Privacy Policy
This page describes what we actually collect and do today. It is a draft: Bush King Safaris' own legal counsel will review it before it is final, and the registration details below are placeholders pending that review.
What we collect (draft)
Enquiry and contact details
When you contact us, request a plan, or fill in the Trip Builder or Plan For Me forms, we collect what you give us: your name, email address, phone or WhatsApp number, and the trip details you enter (destinations, dates, party size, budget range, preferences).
Trip-planning behaviour, no name attached
If you start building a trip but do not finish, we record an anonymous count of how far you got (adults, children's ages, residency, and the stops you had added), so we can see where the tool loses people and improve it. This is never linked to a name, email, or any other identifying detail.
Cookies and analytics
See the separate cookie policy for the full, accurate list of what is set and when. In short: essential cookies run always, analytics and marketing cookies only run if you accept them in the consent banner.
Why we use it (draft)
To respond to your enquiry and put together the trip estimate or itinerary you asked for.
To generate quotes, invoices, and receipts if you go ahead and book with us.
To improve the Trip Builder and Plan For Me tools, using the anonymous drop-off counts described above.
To measure how people use the site and how our marketing performs, only for visitors who accept analytics or marketing cookies.
Legal basis (draft)
Consent: for analytics and marketing cookies, and for the enquiry details you choose to give us.
Contract: to prepare and administer a quote, invoice, or booking once you ask us to.
Legitimate interest: for the anonymous, no-PII trip-planning drop-off count described above, and for keeping the site secure (Cloudflare Turnstile).
How long we keep it (draft)
We keep enquiry and booking records for as long as needed to provide the service you asked for and to meet our own accounting and legal obligations, then delete or anonymise them. Anonymous drop-off counts carry no personal data to delete in the first place.
Who we share it with (draft)
Supabase: database and file storage for enquiries, itineraries, quotes, and media. (hosting region as configured on our Supabase project.)
Vercel: hosting and delivering this website. (global edge network, primary compute region as configured on our Vercel project.)
Resend: sending transactional email (itinerary copies, staff notifications). (as documented in Resend's own privacy policy.)
HubSpot: our sales CRM, once an enquiry is ready to follow up on. (as documented in HubSpot's own privacy policy.)
Cloudflare (Turnstile): keeping our forms free of automated abuse, without tracking you. (as documented in Cloudflare's own privacy policy.)
Upstash: rate-limiting our forms against abuse. (as documented in Upstash's own privacy policy.)
Sentry: catching and fixing errors on this site. We deliberately do not capture local variables in error reports, to avoid catching personal data by accident. (as documented in Sentry's own privacy policy.)
Your rights (draft)
Under Kenya's Data Protection Act 2019, and under GDPR if you are visiting from the European Economic Area or the UK, you have the right to ask what personal data we hold about you, to correct it, to ask us to delete it, and to object to how we use it. To exercise any of these rights, contact us at bushkingsafaris@gmail.com.
If you are not satisfied with how we have handled your request, you can complain to Kenya's Office of the Data Protection Commissioner.
[Bush King Safaris Limited: ODPC registration number and Data Protection Officer contact to be added here once confirmed.]