Privacy Policy

1. Information we collect

Information you give us:

• Contact and planning details: your name, email, phone number, city, state or province, organization, travel dates, group size, budget, interests, how you heard about us and any notes you add.
• Booking details: the names of travelers, contact details, number of travelers and any requests. For the trip itself we may ask for passport details, date of birth, dietary and accessibility needs, medical information you choose to share for your safety, emergency contacts and insurance details. We ask for these only when they are needed to book flights, lodges, park permits or activities.
• KESCA applications: age, education status, location, connection to Kenya, Swahili level and a personal statement. For applicants under 18, a parent or guardian's name, email and phone.
• Reviews and messages you send us, answers to our traveler feedback survey (used for research into what travelers want), and your choices about marketing emails.
• Group and referral programs: the group name and message an organizer writes, and referral code holders' names and contact details.

Information collected automatically:

• Usage and device information through Google Analytics and Vercel Web Analytics: pages visited, the page that referred you, approximate location derived from your IP address, browser and device type. Google Analytics uses cookies; Vercel Web Analytics does not.
• If we run a session-recording tool such as Microsoft Clarity, it records clicks, scrolling and mouse movement on our pages so we can see where the site is hard to use. It masks what you type into forms, and we never use it to identify you.
• If we advertise, the Google Ads and Meta (Facebook and Instagram) tags tell those companies when someone who saw our ad visits, sends an enquiry or books, so we can measure our ads and show them to people likely to be interested.
• The page you came from and campaign tags (UTM parameters), so we know which pages and campaigns work.
• A referral cookie when you follow a referral link (/r/CODE), kept for 60 days so the code applies at checkout.
• Sign-in cookies when you log in, and your saved shortlist of trips, which stays in your own browser.

Information from others: payment confirmations from Stripe (we never receive your full card number), and details a group organizer, family member, school or church gives us when booking on behalf of a group. If you give us information about other travelers, please make sure they are happy for you to do so.

2. How we use it

• To answer inquiries, prepare quotes and plan trips.
• To take bookings and payments, run monthly payment plans, send confirmations, reminders (for example, about the eTA) and trip documents.
• To book flights, lodges, guides, transport, permits and activities with our suppliers, and to look after your safety and wellbeing during the trip.
• To review and manage KESCA applications, including contacting a parent or guardian for applicants under 18.
• To run group pages and referral codes, including showing an organizer who has booked and paying rewards to code holders.
• To publish reviews you send us.
• To send marketing emails if you asked for them. You can unsubscribe at any time.
• To understand how the website is used and improve it, prevent fraud and misuse, keep records for tax and accounting, and meet our legal obligations.

3. Who we share it with

We share personal information only as needed for the purposes above:

• Our partner companies GCK Travel and Roundtrip Safaris, which plan and operate trips with us. Group, school, church and corporate inquiries usually go to GCK Travel, and leisure and safari inquiries to Roundtrip Safaris.
• Travel suppliers in Kenya and elsewhere, such as airlines, lodges, camps, guides, ground transport, park and conservancy authorities, and emergency evacuation providers, who need your details to provide your trip.
• Service providers who run parts of our business for us: Stripe (payments, including pay-later options such as Affirm and Klarna, which have their own privacy policies), Microsoft Clarity (site usage), Google and Meta (advertising measurement, when we advertise), Supabase (secure database), Vercel (website hosting), Resend (email delivery), Google (analytics) and the customer-management and workspace tools our team uses. They may use your information only to provide services to us.
• Insurers, professional advisers and authorities when required by law, to protect someone's safety, or to establish or defend legal claims.
• A buyer or successor if our business is sold or reorganized, under the same protections.

We do not sell personal information. If we advertise on Google, Facebook or Instagram, their tags on our site may count as sharing for targeted advertising under some state laws; you can opt out at any time as described in section 8, and we honor Global Privacy Control signals.

4. International transfers

We are based in the United States, and our trips take place in Kenya. To provide your trip, we send the details our Kenyan suppliers need to them in Kenya, and our service providers may process information in the United States and other countries. Kenya has its own data protection law, the Data Protection Act, 2019, and we expect our suppliers to protect your information. Where we transfer information, we take reasonable steps to keep it safe.

5. How long we keep it

• Inquiries and quotes that do not become bookings: up to three years after our last contact with you.
• Bookings, payments and related records: seven years after your trip, for tax, accounting and legal purposes.
• KESCA applications: up to three years after the cohort year, unless you enroll, when the booking period applies.
• Marketing email lists: until you unsubscribe.
• Analytics data: up to 14 months.

We delete or anonymize information when we no longer need it.

6. How we protect it

We use encrypted connections, access controls so that only team members who need information can see it, and established providers with strong security. Card payments are handled by Stripe, which is certified to the PCI DSS standard. No system is perfectly secure, and we will tell you, and the authorities where required, if a breach affects your information.

7. Your choices and rights

You can ask us to tell you what personal information we hold about you, to give you a copy, to correct it, or to delete it. You can also ask us to stop using it for marketing, and opt out of any targeted advertising or sale (we do neither). Depending on where you live, including New Jersey, California and other U.S. states, Canada or Kenya, the law may give you these and other rights. We will respond within the time the law requires, and we will not treat you differently for using your rights.

To make a request, email kibetck@kenyaexperience.org. We may need to confirm your identity first. You can appeal our decision by replying to our answer. If you are not satisfied, you may contact your state attorney general or, in Kenya, the Office of the Data Protection Commissioner.

We will need some information to complete a booking we have already agreed, and we may have to keep some records for legal reasons, but we will explain that if it applies.

8. Cookies and analytics

We use a small number of cookies: sign-in cookies so you stay logged in, the 60-day referral cookie, Google Analytics cookies to measure visits, and, when they are switched on, cookies from Microsoft Clarity, Google Ads and Meta. You can block or delete cookies in your browser settings, or use Google's opt-out add-on at tools.google.com/dlpage/gaoptout. Blocking sign-in cookies will stop you from signing in. We honor Global Privacy Control signals as a request to opt out of any sale or targeted advertising: when your browser sends one, we do not load the Google Ads or Meta tags.

Our home page shows a post from our Instagram account. It loads only when you scroll to that section. When it loads, Instagram (Meta) receives your IP address and browsing information and may set its own cookies, under its own privacy policy. Our TikTok, Facebook and X links on that page are plain links and load nothing until you click them. If you would rather Instagram did not load, do not scroll to that section, or block third-party cookies in your browser.

9. Children

Our website is not directed to children under 13, and we do not knowingly collect personal information from them. Young people aged 13 to 17 may apply to KESCA only with a parent or guardian's details, and travelers under 18 travel only with a parent or guardian or in a supervised program with their written consent. If you believe a child under 13 has given us information, contact us and we will delete it.

10. Marketing emails

We send marketing emails only to people who asked for them. Every email includes an unsubscribe link, and unsubscribing does not affect emails about a booking you have made.

11. Changes to this policy

We may update this policy as our services change. The date at the top shows when it last changed. If we make a significant change, we will tell you by email or on the website before it applies to information we already hold.

12. Contact

Kenya Experience LLC, New Jersey, United States. Email: kibetck@kenyaexperience.org.