This document is being finalised with our advocate and may change. Items shown [in brackets] are still being confirmed. Your written quote sets out the terms that apply to your booking. Questions? Email info@creekstours.com.
1. Who we are and scope
1.1 Creeks Tours means Creeks Tours and Travel Limited, trading as Creeks Tours & Travel, of [Registered office address], Karen, Nairobi, Kenya. We are the data controller for the personal data described in this policy. Our company number is [Company registration number], our KRA PIN is [KRA PIN], and our ODPC registration number is [ODPC registration number].
1.2 This policy applies when you visit creekstours.com, send an enquiry, subscribe to Field Notes, ask us to prepare a trip, accept a quote, travel with us, contact us by email, telephone or WhatsApp, or otherwise deal with us.
1.3 Contact us about privacy at info@creekstours.com, +254 717 348 064, or [Data protection contact postal address]. Our responsible privacy contact is [Data Protection Officer or privacy lead name and title].
2. Data we collect
2.1 Enquiry data may include your name, email address, telephone or WhatsApp number, enquiry subject, free-text message, preferred contact method, desired destinations and activities, custom destination, budget range, trip duration, group size, preferred departure month, selected trip, number of adults and children, and any preferences you choose to provide.
2.2 Booking and travel data may include passenger names, dates of birth or ages, nationality, passport and immigration information, emergency contacts, dietary and accessibility needs, health information relevant to safe travel, insurance details, itinerary, accommodation, transport, permits, payment and refund records, correspondence, complaints and signed releases.
2.3 Newsletter data currently consists of an email address. If we introduce a lead list using Resend Contacts or a controlled spreadsheet, it may also contain name, source, consent status and timestamp, interests, engagement history, last contact and suppression status.
2.4 Website and communications data may include IP address, device and browser information, server request logs, timestamps, message delivery data, aggregated cookieless page-view statistics from Vercel Web Analytics, and records created by Vercel, Resend, Hostinger, WhatsApp/Meta or telecommunications providers. The current website has no customer account, checkout or customer database and does not intentionally set analytics or advertising cookies.
2.5 We may receive information from the person arranging a group booking, a travel companion, supplier, insurer, medical provider, immigration or park authority. The person supplying another traveller’s information must be authorised to do so and must show that traveller this policy.
2.6 Please do not put passport copies, detailed medical records, card details or other sensitive information into a general enquiry form. We will request necessary sensitive information through an appropriate channel after booking.
2.7 In the current Website implementation, contact-form and Trip Planner submissions are sent through Resend to our Hostinger mailbox, and Resend sends a confirmation to the enquirer. A newsletter submission sends a subscription notice through Resend to that mailbox; it is not yet written to a Website database. The downloadable Trip Planner enquiry PDF is generated in the Traveller’s browser. The Website itself has no payment checkout, customer account or customer database. If we activate Resend Contacts or an approved lead spreadsheet, clauses 2.3, 3 and 6 apply before data is added.
3. Why we use data and our legal bases
| Purpose | Data | Kenyan basis; additional basis where GDPR/UK GDPR applies |
|---|---|---|
| Answer an enquiry and design or quote a trip | contact details and preferences | steps requested before a contract; legitimate interests in responding and operating our business |
| Form and perform a Booking | booking, traveller, supplier and payment records | performance of contract; legal obligations |
| Arrange permits, hotels, transport, guides, flights, insurance assistance and border services | identity, passport, itinerary and necessary health/accessibility data | performance of contract; explicit consent or vital interests for sensitive data; legal obligations |
| Provide safety, incident and emergency support | identity, location, emergency contact and relevant health data | vital interests; performance of contract; legal obligations |
| Keep financial, tax, licensing, insurance and legal records | booking, payment, correspondence and incident data | legal obligations; legitimate interests in establishing or defending claims |
| Prevent spam, fraud, misuse and security incidents | form, log and device data | legitimate interests in security and service integrity; legal obligations |
| Send Field Notes and promotions | email, consent and preferences | consent where required; otherwise only a lawful existing-customer basis permitted by applicable law, with an easy opt-out |
| Improve services using aggregated information | de-identified enquiry and trip trends | legitimate interests, provided individuals are not identified |
| Publish a testimonial or identifiable traveller media | name, words, image, voice and trip details | separate, freely given consent under Photo, Video & Testimonial Release |
3.1 Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing. Refusing optional marketing or media consent does not affect a Booking.
3.2 We do not use solely automated decision-making that produces legal or similarly significant effects. Trip-planner filtering only suggests matching website trips.
4. Who receives data
4.1 We use service providers that process data for us, including Resend for email delivery and any future contact list, Vercel for hosting, technical logs and cookieless website analytics, Hostinger for domain, DNS and mailbox services, and WhatsApp/Meta when you choose WhatsApp. Their own terms and privacy notices may apply where they act independently.
4.2 After you request or book services, we may share the minimum necessary information with hotels, camps, lodges, airlines, ground transport providers, guides, local operators, park and wildlife authorities, permit issuers, border or immigration authorities, insurers, emergency and medical providers, payment or banking providers, professional advisers and regulators.
4.3 We may disclose data where law requires it, to protect a person’s vital interests, to investigate fraud or an incident, to establish or defend legal claims, or as part of a corporate reorganisation subject to confidentiality and lawful safeguards.
4.4 We do not sell personal data. We do not share it for cross-context behavioural advertising. We do not disclose it merely because a third party asks.
5. International transfers
5.1 Our base is Kenya, but suppliers and technology providers may process data in Kenya, the destination country, the United States, the European Economic Area, the United Kingdom or other countries. Destination-country sharing is often necessary to perform the Trip.
5.2 For a transfer outside Kenya, we will use a lawful mechanism required by the Data Protection Act 2019 and the Data Protection (General) Regulations 2021, such as proof of appropriate safeguards, a binding contract, an adequacy basis, necessity for the contract or an emergency, or your explicit informed consent where permitted.
5.3 Where EU or UK law applies, we will use an adequacy decision or approved contractual safeguards and any needed transfer-risk measures. You may ask for information about the relevant safeguard, subject to lawful redactions.
6. Retention
6.1 We keep data only as long as needed for the stated purpose, legal obligations and reasonable claims. Our working periods are:
- unsuccessful enquiry: 24 months after the last meaningful contact;
- Booking, payment, tax and core contract record: seven years after the Trip ends or the record is created, whichever is later;
- passport, permit and routine health or accessibility documents: delete or securely redact within 30 days after the Trip unless law, an incident or a live claim requires longer;
- emergency contacts: 30 days after the Trip;
- newsletter record: until you unsubscribe or the address is persistently undeliverable, with a minimal suppression record retained to honour the opt-out;
- ordinary technical logs: 30 to 90 days unless needed for security investigation;
- complaints, incidents, insurance and legal claims: seven years after closure, or longer while proceedings are live;
- consent evidence and signed releases: seven years after the relevant use ends or consent is withdrawn.
6.2 Email copies may remain in controlled backup or archive systems until overwritten under provider schedules. We restrict their use during that period.
7. Security and breaches
7.1 We use proportionate access controls, strong authentication, least-privilege access, staff confidentiality, secure provider accounts, controlled exports, deletion routines and incident procedures. No internet or email system is completely secure.
7.2 We record and assess suspected personal-data breaches. Where Kenyan law requires, we will notify the ODPC without delay and, where reasonably practicable, within 72 hours after becoming aware; we will also notify affected people where required. Processors are required to notify us without delay and, where reasonably practicable, within 48 hours.
8. Children
8.1 Our website and general newsletter are not directed to children. A parent or legal guardian must provide and authorise personal data for a traveller under 18. We do not knowingly use a child’s data for profiling or direct marketing.
8.2 We process a child’s identity, age, travel, health or safeguarding information only as reasonably necessary to arrange and safely provide the Trip, meet law or protect vital interests. We verify parental or guardian authority where appropriate.
9. Your rights
9.1 Subject to applicable law, you may ask to be informed about our use, access your data, object to processing, correct inaccurate or misleading data, erase data, restrict processing, receive portable data, withdraw consent, object to direct marketing, and obtain safeguards information for an international transfer. EU and UK residents may also complain to their local supervisory authority.
9.2 Email info@creekstours.com with “Data request” in the subject. State the right you wish to exercise and enough detail to locate the records. We may request proportionate identity or authority evidence. We will respond within the period required by the applicable law. Under Kenya’s current General Regulations, access is ordinarily due within seven days, rectification, restriction and erasure within 14 days, and portability within 30 days; GDPR/UK GDPR requests are ordinarily due within one month, subject to lawful extensions.
9.3 You may complain to Kenya’s Office of the Data Protection Commissioner at https://www.odpc.go.ke/file-a-complaint/. Please contact us first if you are comfortable doing so, but that is not a condition of complaining to the ODPC.
10. EU and UK visitors
10.1 If the EU GDPR or UK GDPR applies to our offering or monitoring, the additional rights and safeguards in those laws apply. Contract necessity, legal obligation, vital interests, legitimate interests and consent are used only as those laws permit. Mandatory local rights are not displaced by Kenyan governing law.
10.2 Our EU representative is [EU representative name and contact] and our UK representative is [UK representative name and contact], if appointment is required.
11. California notice
11.1 In the preceding 12 months, we may have collected the categories described above: identifiers and contact information; customer records; commercial and transaction information; internet or network activity; approximate location inferred from communications; audio/visual information supplied under a release; and sensitive data such as passport, precise itinerary or health/accessibility information when necessary for travel.
11.2 We collect, use, retain and disclose those categories for the business purposes in clauses 3 and 4. We do not sell personal information or share it for cross-context behavioural advertising and do not knowingly do so for people under 16.
11.3 If the California Consumer Privacy Act, as amended by the CPRA, applies to us, California residents may request access, categories and specific pieces, correction, deletion and information about disclosures, and may exercise applicable opt-out or limitation rights without discrimination. Submit a request using clause 9.2. An authorised agent must provide lawful authority and we may verify the consumer directly.
12. Changes
12.1 We may update this policy to reflect law, suppliers or practices. We will post the new version and effective date and provide additional notice where a material change requires it.