Privacy Policy

[PLACEHOLDER: this document is a structural draft and must be reviewed and completed by a qualified data protection adviser before publication. It has to be checked against Uganda’s Data Protection and Privacy Act and, because the business markets to travellers in Europe and the United Kingdom, against the GDPR and the UK GDPR.]

This policy explains what personal data [PLACEHOLDER: registered company name], trading as Mnyansio Tours and Travel, collects, why we collect it, who we share it with and how long we keep it. The data controller is [PLACEHOLDER: registered company name] of [PLACEHOLDER: registered address]. Data protection queries go to [PLACEHOLDER: privacy contact email address].

When you make an enquiry

We collect your name, email address, phone number, country of residence, travel dates, party size and anything else you choose to tell us. We use it to answer your enquiry and to prepare an itinerary. The lawful basis is our legitimate interest in responding to a request you made, or steps taken at your request before entering a contract.

When you book

We additionally collect the full names, passport numbers, passport expiry dates, dates of birth and nationalities of everyone travelling, your insurance policy details, your emergency contact, and any dietary, medical or mobility information you give us. Passport details are a hard requirement of the park authorities, who issue gorilla and chimpanzee permits against a named passport, and of internal airlines.

Health and dietary information

Where you tell us about a medical condition, an allergy or a mobility need, that is special category data. We use it only to make the trip safe and workable, we share it only with the specific lodge, guide or airline that needs it, and the lawful basis is your explicit consent. You can withdraw that consent, though doing so may mean we cannot safely operate part of the trip.

When you use this website

[PLACEHOLDER: complete this section only after the analytics and cookie configuration is finalised, and make sure it matches what the site actually loads. List each cookie, its purpose and its lifetime. If any non-essential cookie is used, a consent mechanism must be in place before it loads.]

Recipients

• Park authorities. The Uganda Wildlife Authority and the Rwanda Development Board require passport details to issue permits in your name.
• Lodges and camps. Names, arrival dates and any dietary or accessibility requirements.
• Airlines and charter operators. Names, passport details and weights where light aircraft are used.
• Payment processors. We do not store card numbers. Card data is handled by our payment provider and never reaches our systems.
• Our own guides and drivers. Only the information they need to run your trip safely.

We do not sell personal data, and we do not share it with anyone for their own marketing.

International transfers

Your data is processed in East Africa and, where our software suppliers are based elsewhere, in [PLACEHOLDER: list the countries where processors are located and the transfer mechanism relied on for each].

Retention

[PLACEHOLDER: set and state real retention periods. Suggested structure to confirm with your adviser: enquiries that do not convert, held for a stated period then deleted; booking and financial records, held for the statutory accounting retention period in the operating jurisdiction; passport details, deleted once permits are issued and the trip has been completed; marketing consents, held until withdrawn.]

You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to our using it, and ask for it in a portable format. Where we rely on consent, you can withdraw that consent at any time without affecting anything we did before you withdrew it.

Write to [PLACEHOLDER: privacy contact email address]. We will respond within [PLACEHOLDER: statutory response period for the applicable jurisdictions].

If you are not satisfied with how we have handled your data you can complain to the supervisory authority. In Uganda that is the Personal Data Protection Office. If you are in the United Kingdom or the European Union you may also complain to your own national authority.

Marketing

We only send marketing email to people who have asked for it. Every message carries an unsubscribe link that works immediately, and unsubscribing from marketing never affects the operational emails about a trip you have booked.

Changes to this policy

The current version is always the one published here. [PLACEHOLDER: add a last updated date on publication and update it whenever the policy changes.]