Privacy Policy
Last updated: June 2026
Table of Contents
Introduction
Kong Safaris Ltd ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website, mobile applications, and services (collectively, the "Services").
By using our Services, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use our Services.
We operate in full compliance with the Data Protection Act of Kenya (No. 24 of 2019) and relevant international data protection laws where applicable.
1. Information We Collect
Personal Information You Provide
We may collect the following categories of personal information when you book a safari, create an account, or communicate with us:
- Identity Information: Full name, date of birth, nationality, and passport or national ID number (where required for travel documentation).
- Contact Information: Email address, phone number, and physical address.
- Booking Information: Pickup and drop-off locations, travel dates, group size, vehicle preferences, special requests, and accessibility needs.
- Payment Information: M-Pesa transaction codes, payment receipts, and partial billing details. We do not store full card numbers, M-Pesa PINs, or bank account credentials.
- Communication Records: Correspondence with our team via email, phone calls, SMS, or messaging platforms.
- Marketing Preferences: Your consent or objection to photography and videography during trips.
Information Collected Automatically
When you use our website or mobile application, we may automatically collect:
- Device Information: IP address, browser type, operating system, device identifiers, and language preferences.
- Usage Data: Pages visited, time spent on pages, links clicked, referral URLs, and other browsing behaviour.
- Location Data: Approximate geographic location derived from your IP address. With your explicit consent, precise GPS location data may be collected during active trip tracking (see Section 5).
Information from Third Parties
We may receive information about you from third parties, including:
- Payment Processors: Paystack and M-Pesa provide transaction confirmations and payment status updates.
- Corporate Partners: Travel agencies or corporate accounts providing passenger details for group bookings.
- Public Sources: Information available in public records or on public websites, where permitted by law.
2. How We Use Your Information
We use your personal information for the following purposes:
- Service Delivery: To process bookings, communicate trip details, assign drivers, coordinate pickups, and deliver safari services as requested.
- Payment Processing: To facilitate payments through our payment gateway, issue invoices and receipts, and manage refunds and cancellations.
- Real-Time Tracking: To provide live GPS tracking of your booked vehicle during active trips and share your location with dispatch teams for safety purposes.
- Customer Support: To respond to your enquiries, resolve issues, and provide technical support.
- Safety & Security: To verify identities, enforce our terms and conditions, and comply with legal obligations.
- Marketing Communications: To send promotional offers, newsletters, and service updates where you have provided consent. You may opt out at any time.
- Service Improvement: To analyse usage patterns, improve our platform, develop new features, and enhance user experience.
- Legal Compliance: To comply with applicable laws, regulations, legal processes, or governmental requests in Kenya and other relevant jurisdictions.
4. M-Pesa & Payment Data
Kong Safaris processes payments through Paystack, a PCI-DSS compliant payment gateway that supports M-Pesa integration in Kenya.
- What We Collect: We record the M-Pesa transaction code, amount paid, payment date, and mobile money phone number used for the transaction. This data is necessary to reconcile payments and issue receipts.
- What We Do NOT Collect: We do not collect, store, or process your M-Pesa PIN, SIM card details, or full bank account credentials. All sensitive payment authentication is handled entirely within the secure M-Pesa/Safaricom environment and Paystack's PCI-DSS compliant infrastructure.
- Third-Party Processing: Your payment data is transmitted directly to Paystack and/or Safaricom. We encourage you to review their respective privacy policies:
- Paystack Privacy Policy: https://paystack.com/privacy
- Safaricom (M-Pesa) Privacy Policy: https://www.safaricom.co.ke/privacy-policy
- Refunds: When processing refunds, we will use the original payment method where possible, which may require us to reference your M-Pesa transaction code. Refunds are processed in accordance with our Cancellation & Refund Policy.
5. Location & Trip Tracking
Kong Safaris provides a real-time GPS tracking feature as part of our Service. This feature is designed for safety, operational coordination, and transparency.
- How It Works: During an active trip, our driver's mobile application periodically transmits GPS coordinates (latitude and longitude) to our servers. These coordinates are used to display the vehicle's location on a map interface accessible to the customer and our operations team.
- Data Collected: GPS coordinates, timestamp, vehicle identifier, and trip reference number.
- Who Can See It: The customer who booked the trip, the assigned driver, and authorised Kong Safaris operations staff. Location data is not publicly visible or shared with third parties unless required by law.
- Retention: Real-time coordinate streams are retained for the duration of the trip and for a period of 30 days thereafter for dispute resolution and operational analysis. Historical trip routes may be stored in anonymised or aggregated form for longer periods.
- Consent: By booking a trip with tracking enabled, you consent to the collection and display of vehicle location data for the duration of your trip. Drivers are informed and consent separately through their employment agreements.
6. Data Retention
We retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy, or as required by applicable law.
- Account Data: Retained for the duration of your account's active status plus 3 years after account closure, unless a longer retention period is required by law (e.g., for tax or legal compliance).
- Booking Records: Retained for 5 years from the date of the completed trip to comply with Kenyan tax and transport regulations.
- Payment Records: Retained for 7 years in accordance with Kenyan financial record-keeping requirements.
- Location Data: Active trip coordinates are retained for 30 days. Anonymised route data may be retained indefinitely for analytical purposes.
- Communications: Customer support correspondence is retained for 3 years from the date of resolution.
- Marketing Data: Retained until you opt out or withdraw consent, whichever comes first.
When data is no longer required, we securely delete or anonymise it in accordance with our data disposal procedures.
7. Your Rights
Under the Data Protection Act of Kenya and applicable international laws, you have the following rights regarding your personal information:
- Right to Access: You may request a copy of the personal information we hold about you.
- Right to Rectification: You may request that we correct any inaccurate or incomplete personal information.
- Right to Erasure: You may request that we delete your personal information, subject to legal retention obligations.
- Right to Restrict Processing: You may request that we limit the processing of your personal information in certain circumstances.
- Right to Data Portability: You may request a structured, machine-readable copy of your personal information.
- Right to Object: You may object to the processing of your personal information for direct marketing purposes at any time.
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
To exercise any of these rights, please contact us using the details in Section 11. We will respond to your request within 30 days, as required by Kenyan data protection law.
If you are dissatisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.
8. Data Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:
- Encryption of data in transit using TLS 1.2+ (SSL) for all communications between your browser and our servers.
- Secure, tokenised payment processing through PCI-DSS compliant third-party providers (Paystack).
- Access controls and authentication protocols limiting data access to authorised personnel only.
- Regular security audits, vulnerability assessments, and penetration testing of our systems.
- Secure data storage with encrypted backups and offsite redundancy.
- Employee training on data protection and privacy best practices.
While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we will notify you of any data breach that is likely to result in a high risk to your rights and freedoms in accordance with legal requirements.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make material changes, we will notify you by:
- Posting the updated policy on this page with a revised "Last updated" date.
- Sending an email notification to the address associated with your account, where significant changes affect your rights.
- Displaying a notice on our website or within our application.
We encourage you to review this Privacy Policy periodically. Your continued use of the Services after any changes constitutes your acceptance of the updated policy.
11. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:
Data Protection Officer
- Kong Safaris Ltd
- Nairobi, Kenya
- Email: [email protected]
- Phone: +254 700 000000
Office of the Data Protection Commissioner (ODPC)
If you are not satisfied with our response to your data protection concern, you have the right to lodge a complaint with the regulator:
- Office of the Data Protection Commissioner
- P.O. Box 2183-00502,
- Nairobi, Kenya
- Email: [email protected]
- Website: https://www.odpc.go.ke