Privacy policy

Last updated 2026-10-17

1. Who is responsible for your data

The data controller is Amboseli National Park Safaris, a tour operator based in Nairobi, Kenya. You can contact us on WhatsApp or by phone on +254 725 431 452, or by email at bookings@amboselinationalparksafari.com. We process personal data in line with the Data Protection Act, 2019 of Kenya and its regulations. Because we are a small business, there is no separate data protection officer. Privacy questions go to the email address above.

2. What we collect and how

We only collect what you choose to give us, or what a booking needs. This is how it reaches us.

• WhatsApp. When you message us on WhatsApp, we see your phone number, your WhatsApp profile name and photo (if you show them) and everything you write or send, including photos and documents.
• Phone calls. If you call, we see your number and note what you tell us. We do not record calls.
• Email. If you email us, we receive your email address, your name and the content of your message and attachments.
• The Plan My Safari form. This website has no backend. The form does not send anything to us, and nothing you type into it is stored by the website. When you press the button, it builds a message in your browser and opens WhatsApp so that you can read it, change it and decide whether to send it. We receive it only if you send it.

Depending on your booking, the personal data we hold may include:

• names, phone numbers, email addresses and the country you live in;
• travel dates, group size, the ages of children, interests and room preferences;
• passport details (full name, nationality, passport number, date of birth and expiry date), only when a park, lodge, airline or the authorities need them;
• dietary, allergy, medical and mobility information that you choose to tell us. This is sensitive personal data, and we use it only with your consent;
• payment records, such as an M-Pesa confirmation message, a bank transfer reference or a card payment receipt. We do not see or store your full card number. Card payments, where offered, are handled by the payment provider;
• your messages about your trip, feedback and complaints.

3. Why we use your data

We use personal data to plan and run your safari, to reply to you, to take payment, to meet our legal duties and to handle complaints. We do not use it for advertising, we do not sell it, and we do not make decisions about you by automated means or profile you.

If we ever want to use your details for something else, such as sending offers, we will ask first. You can say no at any time without any effect on your booking.

4. Who we share it with

We share only what is needed, and only with those who need it to deliver your trip:

• lodges and camps where you stay, and airlines or air charter companies for fly-in trips, which need names and sometimes passport details;
• our own drivers and guides, who see names, pick-up details and any health or dietary needs relevant to your safety;
• the Kenya Wildlife Service and other park or conservancy authorities, for entry permits and fees;
• payment providers and banks, such as mobile money, bank and card services, to take and refund payments;
• our accountant and professional advisers, and our email, phone and web hosting providers, who handle data for us under confidentiality duties;
• the police, courts, tax or other authorities, if the law requires it or to protect safety.

Each lodge, airline and authority is responsible for how it uses the data we pass to it, under its own privacy terms.

5. Sending data outside Kenya

Some of the services we use are run from other countries, so your data may leave Kenya:

• WhatsApp. WhatsApp is run by Meta. Messages are protected by end-to-end encryption in transit, but Meta processes some information about your use of the service, such as your phone number and device data, on servers in other countries, under its own privacy policy.
• Google Fonts and Google Maps. When you open our pages, your browser fetches fonts from Google. The Contact page also shows a Google map. Google receives your IP address and browser details and processes them outside Kenya, under its own policies. Details are in section 6.
• Suppliers and guests abroad. If you live outside Kenya, your data travels to us in Kenya. If a lodge, airline or provider is based abroad, we send it only what the booking needs.

Where the Data Protection Act, 2019 requires safeguards for transfers out of Kenya, we rely on the transfer being necessary to carry out our contract with you, on your consent, or on the provider's own legal safeguards. You can ask us for more detail.

6. Cookies, fonts, maps and server logs

This website sets no cookies of its own and uses no analytics, advertising pixels, social media trackers or live chat tools. It does not keep any account or login. These are the only third-party services the pages load:

• Google Fonts (every page). The fonts are fetched from Google's servers. Google receives your IP address, your browser type and the page you are on. According to Google, font requests do not set cookies.
• Google Maps (Contact page only). An embedded map loads when you scroll to it. Google may set cookies or similar technologies there and process your data under its own policies. You can avoid it by not opening the Contact page, or by blocking third-party content in your browser.
• WhatsApp links. Our WhatsApp buttons open WhatsApp, in the app or in a browser tab. From that point, WhatsApp's own privacy terms apply.
• Hosting. Our web host keeps routine server logs of visits (IP address, date and time, pages requested and browser type) for security and fault-finding. We do not use them to identify you.

You can block or delete cookies in your browser settings at any time. The site works without them.

7. How long we keep it

• Enquiries that do not become bookings: deleted 12 months after the last message.
• Booking and payment records: kept for five years after your trip, because Kenyan tax and accounting rules require it.
• Passport details: deleted from our chats and files 12 months after your trip, unless we need them as part of a financial record.
• Health, dietary and mobility notes: deleted three months after your trip.
• Complaints: kept until the matter is closed and any claim period has ended.

If a longer period is needed to meet a legal duty or to deal with a claim, we keep the data for that time and no longer.

8. How we protect it

We limit access to the people who need your data, protect our phones, WhatsApp and email accounts with screen locks and two-step verification where available, and share documents only with suppliers who need them. No system is perfectly secure, so please do not send card numbers, PINs or passwords over WhatsApp or email. If a breach is likely to harm you, we will tell you and the Office of the Data Protection Commissioner without undue delay, as the law requires.

9. Your rights

Under the Data Protection Act, 2019, you have the right to:

• be told how your data is used (this policy does that);
• ask for a copy of the personal data we hold about you;
• object to our processing of your data;
• have false or misleading data corrected;
• have data deleted, where we have no lawful reason to keep it;
• receive your data in a common electronic format, and withdraw your consent at any time where we rely on it.

To use any of these rights, message us on WhatsApp or email bookings@amboselinationalparksafari.com. We may ask you to confirm who you are before we release or change anything. We answer as quickly as we can and within the time the law allows. There is no charge for a reasonable request. Some records, such as accounts, we must keep by law even if you ask us to delete them, and we will explain this if it applies.

10. Children

We collect information about children, such as names, ages and passport details, only from the parent or guardian making the booking, and only for the trip. We do not knowingly collect data directly from children through this website.

11. If you are not happy

Please tell us first, so we can put it right. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC), the Kenyan regulator, under section 56 of the Data Protection Act, 2019. The ODPC is at Britam Tower, Hospital Road, Upper Hill, Nairobi (P.O. Box 30920-00100 GPO Nairobi). Email info@odpc.go.ke or call 0207801800. Its complaints form is on its website, odpc.go.ke.

12. Changes to this policy

If we change how we use personal data, we will update this page and the date at the top. We show the date of the latest version so that you can see what has changed.

13. Contact

Amboseli National Park Safaris, Nairobi, Kenya. WhatsApp or call +254 725 431 452. Email bookings@amboselinationalparksafari.com.