Privacy Policy

1. Who we are

The data controller is Crimson Brooke Safaris, Nairobi, Kenya, trading via www.crimsonbrooke.com. In this policy, “we”, “us” and “our” mean Crimson Brooke Safaris.

2. Personal information we collect

Depending on how you interact with us, we may collect:

• enquiry form information, including your name, email address, phone number, travel dates, number of travellers and country of origin;
• WhatsApp conversations and contact details;
• other correspondence you send to us or that we send to you; and
• booking and payment details when you decide to make a booking.

We may also receive technical information, such as cookie identifiers, browser information and website usage data, through analytics, advertising and similar tools described below.

3. How we collect information

We collect information through:

• enquiry forms on our website;
• our WhatsApp Business number, +254 112 427879;
• Facebook and Instagram advertising, including click-to-WhatsApp adverts and lead forms; and
• email and other correspondence.

4. How we use personal information

We use personal information to:

• respond to enquiries and requests for information;
• prepare and send safari quotations and proposals;
• arrange and deliver safari bookings;
• take and administer payments;
• send service and booking communications; and
• send marketing communications only where we have the required consent or another lawful permission.

5. Legal bases for processing

We process personal information on one or more of these legal bases:

• Consent: where you choose to receive marketing or submit information for a stated purpose;
• Performance of a contract: where processing is needed to prepare for or provide a safari booking;
• Legitimate interests: where it is reasonable and necessary to operate our business, respond to visitors and improve our services, while respecting your rights; and
• Legal obligation: where we must keep records or provide information to comply with applicable law.

6. Who we share information with

We share personal information only when needed for the purposes in this policy, to provide the services you request, or to comply with the law. This may include:

• Meta Platforms, including Facebook, Instagram and WhatsApp, as our advertising and messaging platform;
• our website hosting provider;
• payment processors;
• local ground handlers;
• lodges and camps;
• airlines used for internal flights; and
• professional advisers, such as accountants or lawyers.

We do not sell your personal information. Service providers may use information only as needed to provide their services to us or to meet their own legal obligations.

7. International transfers

Some service providers, including technology and advertising providers, may process information outside Kenya and outside the European Economic Area (EEA). When we make an international transfer, we take reasonable steps to protect the information, including using reputable providers, contractual confidentiality and data-protection obligations, appropriate transfer safeguards such as approved standard contractual clauses where relevant, access controls and encryption where appropriate. We also consider the laws and risks of the destination and use additional safeguards where needed.

8. How long we keep information

Enquiries that do not become bookings are kept for up to 24 months after our last meaningful interaction, unless we need to keep them longer to handle a complaint, protect our legal interests or comply with the law.

Booking, payment, tax and other financial records are kept for as long as legally required. For Kenyan accounting and tax purposes, this is generally about seven years, unless a longer period is needed for an audit, dispute or legal obligation. When information is no longer needed, we securely delete it or anonymise it where practical.

9. Your data protection rights

Subject to applicable law and any relevant conditions or exemptions, you may ask us to:

• give you access to the personal information we hold about you;
• rectify inaccurate or incomplete information;
• erase information;
• restrict how we process information;
• provide your information in a portable format;
• consider an objection to processing;
• withdraw consent at any time where consent is the basis; and
• explain or review a decision involving your information.

Withdrawing consent does not affect processing that took place before withdrawal. You may complain to the Office of the Data Protection Commissioner (Kenya). If you are a visitor from the United Kingdom, you may also contact the Information Commissioner’s Office (ICO). If you are in the EU/EEA, you may contact the relevant data protection supervisory authority in your country.

10. Cookies and analytics

Our website uses cookies and similar technologies. These include Google Tag Manager, Google Analytics 4 and Google Ads tags, as well as Meta advertising tools. They help us operate the website, understand visits and measure or deliver relevant advertising. Depending on the tool and applicable law, these technologies may collect information such as pages viewed, device details, approximate location and online identifiers.

You can control or delete cookies through your browser settings. Your browser may let you block all cookies, block third-party cookies or notify you before a cookie is stored. Blocking some cookies may affect how the website works. You can also review controls offered by Google and Meta for their advertising and analytics services.

11. Children

Our safari planning and booking services are not directed at children under 18. We do not knowingly collect personal information from a child under 18 without appropriate consent from a parent or guardian. If you believe a child has provided information to us, please contact us so that we can review and delete it where appropriate.

12. Contact us about privacy

For questions, requests or complaints about this policy or our use of your information, contact Crimson Brooke Safaris at info@crimsonbrooke.com or on WhatsApp at +254 112 427879.