Privacy Policy

Last updated: 15 August 2026

This explains what personal information we collect, why we collect it, who else sees it, how long we keep it, and what you can ask us to do about it. It covers our website and everything we do to arrange your trip.

1. Who we are

Wild Springs Adventures Limited is the data controller. That means we decide what information is collected and why, and we are responsible for looking after it.

Valley View Office Park, Tower A, First Floor, City Park Drive, Parklands, Nairobi 00100, Kenya.
TRA Licence TRA1/47/C01/25895 · TOSK Member No. 0082

We are completing our registration with the Office of the Data Protection Commissioner and will publish our registration number here once it is issued.

For anything about your personal information, contact [email protected], subject line "Privacy", or call +254 729 257 317.

2. What we collect, and where from

When you enquire or book

Through our enquiry and booking forms, by email, by phone or on WhatsApp: your full name, email address, telephone number, the number of people travelling, your preferred way of being contacted, and anything you write in the notes box. When you book, also your passport details, nationality and residency status where we need them for park fees or permits, your emergency contact, and your insurance details.

Health, diet and family information

To keep you safe at altitude we ask about medical conditions, medication, allergies, dietary requirements, injuries and mobility. On family or group bookings we may hold the names of your spouse and children.

If you create an account

Your login details, your saved wishlist, and your booking history.

If you subscribe to our newsletter

Your name and email address, and whether you open our emails.

Automatically, when you visit our website

Your IP address, browser and device type, the pages you view, how you arrived, and approximate location derived from your IP address.

From other people

From our representative agency in Austria, our partner in the United States, and from travel agents who book on your behalf.

3. Why we use it, and our legal basis

4. Who else sees your information

We do not sell your personal information. We never have and we will not.

We share it with the following, and only what each one needs:

To deliver your trip

• Kenya Wildlife Service — for park entry and camping permits, which are issued in your name
• Hotels, lodges, camps and hut operators
• Transport providers and airlines
• Our own guides, chefs and porters — who receive only what they need, which for medical information means what keeps you safe
• Emergency services and medical providers, if you need them

To run our business

• Google — Google Analytics, Google Ads and Google Tag Manager, for website measurement and advertising
• Cloudflare — which sits in front of our website for security and speed, so your IP address passes through their network
• Tawk.to — our live chat
• Meta / WhatsApp — if you contact us through the WhatsApp button
• Our email marketing provider, for the newsletter
• Our web hosting provider
• Our payment providers and bank
• Our representative agency in Austria and our partner in the United States, where they are involved in your booking
• Our accountants and professional advisers

Where the law requires it

To government authorities, regulators or courts where we are legally obliged to provide it.

5. Information leaving Kenya

Several of the services above are based outside Kenya, mainly in the United States and Europe. That means your information is transferred out of Kenya.

When that happens we rely on one of the grounds permitted by the Data Protection Act — usually appropriate contractual safeguards with the provider, or your consent where the information is sensitive. We keep a record of these transfers and we can show you our safeguards on request.

Transferring your information abroad does not reduce your rights. You can still exercise every right in section 7 against us.

6. How long we keep it

7. Your rights

Under the Kenya Data Protection Act 2019 you have the right to:

• Be told how your information is used — that is what this page is for
• Get a copy of the information we hold about you
• Object to us using it
• Correct information that is false or misleading
• Have deleted information that is false or misleading
• Receive your information in a structured, commonly used, machine-readable format, or have it sent to someone else
• Withdraw consent at any time where we relied on it — this does not undo what we did before you withdrew it

Beyond what the law requires, if you ask us to delete your information we will do so, unless we are legally required to keep it — accounting records being the main example.

To exercise any of these, email [email protected]. We may ask you to confirm your identity so we do not hand your information to somebody else. We respond within 30 days and we do not charge.

8. If you are in the UK or the European Union

We arrange trips for travellers from the United Kingdom and the EU, and we have a representative agency in Austria. Where the UK or EU General Data Protection Regulation applies to what we do, you have the additional rights those laws give you — including the right to complain to the data protection authority in your own country.

If you would like us to deal with a data protection request under those laws, write to [email protected] with "Privacy" in the subject line and we will handle it directly.

9. Cookies and tracking

We do not set cookies of our own for tracking. However, some of the services we use to run the website do set them, and they do so on our behalf, so we are responsible for telling you about them.

What is actually set

Your choices

We are adding a consent control that will let you accept or refuse the measurement and advertising groups before they load. Until it is in place, you have three options that work today:

• Your browser settings — every browser lets you block or delete cookies. Blocking the necessary ones may stop parts of the site working.
• Google Analytics opt-out — Google publishes a browser add-on that stops Analytics collecting anything from you on any website: tools.google.com/dlpage/gaoptout
• Ask us — email [email protected] and we will tell you exactly what we hold about your visit, and delete it.

10. Children

Our website is not aimed at children and we do not knowingly collect information from them. Bookings that include children are made by a parent or guardian, who provides the children's details and consents on their behalf. If you believe we hold a child's information without that consent, tell us and we will delete it.

11. How we protect your information

Our website runs over an encrypted connection and sits behind a security service that filters malicious traffic. Access to booking records is limited to staff who need it. Passwords are stored in a form that cannot be read back. Our staff are bound by confidentiality.

No system is perfectly secure, and we do not claim otherwise. If a breach happens that puts you at real risk of harm, we will tell the Office of the Data Protection Commissioner within 72 hours and tell you as soon as we reasonably can.

12. Complaints

Please come to us first — [email protected]. Most things are resolved quickly.

If we cannot resolve it, you can complain to the Office of the Data Protection Commissioner:
www.odpc.go.ke · [email protected] · +254 20 780 1800

If you are in the UK or the EU, you may also complain to your own national data protection authority.

13. Changes to this policy

We update this page when what we do changes. The date at the top always shows the current version. If we make a change that materially affects you, we will email account holders and put a notice on the site.