Data Privacy & Protection Policy

1 Personal Information We Collect

To design, manage, and execute complex single-country and multi-country travel packages, we must collect specific personal information. This includes:

• Identity Data: Full name, date of birth, gender, nationality, country of residence, and passport biodata pages (including passport numbers, issuance, and expiry dates).

• Contact Data: Email address, telephone numbers, physical address, and emergency contact details.

• Travel & Logistics Data: Intended travel dates, custom itinerary details, flight bookings, hotel/lodge reservations, and visa/immigration documentation.

• Sensitive Personal Data: Limited medical information, physical accessibility needs, and specific dietary requirements. We collect this data solely to ensure your safety and physical well-being during travel.

• Financial Data: Payment and billing details, transaction histories, and corporate invoicing information.

• Interaction Data: Records of communications via email, phone calls, WhatsApp, website forms, or online complaint portals.

We adhere strictly to the principle of data minimization—we only collect data absolutely essential to deliver your seamless travel experience.

2 How We Collect Your Information

We collect data through fair, lawful, and direct interactions with you or your authorized representatives:

• Direct Interactions: When you fill out enquiry or booking forms on sifavian.com, submit an online complaint, or correspond directly with our consultants via email, text, or WhatsApp.

• Document Submission: When you securely provide copies of passports, visas, or travel insurance certificates.

• Third-Party Authorization: From international travel agents, family members, or corporate entities booking a cross-border expedition on your behalf, with your explicit authorization.

3 Purposes for Which We Use Your Information

Your personal data is processed strictly for legitimate operational, business, and legal purposes, including:

• Processing and engineering tailored trip quotations and custom cross-border itineraries.

• Securing hotel, luxury lodge, private tented camp, national park, and conservancy reservations.

• Coordinating regional bush flights, international flight blocks, and private ground transfers.

• Facilitating necessary border crossings, visa verifications, and regional immigration compliance.

• Managing billing, secure payment processing, and internal accounting protocols.

• Providing 24/7 on-the-ground support and emergency assistance throughout your multi-destination journey.

• Complying with regulatory obligations mandated by the Kenya Revenue Authority (KRA), the ODPC, and equivalent authorities across Africa.

4 Legal Basis for Processing Your Data

Under applicable African data privacy laws, Sifavian Adventures Ltd processes data under the following clear legal frameworks:

• Consent: When you explicitly choose to provide us with your details, particularly sensitive data like dietary or medical requirements.

• Performance of a Contract: Essential processing required to execute the booking agreement made between you and Sifavian Adventures Ltd.

• Legal Obligation: Compliance with statutory, tax, or civil infrastructure safety laws within Kenya and destination countries.

• Vital Interests: Critical data processing necessary during unexpected medical or logistics emergencies to protect your life or health.

5 Sharing of Personal Information

You have the right to acBecause we specialize in multi-country itineraries, providing your services requires us to share minimum necessary data blocks with trusted third-party service providers. These include:

• Partner airlines, luxury hospitality groups, private conservancy authorities, and local ground handlers.

• Tour guides, transport logistics companies, and safari vehicle operators.

• Emergency medical evacuation companies and travel insurance providers.

• Government immigration departments and national park management bodies for border clearances and entry permits.

We enforce strict data protection obligations upon all our third-party ground handlers and suppliers. Sifavian Adventures Ltd will never sell, rent, trade, or lease your personal information to third parties for independent marketing purposes.

6 International Transfer of Personal Data (Cross-Border Safaris)

As a specialist in multi-destination African expeditions, your data will inevitably cross international borders outside of Kenya (e.g., between East, Southern, Central, West, or North African states) to synchronize your bookings.

In strict compliance with Sections 48 and 49 of the Kenya Data Protection Act, cross-border transfers are conducted using the following safeguards:

• Transferring data only to destination entities that enforce equivalent privacy standards.

• Utilizing specialized Standard Contractual Clauses (SCCs) or service level agreements that guarantee the recipient will safeguard your data with standard-compliant security measures.

• Obtaining your explicit, informed consent during the multi-country booking phase.

7 Data Security and Technical Protection Measures

We have implemented robust technical and organizational measures to prevent your data from being accidentally lost, used, altered, disclosed, or accessed without authorization:

• Secure Storage: Digital client data is stored on password-protected cloud servers with strict access controls.

• Access Control: Only authorized Sifavian travel consultants and operations managers handling your specific booking are granted access to your passport and travel details.

• Confidentiality: All Sifavian employees sign strict data non-disclosure agreements upon hiring.

Data Breach Protocol: In the highly unlikely event of a data breach compromising your personal data, Sifavian Adventures Ltd will notify the Office of the Data Protection Commissioner (ODPC) Kenya within 72 hours of discovery, and communicate directly with affected data subjects as required by law.

8 Data Retention Limits

We retain your data only as long as necessary to fulfill the specific purposes of your travel booking, comply with tax laws (which often require financial records to be kept for up to seven years), or resolve legal disputes. When no longer required, data is permanently erased, securely shredded, or completely anonymized.

9 Your Rights as a Data Subject

Under the Kenya Data Protection Act, 2019, you retain full, sovereign rights over your information. You have the right to:

• Access: Request a copy of all personal data we hold about you.

• Rectification: Request immediate correction of inaccurate or incomplete information.

• Erasure ("Right to be Forgotten"): Request deletion of your data when it is no longer necessary for contract performance or statutory retention.

• Portability: Request that your data be transferred to you or another provider in a structured, machine-readable format.

• Objection/Restriction: Object to processing your data for direct marketing or restrict processing during legal disputes.

• Withdraw Consent: Revoke your processing consent at any time, without affecting prior lawful processing.

To exercise any of these rights, please contact our compliance desk via the contact details provided in Section 15.

10 Use of Cookies and Website Analytics

Our platform sifavian.com utilizes standard browser cookies and tracking technologies to optimize website layout, analyze user engagement trends, and ensure smooth digital interactions. Cookies do not scan your device or capture private personal files. You can choose to disable cookies through your browser settings, though doing so may limit performance on certain pages of our site.

11 Online Forms and Electronic Communications

All electronic entry points on our website are protected by standard encryption protocols. Please note that text or email interactions with Sifavian Adventures Ltd may be archived or monitored internally to ensure quality control, staff training, and compliance with our premium service benchmarks.

12 Regulatory Accountability & Compliance

We proactively register as Data Controllers and Processors with the Office of the Data Protection Commissioner (ODPC) in Nairobi, Kenya. Our operational frameworks are continually audited to match evolving data privacy landscapes across sub-Saharan Africa.

13 Changes to This Privacy Policy

Sifavian Adventures Ltd reserves the right to modify this policy at any time to reflect updates in operational infrastructure, corporate scaling, or international law. The current operational version will always be live on sifavian.com, noted with a "Last Updated" timestamp.