What we collect, why we hold it, who we pass it to, and what you can ask us to do about it.
The full policy is below and worth reading. If you only read one part, read this one.
We hold personal information because a safari cannot be arranged without it. Passports get you on aircraft, dietary notes get you fed properly, and a quiet word about a bad knee gets you the tent nearest the dining room. This policy sets out exactly what we do with all of it.
Ongeri Expeditions is a luxury safari operator registered and operating in Kenya, with offices at Terra Mia, Marula Lane, Karen, Nairobi. In this policy, Ongeri Expeditions is referred to as we, us or our.
For the purposes of the Kenya Data Protection Act 2019, and of the General Data Protection Regulation where it applies to you, Ongeri Expeditions is the data controller for the personal information described below. That means we decide what is collected and what happens to it, and we are accountable for both.
Our Data Protection contact is reachable at travel@ongeriexpeditions.com or on +254 711 471 757.
This policy explains what personal information we collect when you use ongeriexpeditions.com, when you enquire about a safari, when you travel with us, and when you subscribe to our mailing list. It explains why we hold it, who we share it with, how long we keep it, and what you can ask us to do about it.
It does not cover the websites of other companies you may reach through links from ours, including the camps, lodges, airlines and booking tools we work with. Each has its own policy, and we would encourage you to read them.
Most of what we hold is information you provide directly, usually through an enquiry form, an email, a WhatsApp message or a phone call. That typically includes:
Once a booking is confirmed, we also collect what is needed to arrange the travel itself:
When you visit the website we collect limited technical information, including your IP address, approximate location derived from it, device and browser type, the pages you view and how you arrived. This comes from cookies and similar technologies, described further down.
We use approximate location for one purpose beyond analytics, which is to restrict our Kenyan and East African resident offers to visitors in the region those rates apply to.
Occasionally we receive information about you from a travel advisor acting on your behalf, from another member of your party who is organising the trip, or from a partner camp or airline in the course of arranging your journey.
If you are booking for other people, you are responsible for making sure they have seen this policy and are content for you to share their details with us.
Some of what you tell us falls into a category the law treats with particular care. Under the Kenya Data Protection Act 2019 and the General Data Protection Regulation, this includes information about health, and information revealing religious or philosophical beliefs, or sexual orientation.
We may hold sensitive information about you in three situations:
We handle all of it on the basis of your explicit consent, which you give by choosing to tell us. There are cases where withholding medical information genuinely limits what we can arrange safely, and we will say so plainly rather than proceed regardless.
We share sensitive information with a camp, airline or medical provider only where it is necessary for your safety or comfort, and only as far as needed. On information relating to sexual orientation specifically, we share nothing beyond a room configuration unless you ask us to, and we follow your instruction on how visible you wish to be.
We use your information for the purposes below. Where the General Data Protection Regulation applies to you, the lawful basis for each is given alongside.
| What we do | Lawful basis |
|---|---|
| Answering your enquiry and preparing a proposal | Steps taken at your request before entering a contract |
| Booking camps, flights, transfers and activities | Performance of our contract with you |
| Arranging evacuation cover and briefing camps on your needs | Your explicit consent, and protection of vital interests |
| Taking payment and keeping financial records | Performance of our contract, and legal obligation |
| Sending you our newsletter and offers | Your consent, withdrawable at any time |
| Improving the website and understanding how it is used | Our legitimate interests, and your consent for non essential cookies |
| Restricting resident offers to the region they apply to | Our legitimate interests in honouring supplier rate conditions |
| Responding to a complaint or defending a legal claim | Our legitimate interests, and legal obligation |
Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights, and you may object at any time.
Because we arrange travel across East Africa and the Indian Ocean, your information will be sent to countries other than the one you live in. That includes Kenya, Tanzania, Rwanda, Uganda, South Africa, Zanzibar, the Seychelles and Mauritius, and technology providers based in the United States and the European Union.
Not all of these countries have data protection laws equivalent to those in Kenya, the United Kingdom or the European Economic Area. Where we transfer information internationally we do so on one of the following bases: it is necessary for the performance of our contract with you, which covers most camp and airline bookings; you have given explicit consent; or the transfer is covered by appropriate contractual safeguards with the supplier.
We send occasional emails with safari stories, seasonal advice and offers, and only to people who have asked for them. You can subscribe through the form in our footer.
Every email carries an unsubscribe link at the foot, and it works immediately. You can also simply reply and ask, or write to travel@ongeriexpeditions.com.
Unsubscribing does not stop the messages we need to send about a booking you have made, such as confirmations, flight times and safety information.
This section is our cookie policy. It sits inside this document rather than on a page of its own, so that everything about your information lives in one place.
Cookies are small text files a website stores on your device. Some are essential to make a site work at all. Others count visits, remember preferences or measure whether an email was opened. We use a small number of each, and nothing more than we need.
When you first arrive you are shown a consent banner, managed by CookieYes. Strictly necessary cookies are set without consent because the site cannot function without them. Everything else is set only if you agree.
| Category | What it does, who sets it, how long it lasts |
|---|---|
| Strictly necessary | Remembers your cookie choices and keeps the site working. Set by CookieYes. Up to twelve months |
| Analytics | Counts visits and shows us which pages are read and which are ignored. Set by Google Analytics, loaded through Google Tag Manager. Up to twenty four months |
| Behaviour and heatmaps | Records anonymised sessions and heatmaps so we can see where the site is confusing. Text you type into forms is masked. Set by Microsoft Clarity. One day to twelve months |
| Marketing | Recognises subscribers and measures whether our emails have been opened. Set by Klaviyo. Up to twenty four months |
The itemised list, with every individual cookie name and its exact duration, is held in the CookieYes banner and updates automatically as our tools change. That list is always more current than any table we could type out here.
You can reopen the consent banner at any time and change or withdraw your choices. Nothing you decline is set, and anything already set in a category you later decline stops being used.
You can also block or delete cookies through your browser settings, which every major browser allows. Doing so affects all websites rather than just ours, and parts of this site may behave oddly afterwards.
Some pages embed content from other companies, including our booking tool, our scheduling tool and social media links. Where you interact with those, the company concerned may set its own cookies under its own policy, which we do not control.
We keep information for as long as we need it, and no longer.
We hold your information on password protected systems with access limited to the people who need it. Our website runs over an encrypted connection. Card details are handled by our payment providers and are not stored on our systems.
No system is perfect, and we would not claim otherwise. If a breach occurs that is likely to result in a risk to your rights, we will notify the Office of the Data Protection Commissioner in Kenya within seventy two hours where the law requires it, and we will tell you directly where the risk to you is high.
Whether you are in Kenya, the United Kingdom, the European Economic Area or elsewhere, you can ask us to do the following, and we will not charge you for it.
To exercise any of these, write to travel@ongeriexpeditions.com. We may ask you to confirm your identity first, which protects you rather than us.
If you are a California resident, you additionally have the right to know what is collected, to request deletion, and not to be treated differently for exercising either. We do not sell personal information as that term is defined in California law.
We arrange a great many family safaris, so we frequently hold information about children, including names, ages, dietary requirements and occasionally medical needs. That information is always provided by a parent, guardian or the adult organising the trip, never collected from the child directly.
Our website is not directed at children and we do not knowingly collect information from anyone under eighteen through it. If you believe a child has given us information through the website, tell us and we will delete it.
Payments are taken through regulated payment providers. Your full card number is entered on their systems rather than ours, and we never see or store it. We receive confirmation that a payment succeeded, along with the last digits of the card for reconciliation.
We absorb card processing fees rather than passing them on, which has no bearing on your data but is worth saying plainly.
We update this policy when our practices change or when the law does. The date at the top tells you when it was last revised. If a change materially affects how we use information you have already given us, we will tell you directly rather than relying on you noticing.
For anything in this policy, including a request to see, correct or delete your information, we would always rather hear from you first.
Terra Mia, Marula Lane, Karen, Nairobi, Kenya
You have the right to complain to a supervisory authority.