Privacy Policy

This policy covers the website, our emails and WhatsApp chats, trek bookings and guide book sales. It follows Tanzania's Personal Data Protection Act, 2022 (Cap. 44) and its 2023 regulations. If you live in the EU, the UK or California, your own privacy laws protect you too, and we've written this with them in mind.

Who we are

The company responsible for your data (the "data controller", in legal terms) is [Registered company name and legal form, e.g. Makoliya Safari Limited], registered in Tanzania under number [BRELA registration number] and trading as Makoliya Safari.

We haven't appointed a representative in the EU or the UK, so please write to us directly about anything here.

What we collect, and why

Almost everything we hold, you gave us yourself.

You don't have to give us anything to ask a question, though we need some way to reply. Once you book, it's different: the parks won't issue a permit without your passport details, so we can't confirm a trek without them. The medical form is voluntary, but without it we may not be able to take you on the higher mountains.

Tanzanian law treats health information, information about children and details of financial transactions as sensitive. Your medical form is the main example. We only collect it with your written consent and keep it apart from the rest of your booking. You can withdraw that consent whenever you like, free of charge. If you do, we may not be able to take you up safely, and withdrawing doesn't undo what we did with it before.

The trip planner doesn't send anything by itself. When you press send, it opens WhatsApp with your message written out, and nothing reaches us until you send it there. The parks, waterfalls and trip types you add to "My trip" are saved in your own browser so they're still there next time. They never leave your device unless you put them in a message to us. Our Cookie Policy explains this storage.

No computer makes decisions about you here. We don't use automated decision-making or profiling.

Who sees your data

We never sell or rent your details, and we don't share them for advertising. We pass them on only when your trip needs it:

• park authorities, such as Tanzania National Parks (including Kilimanjaro National Park), the Ngorongoro Conservation Area Authority and the Tanzania Forest Services Agency, who need your details for permits, and any other authority the law requires us to inform
• the hotels, lodges, campsites and drivers on your itinerary, and your guide and crew. Your guide sees your dietary needs and any medical information that matters on the trail, nothing more
• doctors, rescue teams and your insurer, if you're ill or hurt
• the companies that run our systems: our web host [host name], form service [form provider], email provider [email provider] and payment provider [payment provider], plus the checkout partner named on the guide book checkout page. They work on our instructions, under contract
• WhatsApp (Meta), if you message us there. WhatsApp handles your data under its own policy. We see your number, your WhatsApp name and your messages
• our accountant or lawyer, the tax authority, the police or a court, when the law requires it or to deal with a legal claim

Files your browser loads from other companies

When a page opens, your browser fetches our fonts from Google. That means Google sees your IP address and some basic browser details.

Our fonts come from Google Fonts (Google LLC, USA). Google says the service sets no cookies and uses these requests only to deliver the fonts and keep the service secure. See Google's privacy policy.

We rely on our legitimate interest in showing the site properly. Links to WhatsApp and social networks take you to those services, and their own policies apply there. Our Cookie Policy has more on this.

Sending data outside Tanzania

We're in Moshi, so when you send us your details, they come to Tanzania. Your permits, hotels and transport are here too. Some services we use, such as email, hosting, forms and payments, may store data in the United States, Europe or elsewhere.

Tanzanian law allows a transfer abroad when it's needed for your booking or a contract made in your interest, when you've agreed to it, or when proper safeguards are in place (with the Personal Data Protection Commission's approval where that's required). Those are the only routes we use.

For travellers covered by the EU or UK GDPR: sharing your details with our suppliers in Tanzania is necessary to carry out your booking (Article 49(1)(b) and (c)). For providers in the United States, we rely on the EU-US Data Privacy Framework and its UK Extension where the provider is certified, or on the standard contractual clauses the provider offers. Ask us if you'd like the details.

How long we keep it

Keeping it safe

The site runs over HTTPS. Only the people who need your details can see them. Our accounts use strong passwords and two-step sign-in, and medical forms are stored separately from everything else. The companies we work with are bound by contract to protect your data as well.

No system is perfect, though. If a breach affects your data, we'll report it to the Personal Data Protection Commission without delay, and we'll tell you if it's likely to put you at risk.

Your rights

Depending on where you live, you can ask us to:

• tell you whether we hold data about you, give you a copy, and explain what we use it for and who sees it
• correct anything that's wrong, incomplete or misleading
• delete it when we no longer need it or have no right to keep it
• stop or pause using it where that could cause you harm or distress
• stop using it for marketing, at any time, and stop any use that relies on our legitimate interests
• send you the data you gave us in a common electronic format (EU and UK)

You can also withdraw your consent whenever you like, though that doesn't undo what we did before. And if a breach of data protection law causes you damage, you can claim compensation.

To do any of this, email info@makoliyasafari.com. A plain email is fine, although Tanzanian law also has official request forms we can send you. We may ask you to prove who you are. It costs nothing. We'll confirm we've received your request within 72 hours and give you an answer within 14 days, and never later than the law allows.

If you're unhappy

Please talk to us first. We'll get back to you within 30 days at the very latest, and usually much sooner, and tell you what we've done about it.

You can also complain to a regulator. In Tanzania, that's the Personal Data Protection Commission. In the EU, it's the data protection authority where you live or work, or where the problem happened (here is the list of EU authorities). In the UK, it's the Information Commissioner's Office.

Marketing emails

We only send marketing emails if you've said yes, or if you've travelled with us and we're writing about similar trips. Every email says who it's from and has an unsubscribe link that works. We never hand your details to other companies for their marketing.

Children

This website isn't meant for children under 13 (under 16 in the EU and UK), and we don't knowingly collect their data online. When a child comes trekking with us, a parent or guardian gives us the child's details and consents for them. If you think a child has sent us personal data, tell us and we'll delete it.

Visitors from the United States

We don't track you across other websites, and we don't let anyone else do it through ours, so a "Do Not Track" signal doesn't change anything here. We don't sell or share personal information, as California law defines those words. To review or change what we hold about you, email us as described under Your rights.

When this policy changes

We'll post the new version here and change the date at the top. For bigger changes, we'll also put a notice on the home page and email anyone with a trek coming up before the change applies. If we ever want to use your data for something new, we'll tell you first.