Privacy Policy

WildSafari Ltd. ("WildSafari", "we", "our", or "us") is a wildlife conservation park and safari experience company registered in Nairobi, Kenya. We operate the website wildsafari.com and provide on-site safari tours, animal encounters, and conservation education services.

As the data controller, WildSafari is responsible for deciding how and why your personal data is processed. For all privacy matters, our dedicated Data Protection Officer (DPO) can be reached at:

We collect personal data through three channels: information you provide directly, information collected automatically when you use our website, and information received from third-party partners.

We use your personal data only for clearly defined, legitimate purposes. We never use data in ways that are incompatible with the reason it was originally collected.

• Processing & managing your booking — confirming reservations, sending reminders, and coordinating your safari experience.
• Processing payments — handling deposits, final payments, and issuing refunds securely through our payment processor.
• Customer support — responding to enquiries, complaints, and modification requests.
• Safety & operational planning — ensuring tours are appropriately staffed and accessibility needs are met before your visit.
• Legal compliance — meeting obligations under Kenyan data protection law, tax regulations, and safety legislation.
• Marketing communications — sending newsletters and offers only where you have explicitly opted in. You may unsubscribe at any time.
• Website improvement — using aggregated, anonymised analytics to understand how visitors use our site and improve the experience.
• Conservation & education — using anonymised visit data to support wildlife population reporting and conservation planning.

Under the Kenya Data Protection Act (2019) and applicable international data protection laws, we rely on the following legal bases:

We do not sell, rent, or trade your personal data to any third party for commercial purposes — ever. We may share your data only in the following limited, controlled circumstances:

• Payment processors (e.g. Stripe, PayPal) — to securely process your booking payments. These providers are PCI-DSS compliant and process only the minimum data necessary.
• Email service providers — to deliver booking confirmations, reminders, and newsletters. Providers are contractually bound to process your data only on our instructions.
• Analytics platforms — anonymised, aggregated usage data may be processed by tools such as Google Analytics. No personally identifiable data is shared.
• Emergency services — in a medical emergency on-site, relevant personal and health data may be shared with emergency responders to protect your life.
• Regulatory authorities — where required by law, court order, or lawful government request, we will disclose data to the appropriate authorities.
• Business transfers — if WildSafari is acquired or merges with another entity, your data may be transferred as part of that transaction. We will notify you before any such transfer occurs and your rights will be maintained.

Cookies are small text files placed on your device when you visit our website. We use cookies to make the site function properly, remember your preferences, and understand how visitors use our content.

We retain personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by law. The following retention periods apply:

After applicable retention periods expire, your data is securely deleted or permanently anonymised so it can no longer be linked to you.

Under the Kenya Data Protection Act and applicable international regulations, you hold the following rights over your personal data. We will respond to all valid requests within 30 days.

We take data security seriously and have implemented a comprehensive set of technical and organisational safeguards to protect your personal information from unauthorised access, accidental loss, destruction, or disclosure.

• TLS/SSL encryption — all data transmitted between your browser and our servers is protected by 256-bit encryption.
• Encrypted data storage — personal data stored in our databases is encrypted at rest using AES-256 encryption.
• Access controls — personal data is accessible only to authorised WildSafari staff who require it to carry out their job responsibilities.
• Staff training — all team members who handle personal data receive regular data protection and security training.
• Regular security audits — we conduct annual penetration testing and security reviews of our systems and infrastructure.
• Breach response plan — in the event of a data breach, we will notify affected individuals and the ODPC within 72 hours as required by law.

WildSafari is committed to protecting the privacy of children. Our website and online booking services are directed at adults aged 18 and over. We do not knowingly collect personal data directly from children under the age of 18 without verifiable parental consent.

• When booking for children, all personal data (including names and ages) is collected from the responsible adult at the time of booking.
• Health or accessibility data relating to children is processed only with the explicit consent of a parent or legal guardian and used solely to ensure their safety during the visit.
• We do not use children's data for marketing purposes under any circumstances.
• On-site photographs that may include children are subject to our Photography Policy (Section 8 of our Terms & Conditions). Parents may opt out by notifying staff before the tour.

WildSafari is based in Kenya, but some of our trusted service providers (such as cloud hosting and payment processing platforms) may process your data in other countries, including within the European Economic Area (EEA), the United Kingdom, or the United States.

Whenever personal data is transferred outside Kenya, we ensure it receives equivalent protection by relying on one or more of the following safeguards:

• Adequacy decisions — transferring only to countries recognised as providing adequate data protection by the ODPC or equivalent authorities.
• Standard contractual clauses — legally binding data processing agreements with all international service providers that impose GDPR-equivalent obligations.
• Certified frameworks — using providers certified under recognised international data protection frameworks where available.

You may request further information about the specific safeguards in place for any international transfer by contacting our DPO at privacy@wildsafari.com.

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or best practices. The "Last updated" date at the top of this page will always reflect the most recent revision.

• Minor updates (e.g. clarifications, formatting) — updated on this page with no direct notification.
• Material changes (e.g. new data uses, new sharing arrangements) — we will notify you by email at least 14 days before the changes take effect.
• Major changes (e.g. changes to legal basis or data controller) — we will seek fresh consent where required and provide a clear summary of what has changed.