Privacy Policy

1. Who we are and how to reach us

The data controller responsible for your personal information is:

• Geob Ventures, a safari tour operator established in 2013 and based in Nairobi, Kenya.
• Email: safaris@geob.co.ke · Phone and WhatsApp: +254 728 136 167

For anything about your personal information, including the rights in section 13, contact our data protection lead at safaris@geob.co.ke with the subject "Data request", or write to us at the address above.

2. What this policy covers

This policy covers personal information we handle when you use geob.co.ke, enquire or book with us by email, WhatsApp, phone or social media, travel with us, or sign up for our newsletter. It follows Kenya's Data Protection Act, 2019 and its regulations, and, for travellers in the European Union and the United Kingdom, the EU General Data Protection Regulation and the UK GDPR. Lodges, airlines and other suppliers that host you on your trip are responsible for the information they hold under their own privacy policies.

3. What we collect

Information you give us

• Enquiries and trip planning: your name, email address, phone or WhatsApp number, country of residence, preferred contact method, travel dates and flexibility, number of travellers and age ranges, children's ages, budget, interests, and anything you write in your message, including through the Safari Planner, the contact form and our Roho assistant.
• Bookings: full names as in passports, dates of birth, nationality, passport numbers and expiry dates (required for gorilla and chimpanzee permits, park entry, light-aircraft manifests and some lodges), arrival and departure flight details, room and bed arrangements, emergency contact, travel insurance details, and dietary, medical or mobility needs you choose to tell us about.
• Payments: invoices, the amount and date paid, and payment confirmations from our bank or payment provider. Card and M-Pesa payments are handled by IntaSend; we never see or store your full card number or PIN.
• Accounts and reviews: if you create an account, your login details, saved safaris, wishlists and preferences; reviews and photos you send us.
• Communications: emails, WhatsApp messages, call notes and feedback.

Information collected automatically

• Technical data: your IP address, browser and device type, pages viewed and the time of your visit, recorded in our server logs for security.
• Campaign source: if you arrive from an advert or tagged link, which campaign it was (for example "facebook / safari-honeymoon") and the page you landed on, so we can see which adverts lead to enquiries.
• Cookies and similar technologies: see section 10 and our Cookie Policy. Analytics and advertising cookies are used only with your consent.

Information from others

• The lead traveller often gives us details for everyone in a group. If you do, please make sure your companions know and agree, and show them this policy. We also send each traveller whose email we hold a link to this policy, within 14 days of receiving their details.
• Travel agents and partners who refer you to us, suppliers during your trip (for example a lodge reporting a change), and our payment provider confirming a payment.
• Social media and advertising platforms when you message us or respond to one of our adverts.

4. Why we use it and our legal basis

Data protection law requires a lawful basis for each use. Ours are:

Where we rely on legitimate interests, we have weighed them against your rights, and you can object (section 13).

5. Health details, family details and children

Under the Data Protection Act, health information and family details (such as the names of your children, spouse or parents travelling with you) are sensitive personal data. We use them only with your consent, which you give when you send them to us for your booking, and only to arrange and run your trip. Where they must go to a lodge, guide or ground handler in another country, we send them only with your consent and with the safeguards described in section 7.

Health and mobility information in particular: We ask for it only when it matters to your safety or comfort (for example allergies, mobility needs or a medical condition your guide should know about), we use it only for that purpose, and we share it only with the people who need it to look after you, such as your guide, the lodge or the flight operator. Giving it is your choice; you can withdraw consent, though we may then be unable to make suitable arrangements.

Children: our website and accounts are for adults. We collect children's names, dates of birth and passport details only from a parent or guardian, for a booking that includes them, and use them only to arrange and run that trip, in the child's best interests as Section 33 of the Data Protection Act requires.

6. Who we share it with

We share only what each recipient needs. We do not sell or rent personal information, and we do not let others use it for their own marketing.

• Suppliers that deliver your trip: lodges and camps, transport and guiding partners, airlines and light-aircraft operators, balloon and activity operators, and our partner ground handlers in Tanzania, Uganda and Rwanda.
• Park and permit authorities: for example the Kenya Wildlife Service and conservancies, Tanzania National Parks and the Ngorongoro Conservation Area Authority, the Uganda Wildlife Authority and the Rwanda Development Board, which require passport details to issue permits and entry.
• Payment providers and banks: IntaSend (card and M-Pesa) and our bank, to process payments and refunds.
• Our technology providers, who process data only on our instructions and under confidentiality:
  • Pinch Africa Ltd (Nairobi), which builds and runs our website, enquiry records and customer relationship (CRM) system;
  • Hetzner Online GmbH, which hosts our website, email and CRM servers in Germany;
  • Google, for website analytics (with consent), the Gemini AI service behind Roho and our planning tools, website translation (when you choose a language) and maps;
  • Microsoft and WhatsApp (Meta), which carry the emails and messages we exchange with you.
• Meta (Facebook and Instagram), with your consent only: when you send an enquiry and have accepted optional cookies, Meta receives that an enquiry was made, the page it came from, and your email address, phone number and name in hashed (scrambled) form, so it can tell us which adverts work and show them to people likely to be interested. We never send Meta your messages or trip details.
• Insurers, lawyers, auditors and advisers where needed for a claim, audit or legal advice.
• Authorities when the law requires it, for example immigration, tax or law-enforcement requests, or to protect someone's life in an emergency.
• A buyer or successor if our business is sold or reorganised, under the same protections.

7. Transfers outside Kenya

A safari across East Africa means some information must leave Kenya. We transfer personal information only as the Data Protection Act (sections 48 to 50) and its regulations allow:

• to suppliers and authorities in Tanzania, Uganda and Rwanda when your itinerary includes them, because the transfer is necessary to perform your contract;
• to Germany (our hosting provider), where the GDPR gives protection at least equal to Kenyan law;
• to Google, Microsoft and Meta, which may process data in the United States and elsewhere, under their data processing terms and standard contractual clauses.

Sensitive personal data (section 5) is sent abroad only with your consent and with these safeguards. We keep a record of transfers made under safeguards, as the Data Protection (General) Regulations, 2021 require, and you can ask us for more detail about the safeguards for a particular transfer.

8. AI tools and automated decisions

Roho and our Safari Lab tools send the questions you type to our AI provider (Google Gemini) to produce answers, and we keep the conversation so our team can follow up if you ask. Please don't include sensitive details. We don't make decisions that have legal or similarly significant effects on you by automated means alone: every quote, booking and refund is handled by a person. If you have accepted cookies, advertising platforms may use the hashed data in section 6 to decide which people see our adverts; you can refuse or withdraw that consent at any time.

9. Marketing messages

We send newsletters and offers only if you have signed up or asked for them. Every email has an unsubscribe link, and you can also reply "STOP" or tell us on WhatsApp. Messages about a booking you made (confirmations, documents, changes, safety information) are not marketing and will still be sent.

10. Cookies and similar technologies

We use essential cookies to run the site, preference storage to remember your choices, and, only if you agree, analytics and advertising cookies. Our Cookie Policy lists every one and lets you change your choice.

11. How long we keep it

After these periods we delete information or anonymise it so it no longer identifies you.

12. How we protect it

• The website, forms and payment links use encrypted (https) connections, and card payments run on our payment provider's secure pages.
• Access to personal information is limited to the team members and processors who need it, through password-protected accounts.
• Our servers are protected by a firewall and malware scanning and are kept up to date.
• Data sent for advert measurement is hashed first, and we share only what each supplier needs.
• Our technology providers are bound by written confidentiality and data processing terms.

No system is perfectly secure. If a personal data breach is likely to put you at risk, we will tell you without undue delay and notify the Office of the Data Protection Commissioner within 72 hours, as the law requires.

13. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be informed about how your information is used, which is the purpose of this policy;
• access the personal information we hold about you;
• correct information that is wrong or incomplete;
• delete information we no longer need or are not allowed to keep;
• object to processing based on legitimate interests, and to direct marketing at any time;
• restrict our use of your information while a concern is checked;
• data portability: receive the information you gave us in a common electronic format, or have it sent to another company;
• withdraw consent at any time, without affecting what we did before;
• not be subject to a decision based solely on automated processing that significantly affects you.

To use any of these rights, email safaris@geob.co.ke with the subject "Data request", or tell us in writing another way. We may ask you to confirm your identity. A parent or guardian may make a request for a child. Requests are free, except that we may charge the reasonable cost of providing data in a portable format. We respond within the times set by the Data Protection (General) Regulations, 2021:

If we can't do what you ask, for example because invoices must be kept for tax, we will explain why in writing. Section 17 explains where to complain if you are not satisfied.

14. Travellers in the EU and UK

If you are in the European Union or the United Kingdom, the GDPR or UK GDPR may also apply when we offer you our safaris. You have the rights described above, including the right to complain to the data protection authority where you live or work. Contact us directly at the address in section 1 for anything about your information.

15. What you must give us, and why

Giving us information is voluntary, but some of it is needed for what you ask us to do. Without a name and an email address or phone number we cannot reply to your enquiry. Without full passport names, nationality, dates of birth and passport numbers we cannot buy park entry, gorilla or chimpanzee permits, or light-aircraft seats, so we may be unable to confirm your booking. Some details, such as passport information for permits and park entry, are required by the laws and rules of the countries you will visit.

16. Changes to this policy

We update this policy when our services or the law change; the date at the top shows the latest version. If a change significantly affects how we use information you have already given us, we will tell you by email before it takes effect.

17. Questions and complaints

Please talk to us first at safaris@geob.co.ke; we will try to put things right quickly. You also have the right to complain to Kenya's data protection regulator:

• Office of the Data Protection Commissioner (ODPC), Britam Tower, 12th Floor, Hospital Road, Upper Hill, Nairobi · P.O. Box 30920-00100, Nairobi
• Phone 020 780 1800 · Email info@odpc.go.ke
• Online complaint form: www.odpc.go.ke/file-a-complaint