be requesting — for example, passport details are only ever requested once a booking is being finalised, never at the initial enquiry stage — you’re welcome to ask why we need it before providing it.

3. How We Collect Information

Most of the information we hold is given to us directly by you, through one of the following channels:

• Completing our trip planner or a general enquiry form
• Emailing, calling, or messaging us via WhatsApp about a potential or confirmed booking
• Subscribing to our newsletter or downloadable travel resources
• Completing a booking for one of our safari packages or a custom itinerary
• Leaving a review or testimonial that we may feature on our testimonials page, always with your separate consent

Some information is collected automatically when you browse our website, through cookies and similar tracking technologies — this is described in more detail in the Cookies section below. Occasionally, we also receive information about you from third parties directly involved in delivering your trip, such as a partner lodge, camp, or ground transport operator confirming details you’ve already shared with us, or a travel insurance provider processing a claim on your behalf.

4. Why We Use Your Information

We use personal data for a defined set of purposes tied directly to running our business and delivering the service you’ve asked for. We do not collect data speculatively for undefined future uses. Specifically, we use your information to:

• Respond to enquiries and provide tailored trip proposals, quotes, and itineraries
• Process and manage confirmed bookings, including liaising with lodges, camps, transport providers, and park authorities on your behalf
• Take payments and issue receipts, invoices, or refunds where applicable
• Communicate essential trip logistics before and during travel, including flight confirmations, park permits, and emergency contact arrangements
• Comply with legal, immigration, and park-entry documentation requirements, including Kenya’s eTA system
• Send marketing communications, where you’ve opted in, about offers, new itineraries, or seasonal travel advice
• Improve our website, services, and content based on aggregated, anonymised usage patterns
• Investigate and resolve complaints, disputes, or safety incidents connected to a trip we’ve arranged
• Meet our own accounting, tax, and regulatory record-keeping obligations under Kenyan law

5. Our Legal Basis for Processing

Under Kenya’s Data Protection Act, 2019, and consistent with the broader principles reflected in international data protection law, we rely on one or more of the following legal grounds for each use of personal data described above:

Performance of a contract

Where we are arranging or delivering a trip you’ve booked, processing your travel details, payment information, and communications is necessary to fulfil our contractual obligations to you, as further described in our Booking Conditions.

Consent

Where you’ve opted in to receive marketing emails, or where we ask permission to feature a testimonial or photograph, we rely on your freely given, specific consent, which you can withdraw at any time.

Legitimate interest

For activities such as improving our website, preventing fraud, or maintaining basic security logs, we rely on our legitimate interest in running a functioning, secure business — balanced, in every case, against your right to privacy.

Legal obligation

Where Kenyan tax, immigration, or consumer protection law requires us to retain certain records, we process and store that information to meet those obligations, regardless of any other basis that might otherwise apply.

6. Who We Share Your Information With

Delivering a multi-part trip across national parks, coastal resorts, and internal flights necessarily involves sharing certain details with the operators actually providing those services. We share information only where it’s genuinely needed to deliver what you’ve booked, and we do not sell personal data to third parties for their own independent marketing purposes. The categories of recipients include:

• Accommodation providers — lodges, camps, and hotels featured across our destinations and coast pages, who need guest names, dates, and any dietary or accessibility requirements to prepare for your stay
• Transport operators — light aircraft charter companies, ground transfer drivers, and the providers behind our airport transfer services, who need passenger names, weights (for bush flights), and flight or transfer times
• Payment processors — third-party payment gateways that handle card transactions securely on our behalf; we do not receive or store your full card number
• Park and conservancy authorities — where entry permits or conservation fees require traveller names and nationality
• Travel insurance providers — only where you’ve asked us to help arrange or process cover through a partner insurer
• Professional advisers and regulators — including accountants, auditors, or Kenyan regulatory bodies, where legally required

Each of these third parties is expected to handle your information responsibly and only for the specific purpose it was shared for. Where a partner operator has its own privacy policy — as most licensed camps and airlines do — that policy will govern their independent handling of your data once it’s in their hands, and we’d encourage you to review it if you have specific concerns about a particular property or carrier.

7. International Data Transfers

Because our clients travel internationally and many of our software and payment tools are hosted outside Kenya, some personal data is transferred to and processed in other countries — including within the European Economic Area, the United Kingdom, and the United States, depending on which service providers we use for hosting, email delivery, and payment processing. Where such a transfer occurs, we take reasonable steps to ensure the receiving party maintains a standard of protection consistent with Kenyan data protection requirements, whether through contractual safeguards, the receiving country’s own adequacy status, or the provider’s recognised certification framework.

If you would like more detail on a specific transfer relevant to your booking — for instance, which country a particular payment processor is based in — our contact page is the quickest way to ask.

8. Cookies and Website Tracking

Our website uses cookies and similar small data files to help it function properly and to understand, in aggregate, how visitors use our content. Cookies fall into a few broad categories:

Essential cookies

These are required for core site functionality, such as remembering the state of our mobile navigation menu or maintaining a secure session while you complete a booking form. The site cannot function properly without them, and they do not require separate consent under most data protection frameworks.

Analytics cookies

We use analytics tools to understand which pages — such as our Best Time to Visit guide or our bush-and-beach package — are most useful to visitors, how long people spend reading, and which pages lead to an enquiry. This data is generally aggregated and does not identify you personally, though it may be linked to your IP address or device in raw form before aggregation.

Marketing and retargeting cookies

Where enabled, these allow us to show relevant Sun & Safari content on other platforms you use, based on pages you’ve previously viewed on our site. These cookies are only set with your consent, obtainable and revocable through your cookie preference settings or your browser’s own controls.

Most browsers let you block or delete cookies through their settings, though doing so may affect certain site features, such as staying logged into a booking session. We do not currently respond to “Do Not Track” browser signals, as no consistent industry standard for interpreting them yet exists.

9. How Long We Keep Your Information

We retain personal data only for as long as it’s needed for the purpose it was collected, after which it is deleted or anonymised. As a general guide:

• Enquiry details from trips that never proceed to booking are typically retained for up to 24 months, in case you return to revisit the conversation, after which they are deleted unless you’ve asked us to keep them longer
• Confirmed booking records, including travel documents and payment references, are retained for the period required by Kenyan tax and accounting law, generally seven years
• Marketing consent records are retained for as long as you remain subscribed, and for a reasonable period afterward to demonstrate that consent was properly obtained and later withdrawn
• Website analytics data is generally retained in aggregated or pseudonymised form for longer periods, as it no longer identifies you individually

If you’d like us to delete your information sooner than these general timeframes, see the Your Rights section below for how to make that request.

10. How We Protect Your Information

We apply reasonable technical and organisational measures to protect the personal data we hold against unauthorised access, loss, misuse, or alteration. These include encrypted transmission of data submitted through our website, restricted internal access to booking and payment systems on a need-to-know basis, and the use of reputable, security-vetted third-party providers for payment processing rather than handling card data ourselves.

No system connected to the internet can be guaranteed completely secure, and we cannot promise that a determined, sophisticated attack will never succeed. What we can commit to is taking data security seriously as an ongoing responsibility rather than a one-time setup, and notifying affected individuals and, where required, the relevant Kenyan regulator without undue delay if a breach occurs that is likely to result in a genuine risk to your rights or freedoms.

11. Your Rights Over Your Data

Depending on your location and the applicable law, you generally have the following rights regarding the personal data we hold about you:

• Access a copy of the data we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your data, subject to legal retention needs
• Object to certain processing based on legitimate interest
• Withdraw marketing consent at any time
• Request a portable copy of data you’ve provided us
• Restrict processing in specific circumstances
• Lodge a complaint with a data protection authority

To exercise any of these rights, contact us using the details in the final section of this policy. We will respond within a reasonable timeframe, generally within 30 days, and may need to verify your identity before actioning certain requests — particularly deletion requests — to prevent someone else from fraudulently accessing or altering your data. If you are unsatisfied with our response, you have the right to lodge a complaint with Kenya’s Office of the Data Protection Commissioner, or with the relevant supervisory authority in your own country of residence if you are booking from abroad.

12. Children’s Privacy

Our website and booking services are intended for use by adults arranging travel, including family safaris that include children as travellers within a booking made by a parent or guardian. We do not knowingly collect personal data directly from children, and any information about a minor travelling with your group — such as their name, age, or dietary requirements — is provided by the adult making the booking on their behalf, for the sole purpose of arranging that trip safely and appropriately.

If you believe a child has independently submitted personal information to us without appropriate parental involvement, please contact us and we will take steps to remove it.

13. Marketing Communications

If you’ve opted in to hear from us — typically by subscribing through our website or ticking a consent box during an enquiry — we may send you periodic emails covering seasonal travel advice, new itineraries, limited-time offers, or content from our travel guide. We do not share your email address with unrelated third parties for their own marketing purposes.

Every marketing email we send includes a clear unsubscribe link, and you can also ask us directly to stop at any time via our contact page. Opting out of marketing communications does not affect essential, transactional messages related to a trip you’ve actually booked with us, such as itinerary confirmations or pre-departure logistics, which we will continue to send as necessary to deliver your trip.

14. Links to Third-Party Websites

Our site links out to various third parties, including partner lodges, airlines, and the payment processors used during checkout, as well as informational sources referenced across pages like our eTA and visa guide. Once you leave our site via one of these links, this Privacy Policy no longer applies. We encourage you to review the privacy policy of any third-party site before submitting personal information to it, since we have no control over, and accept no responsibility for, how those separate organisations handle your data.

Frequently Asked Questions About Our Privacy Practices

Do you sell my data to other companies?

No. We do not sell, rent, or trade personal data to third parties for their own independent marketing purposes. The only sharing that happens is what’s genuinely necessary to deliver the trip you’ve booked — passing your name and dates to a lodge featured on our Masai Mara or Diani Beach pages, for example, so they can prepare your room, or sharing passenger weights with a charter operator ahead of a bush flight. Beyond service delivery and the legal obligations described above, your data stays with us.

What happens to my data if my trip doesn’t go ahead?

If you enquire, receive a quote, and then decide not to travel — whether your plans change, your budget shifts, or you book with someone else — we retain your enquiry details for a limited period in case you’d like to pick the conversation back up later, after which the record is deleted in line with the retention schedule described above. You’re welcome to ask us to delete it sooner at any point.

Will you contact me after my trip has ended?

We may send a short post-trip message asking about your experience, partly because genuine feedback helps us improve, and partly because reviews shared on our testimonials page are one of the most useful things for future travellers deciding whether to book with us. We will always ask separately before publishing anything you share, and you’re free to decline both the request and any future contact.

Do you use my information to train AI or automated systems?

We do not use client personal data — names, passport details, payment information, or private trip communications — to train third-party artificial intelligence models. Where we use software tools that incorporate AI, such as for drafting general content or internal efficiency, personal client data is not fed into those systems as training material.

Can I see exactly what data you hold about me?

Yes. This is one of the rights described in Section 11 above, and it’s a request we take seriously rather than treat as a formality. Once we’ve verified your identity, we will provide a copy of the personal data we hold about you in a clear, accessible format within a reasonable timeframe.

What if I booked through a travel agent rather than directly?

If you booked one of our itineraries through an independent travel agent or tour operator rather than contacting us directly, that agent is typically the data controller for the information they collected from you, and their own privacy policy governs that relationship. We act as a processor of the trip-specific details they pass to us — names, dates, and requirements — solely for the purpose of arranging the trip itself.

A Note on How Seriously We Take This

Running a travel business built on repeat referrals and long-term relationships means trust is not an abstract value for us — it’s the thing our entire business depends on. Every traveller who shares a passport number, a home address, or a child’s dietary allergy with us is trusting that we’ll treat it with the same care we’d want shown to our own family’s information. We try to hold ourselves to that standard in practice, not just in this document, and we welcome being asked to explain any part of how we handle your data, at any stage of your relationship with us — before you’ve booked, during your trip, or long after you’ve returned home.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or applicable law. Where changes are material — for example, a new category of third party we share data with — we will take reasonable steps to make that change clear, such as a notice on this page or a direct email to affected subscribers, rather than relying solely on a quiet update to the “last updated” date at the top of this page. We’d encourage you to revisit this page periodically, particularly before submitting new personal information to us.

16. How to Contact Us

If you have a question about this Privacy Policy, want to exercise any of the rights described above, or simply want to understand how a specific piece of information you’ve shared with us is being used, our team is genuinely happy to talk it through — this isn’t a topic we treat as an inconvenience. The fastest way to reach us is through our contact page, where you’ll find our current email address, phone number, and WhatsApp details. For general questions about how we operate as a company, our About page has further background, and our FAQ covers many of the practical questions travellers ask before booking.

This Privacy Policy should be read alongside our Booking Conditions, which govern the specifics of confirmed trips, and our Terms & Conditions, which govern general use of our website. Together, these three documents set out the full relationship between Sun & Safari and the travellers we work with.