Privacy policy

Notice provided pursuant to Articles 13-14 of Regulation (EU) 2016/679 ("GDPR").

1. Data controller

The data controller is Olimpo Code, VAT no. 04601160981, registered office at Paratico, Brescia, who can be contacted at info@abdullsafarikenya.com or at info@abdullsafarikenya.com.

2. What data we process

• Contact and enquiry data: name, email, phone/WhatsApp, language, content of the request.
• Travel data: dates, number of adults and children, children's exact ages (needed to calculate applicable prices and conditions), preferences (e.g. private or shared jeep), departure location, free-text notes.
• Payment data: amount, outcome, date and transaction identifiers. Card details are entered directly on Stripe's payment page: they never pass through or get stored on our systems.
• Communications: emails and messages exchanged to handle quotes and bookings.
• Technical data: essential technical logs generated by the hosting provider for security and site operation.

We do not process special categories of data; please do not include them in free-text notes unless strictly necessary (e.g. dietary or mobility needs, which we process only to organise the requested service).

3. Purposes and legal bases

| Purpose | Legal basis | | --- | --- | | Responding to quote requests and managing bookings | Pre-contractual measures / performance of a contract (Art. 6(1)(b) GDPR) | | Forwarding the request to the tour operator in Kenya to deliver the service | Performance of a contract (Art. 6(1)(b) GDPR) | | Collecting the deposit and issuing receipts and documents | Performance of a contract and legal obligation (Art. 6(1)(b) and 6(1)(c) GDPR) | | Administrative and accounting obligations | Legal obligation (Art. 6(1)(c) GDPR) | | Website usage statistics (only with consent to analytics cookies) | Consent (Art. 6(1)(a) GDPR) | | Aggregated anonymous cookieless statistics (Umami, self-hosted) | Legitimate interest (Art. 6(1)(f) GDPR) |

We do not carry out profiling or automated decision-making.

4. Recipients and transfers outside the EU

The data needed to organise the trip is forwarded to the tour operator in Kenya, Abdi Shee Bakari - Abdull Safari Kenya, who processes it as an independent controller in order to deliver the booked service. Kenya is not covered by a European Commission adequacy decision: the transfer takes place under Art. 49(1)(b) GDPR, as it is necessary for the performance of the contract requested by the data subject.

Online payments are handled by Stripe Payments Europe, Ltd., which processes payment data as an independent controller to provide the service, prevent fraud and meet its own legal obligations: see Stripe's privacy policy.

We also rely on technical providers acting as data processors:

• Vercel Inc. - website hosting;
• Supabase Inc. - application database;
• Resend (Plus Five Five, Inc.) - sending and receiving service emails.

These providers may process data outside the EU on the basis of Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework.

5. Retention periods

• Quote requests not resulting in a booking: up to 24 months from the last contact.
• Booking and payment data: 10 years for civil-law and tax obligations.
• Technical logs: short periods defined by the hosting providers.

6. Your rights

You may at any time exercise the rights provided for by Articles 15-22 GDPR: access, rectification, erasure, restriction, portability, objection and withdrawal of consent (without affecting the lawfulness of prior processing). Write to info@abdullsafarikenya.com.

You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

7. Provision of data

The data requested in the forms is necessary to answer your request: without it we cannot prepare the quote or manage the booking. Optional fields are marked as such.

8. Cookies

For the use of cookies see the Cookie policy.