Privacy
Privacy policy
What you share with us when you ask for a safari, what we use it for and how you can see, correct or delete it.
Who is responsible
The controller of your data is Tumbili Safaris, based in Arusha, Tanzania. For any privacy question, write to us at info@safaristumbili.com.
What we collect
Only what you give us:
- In the safari planner: your name and phone number; your email address, if you choose to give it; how many adults and children are travelling (never their names); when you would like to go; and, if you tell us, anything you would like to add to the trip and what you write in your message.
- If you email us or message us on WhatsApp, whatever you include in your message.
When you would like to travel (“not yet” is fine), your name and a phone number are required: without them we cannot prepare a proposal or call you. Everything else is optional.
Please do not include health details or other sensitive data in your message. If the trip needs them, such as a special diet or reduced mobility, we will talk about it when you book.
What we use it for
To review your request, prepare a trip proposal and call or write to you to talk it through. We do not use it to send you advertising, and we do not make automated decisions or build profiles with it.
If you decide to travel with us, we will ask at that point for the details the booking needs and tell you who they are passed to (lodges, national parks or airlines, depending on the trip).
Legal basis
Handling the request you make: these are steps taken at your request before a possible travel contract (Article 6(1)(b) of the GDPR). The box in the form only confirms that you have read this information; it is not consent. If you ask us to stop using your data, we will.
Who else is involved
We do not sell or share your data with anyone. To run the website and our email, we rely on these providers:
- Cloudflare: hosts the website, receives the form and forwards our email.
- Resend: delivers each request to us by email.
- Google (Gmail): the inbox where we read the requests.
All three are US companies certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as an adequate safeguard for these transfers.
Our team works from Tanzania, outside the European Economic Area, so that is where your request is read and answered.
If you choose to message us on WhatsApp, that channel is provided by WhatsApp (Meta), under its own privacy terms.
How long we keep it
For as long as it takes to handle your request. If you do not end up travelling with us, we delete it no later than twelve months after our last contact. If you do travel, we keep what is strictly necessary for as long as tax and accounting rules require.
The website’s technical logs delete themselves after a few days.
Your rights
You can ask to access your data, have it corrected or deleted, restrict or object to its use, and receive it in a commonly used format. Just write to info@safaristumbili.com saying what you need; we reply within one month at the latest.
If you feel we have not handled your request properly, you can complain to the data protection authority in your country. You can also contact the Personal Data Protection Commission of Tanzania (PDPC).
Children
The form must be filled in by an adult. For children who travel, we only ask how many there are, never their names.
Security
The website is always encrypted (HTTPS), and requests are only read by the people on our team who plan your trip.
Laws we follow
We comply with the European Union’s General Data Protection Regulation (GDPR), because we serve travellers who live in the EU, and with Tanzania’s Personal Data Protection Act of 2022.
Changes to this policy
If we change it, you will see it on this page, with the date it was updated.
Last updated: 5 October 2026.