Privacy Policy | SafariLists

1. Who We Are

SafariLists is an online marketplace connecting travelers with vetted safari operators across Africa. Our registered address is Nairobi, Kenya. For privacy enquiries, contact us at privacy@safarilists.com.

2. Data We Collect

We collect the following categories of personal data:

Account data: Name, email address, password (hashed), and role (traveler or operator).
Profile data: Company name, country, phone number, profile photo, tourism licence (operators only).
Inquiry data: Travel dates, group size, budget, interests, and messages you send to operators.
Payment data: Transaction amount, currency, payment method type. We do not store full card numbers — payments are processed by Stripe, Flutterwave, or PayPal.
Usage data: Pages visited, search queries, package views, device type, browser, and IP address.
Communications: Messages exchanged with operators via our chat feature.

3. How We Use Your Data

To create and manage your account.
To connect you with safari operators and process inquiries.
To process payments and manage escrow.
To send transactional emails (booking confirmations, inquiry notifications, subscription reminders).
To improve our platform, detect fraud, and ensure security.
To comply with legal obligations.

We do not sell your personal data to third parties. We do not use your data for targeted advertising.

4. Legal Basis for Processing

We process your data under the following legal bases:

Contract: Processing necessary to provide our services (account creation, bookings, payments).
Legitimate interests: Platform security, fraud prevention, and service improvement.
Legal obligation: Compliance with applicable laws and regulations.
Consent: Marketing emails (you can withdraw consent at any time).

5. Data Sharing

We share your data only where necessary:

Safari operators: When you submit an inquiry, your contact details and trip preferences are shared with the relevant operator.
Payment processors: Stripe, Flutterwave, and PayPal process payments on our behalf under their own privacy policies.
Infrastructure: Supabase (database and authentication), Vercel (hosting), Resend (transactional email). All are GDPR-compliant processors.
Legal authorities: Where required by law or court order.

6. Data Retention

We retain your data for as long as your account is active. If you delete your account, we erase your personal data within 30 days, except where we are legally required to retain it (e.g. financial records for 7 years).

7. Your Rights

Under GDPR and POPIA, you have the right to:

Access the personal data we hold about you.
Rectify inaccurate or incomplete data.
Erase your data ("right to be forgotten").
Restrict or object to certain processing.
Data portability — receive your data in a machine-readable format.
Withdraw consent at any time for consent-based processing.

To exercise any right, email privacy@safarilists.com. We will respond within 30 days.

8. Cookies

We use strictly necessary cookies to maintain your session and authentication state. We do not use tracking or advertising cookies. You can clear cookies at any time through your browser settings.

9. Security

We use industry-standard security measures including TLS encryption in transit, hashed passwords, row-level security in our database, and regular security reviews. All staff with access to personal data are bound by confidentiality obligations.

10. International Transfers

Your data may be processed in countries outside your own (including the EU, US, and Kenya). Where data is transferred outside the EEA, we ensure appropriate safeguards are in place (Standard Contractual Clauses or equivalent).

11. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by email or a prominent notice on our platform. The "last updated" date at the top of this page always reflects the current version.

12. Contact & Complaints

For any privacy questions, contact our Data Protection Officer at privacy@safarilists.com.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with your local data protection authority (e.g. the ICO in the UK, or the Information Regulator in South Africa).