Our Commitment to You

1. We hold your personal data securely and process it lawfully.
2. We share your data only where necessary or with your agreement.
3. We use your data to arrange your travel and improve our services.
4. We give you control; you may access, correct, restrict, or request deletion of your data.
5. We comply with the Data Protection Act, 2019 (Kenya), its subsidiary regulations, and, where applicable, other data protection laws governing guests travelling from outside Kenya.

1. Who We Are

This Privacy Policy explains how Saruni Basecamp (“Saruni Basecamp,” “we,” “us,” “our”), of P.O. Box 43369–00100, Karen, Nairobi, Kenya, collect, use, disclose, transfer, and store personal data.

We are the data controller for personal data collected through our website www.sarunibasecamp.com, our reservations channels, and during your stay at our camps and lodges.

If you make a booking or enquiry on behalf of another person, you confirm that you have their permission to share their personal data with us and that you have brought this Privacy Policy to their attention. By making a booking or enquiry, you consent to the processing described in this Policy. If you do not agree with this Policy, please do not submit your data to us or use this website.

2. Key Terms

In line with the Data Protection Act, 2019 (“the Act”):

1. “Personal data” means any information relating to an identified or identifiable natural person.
2. “Sensitive personal data” means data revealing a person’s race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details including names of children, parents, spouse(s), sex, or sexual orientation.
3. “Data subject” means the individual to whom personal data relates (you, or a person you are booking for).
4. “Processing” means any operation performed on personal data, including collection, storage, use, disclosure, or erasure.
5. “Data controller” means Saruni Basecamp, as the entity determining the purpose and means of processing.
6. “Data processor” means any third party that processes personal data on our behalf.

3. Personal Data We Collect

We collect:

1. Identity and contact details — name, address, email, phone number, date of birth, nationality, and passport or national ID details (including where required to meet Advance Passenger Information requirements of destination or transit countries);
2. Booking and travel details – itinerary, accommodation, activity, and transport preferences;
3. Communications – records of enquiries, correspondence, and feedback you send us;
4. Technical and website usage data – IP address, device identifiers, browser type, and browsing behavior on our website (see Section 11, Cookies).

Sensitive Personal Data

Where necessary to deliver your safari or lodge experience, we may collect sensitive personal data, such as:

• health conditions, disabilities, or medical requirements relevant to your stay or activities;
• dietary requirements that may indicate religious or cultural beliefs.

We collect sensitive personal data only where necessary, and only with your explicit consent, in accordance with Section 44 of the Act. You may withdraw this consent at any time, though this may limit our ability to accommodate certain requests.

Children’s Data

Where a booking includes a child traveler, we collect the child’s personal data from the parent, guardian, or the adult making the booking, who confirms they hold the authority to provide it on the child’s behalf, in accordance with Section 33 of the Act

4. Why We Process Your Personal Data and Our Lawful Basis

Under Section 30 of the Act, we rely on the following lawful bases to process your personal data:

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

5. How We Use Your Personal Data

We use your personal data to:

1. Process your booking and send you confirmations, itineraries, and travel updates (including delays, cancellations, or changes);
2. Coordinate with airlines, ground transport operators, lodges, and activity providers on your behalf;
3. Process payments, refunds, and manage accounting and audit requirements;
4. Communicate with you before, during, and after your trip;
5. Respond to compliments, complaints, or service queries;
6. Improve our products, services, and guest experience;
7. Market our products and services to you, where you have consented; and
8. Meet our legal, regulatory, and compliance obligations, including responding to lawful requests from courts, regulators, or government authorities.

6. Personal Data We Receive from Third Parties

We may receive your personal data from a travel agent, tour operator, travel companion, or another individual booking on your behalf, from promotional partners, or through social media and referral programmes. Where a third party refers you to us, we require confirmation that you have agreed to be contacted.

7. Sharing Your Personal Data

We share personal data only where necessary, and always subject to confidentiality and data protection obligations. We share data with:

1. Service providers who support our operations- IT and hosting providers, payment processors, booking platforms, and fraud/security vendors bound by written confidentiality and data processing terms;
2. Travel and hospitality partners airlines, tour operators, hotels, camps, transfer and car hire companies, and activity providers involved in delivering your trip;
3. Payment providers and banks, to process and authorised payments;
4. Government authorities, immigration and border control agencies, and regulators, where required by law, including Advance Passenger Information and related border-security obligations; and
5. Your travel agent, where relevant to resolving a booking issue.

Every third party that processes personal data on our behalf is contractually required to implement safeguards no less protective than those set out in this Policy and the Act.

8. International Transfer of Personal Data

Arranging safaris across East Africa and hosting international guests means your personal data may be transferred to, and processed in, countries outside Kenya, including countries whose data protection standards differ from Kenya’s.

In accordance with Section 48 of the Act and the Data Protection (General) Regulations, 2021, we transfer personal data outside Kenya only where at least one of the following applies:

1. The recipient country has been confirmed by the Data Commissioner as having appropriate data protection safeguards;
2. We have put in place a contract or other binding instrument with the recipient that ensures a level of protection consistent with the Act; or
3. You have given your explicit consent to the transfer, after being informed of the possible risks.

15. You may request further information about the safeguards applied to a specific transfer by contacting us using the details in Section 15.

9. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, in line with the data minimisation and storage limitation principles under Section 25 of the Act.

1. Booking-related personal data is generally retained for 7 years after collection, to meet accounting, tax, and legal requirements.
2. Where no booking results from an enquiry, personal data is retained for no more than 12 months.
3. We may retain personal data for longer where required by law, or where necessary to establish, exercise, or defend a legal claim.

Data no longer required is securely destroyed or anonymized.

10. How We Protect Your Personal Data

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or destruction, including:

1. access controls limiting personal data to staff and service providers who need it to perform their roles;
2. confidentiality obligations placed on staff, contractors, and service providers;
3. secure storage and transmission safeguards.

In the event of a security compromise affecting your personal data, we will notify the Office of the Data Protection Commissioner and affected data subjects in accordance with Section 43 of the Act.

11. Cookies and Website Analytics

Cookies are small files of information that a website places on a device. We may store cookies on your device when you visit our Website to enable us to recognize you during subsequent visits.

We may also use this data in aggregate form to develop customized services which are tailored to your individual interests and needs. Should you choose to do so, it is possible (depending on the browser you are using), to be prompted before accepting any cookies, or to prevent your browser from accepting any cookies at all.

11.1 What Cookies We Use

11.2 Cookie Expiry

Cookies set through our website expire and are automatically deleted from your device no later than 12 months from the date they are set, unless you clear them from your browser sooner. We periodically review our cookies to ensure none are retained longer than necessary for the purpose for which they were set.

11.3 Managing Your Cookie Preferences

You can manage, block, or delete cookies at any time through your browser settings. Disabling strictly necessary cookies may affect core website functions, such as completing a booking; disabling functional, analytics, or marketing cookies will not affect your ability to use the website but may make your experience less tailored to you.

11.4 Social Media Plug-ins

Where you interact with social media plug-ins on our website (for example, “Like” or “Share” buttons), your activity may be sent back to and made visible on those platforms, subject to your privacy settings on them.

12. Marketing Communications

We send marketing communications only where you have given your consent, in accordance with your stated preferences. You may withdraw consent at any time by:

1. Clicking “unsubscribe” on any marketing email you receive from us; or
2. Contacting us at marketing@sarunibasecamp.com.

Withdrawing marketing consent does not affect operational communications relating to an active booking or enquiry.

13. Your Rights Under the Data Protection Act, 2019

As a data subject, you have the right to:

1. Be informed of the use to which your personal data is to be put;
2. Access your personal data held by us, including the source of the data, the purpose and legal basis for processing, and any third parties to whom it has been disclosed;
3. Request correction or rectification of inaccurate or misleading personal data;
4. Request deletion or destruction of personal data that is no longer authorised to be retained, subject to Section 40 of the Act;
5. Object to the processing of your personal data, in whole or in part, including for direct marketing;
6. Restrict processing of your personal data in specific circumstances (for example, while accuracy is contested);
7. Data portability, where technically feasible; and
8. Not be subject to a decision based solely on automated processing, including profiling, that significantly affects you, without human intervention.

We may not always be able to fully honour a request for example, where doing so would breach a duty of confidentiality to another person, or where we are legally entitled to handle the request differently. Where this applies, we will explain our reasoning.

To exercise any of these rights, contact us using the details in Section 15. We may request additional information to verify your identity. We aim to respond within 30 days or inform you if we require more time.

14. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at privacy@sarunibasecamp.com so we can address your concern directly.

15. Contact Us

For any questions about this Privacy Policy or how we handle your personal data, contact:

Old Boma Ltd. & Basecamp Masai Mara Ltd. T/A Saruni Basecamp

P.O. Box 43369–00100, Karen, Nairobi, Kenya

+254 715 487 115

Email: privacy@sarunibasecamp.com

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The date at the top of this page shows when it was last updated. We encourage you to review this Policy periodically.