Legal
Privacy Policy
This policy explains what personal data Bookara Tours and Safaris Ltd ("Bookara", "we") collects when you use www.bookaratours.com, message us, or book a trip, why we need it, who we share it with, and the rights you have. We follow Kenya's Data Protection Act, 2019 and, for travellers in the UK and EU, the UK and EU GDPR.
1. Who we are
Bookara Tours and Safaris Ltd (company no. PVT-KW192OWZ), Tumaini House, Room 304, Moi Avenue, Nairobi, Kenya, is the data controller for the personal data described here. Questions about privacy: hello@bookaratours.com.
2. What we collect and why
| What | Why | Legal basis |
|---|---|---|
| Enquiries: name, email, phone/WhatsApp number, trip preferences and anything you write to us (trip planner, WhatsApp, email) | To plan and price your trip and reply to you | Steps you ask us to take before a contract |
| Bookings: lead traveller's contact details, names of everyone travelling, children's ages, flight and pickup details | To book lodges, park entry and transfers, and run your trip | Performance of our contract with you |
| Passport numbers (optional, added after booking) | Some park entry permits and lodge registers require them | Contract, and legal requirements in Kenya |
| Dietary, medical or accessibility notes you choose to share | So lodges and your guide can look after you safely | Your explicit consent (you can withdraw it) |
| Payment references from Paystack. We never see or store your full card number | To record your payment and issue refunds | Contract and legal (tax) obligations |
| Newsletter: your email address | To send our Kenya planning emails | Your consent |
| Website usage: pages visited, device type and approximate country, collected without cookies by Plausible | To understand which pages help people | Our legitimate interest in improving the site |
| Advertising cookies (Google Ads), only if you accept them | To measure whether our adverts lead to enquiries | Your consent, via the cookie banner |
We don't ask for more than we need. Fields marked optional really are optional.
3. Who we share it with
We share only what each party needs to do its part. We never sell personal data.
- Lodges, camps, airlines and transport partners in Kenya: names, dates, and any notes relevant to your stay.
- Paystack: card payments.
- Brevo: booking emails and, if you subscribe, our newsletter.
- Supabase (database) and Vercel (website hosting): where our systems run.
- Meta (WhatsApp Business): when you message us on WhatsApp.
- AI assistance for WhatsApp: our WhatsApp line can use an AI service (OpenAI or NVIDIA) to understand messages and draft replies. The text of your messages is sent to that service to do this.
- Plausible Analytics: cookieless website statistics.
- Google: advertising measurement, only if you accept cookies.
- Our accountants and lawyers, and authorities where the law requires it.
4. International transfers
Some of these providers store data outside Kenya, in the EU, UK or US. Where that happens we rely on the provider's contractual safeguards (such as standard contractual clauses) so your data stays protected to the standard required by Kenyan and UK/EU law.
5. How long we keep it
- Bookings and payments: 7 years after your trip, to meet Kenyan tax and accounting rules.
- Enquiries that don't become bookings: up to 24 months, then deleted.
- Passport numbers and medical notes: deleted 90 days after your trip ends.
- Newsletter: until you unsubscribe.
6. Keeping it safe
Data is sent over encrypted connections, access to our booking system is limited to the people who run your trip, and card details are handled only by Paystack.
7. Children
Our website and services are aimed at adults. Bookings must be made by someone aged 18 or over. If you're travelling with children, you (as their parent or guardian) give us only the details we need for the trip, such as their names and ages. We don't knowingly collect data directly from anyone under 18, and we don't send marketing to children.
8. Your rights
You can ask us to:
- show you the personal data we hold about you, and give you a copy;
- correct anything that's wrong;
- delete your data, unless we have to keep it by law (for example, booking and tax records);
- stop or limit how we use it, or object to it;
- withdraw consent (for the newsletter, cookies or medical notes) at any time.
Use our data request form or email hello@bookaratours.com. We'll reply within 30 days. If you're not happy with how we handle your data, you can complain to Kenya's Office of the Data Protection Commissioner or, in the UK, the Information Commissioner's Office.
9. Marketing emails
We only send our newsletter if you sign up for it. Every newsletter has an unsubscribe link, and you can also reply to any email or message us to stop. Booking emails (confirmations, receipts, reminders) are part of your booking and aren't marketing.
10. Cookies
See our Cookie Policy for exactly what's stored on your device and how to change your choice.
11. Changes
If we change this policy we'll update the date at the top. Significant changes will be explained on this page.