Privacy Policy

1. Who we are

This website is operated by Summit Horizon Journeys Company, a travel agency based in Nakuru, Kenya. In the language of Kenya's Data Protection Act 2019, we are the data controller for the information described in this policy — meaning we decide what is collected and what happens to it.

If you have any question about this policy, or about information we hold on you, contact us at info@summithorizonjourneys.co.ke.

2. What we collect

Information you give us

When you send an enquiry through this website — from the contact page, a tour page or a hotel page — we collect what you type into the form:

• Your name
• Your email address
• Your phone number, if you provide one
• Where you are based, if you provide it
• Your intended travel dates, number of nights, and how many adults and children are travelling
• Your budget range, if you select one
• Anything you write in the message field
• Which tour or property you were looking at when you enquired

If you contact us by phone, email or WhatsApp instead, we hold whatever you choose to tell us in that conversation.

Information collected automatically

When you submit an enquiry, our system also records:

• Your IP address
• Your browser and device type (the "user agent" your browser reports)
• The date and time of the submission

We record these to help identify automated spam and to investigate abuse of the form. They are not used to build a profile of you or to target advertising.

What we don't collect here

This website does not take payments, so we never see your card details or M-Pesa PIN on this site. If you later book with us, payment is arranged separately and any payment information is handled by the bank or mobile money provider, not stored by this website.

We do not ask for, and you should not send us through this website, sensitive information such as health conditions, religious beliefs or identity document numbers. If a trip genuinely requires such details — for example a dietary or mobility requirement affecting your itinerary — we will ask for it directly and only use it for that purpose.

3. Why we use it

We use the information you give us to:

• Reply to your enquiry and prepare a quote or itinerary
• Make bookings on your behalf with hotels, lodges, camps and airlines
• Contact you before, during and after your trip about the arrangements
• Keep a record of what we quoted and agreed, in case a question arises later
• Detect and block automated spam submissions
• Understand which pages and tours people are interested in, so we can improve the site

We do not send marketing emails from enquiries submitted through this site. If we ever introduce a newsletter, it will be something you opt into separately, and you will be able to unsubscribe from every message we send.

4. Our legal basis

Under the Data Protection Act 2019 we need a lawful basis for processing your personal data. Ours are:

5. Who we share it with

To arrange a trip we have to pass some of your details to the people actually providing it. Depending on your booking, that may include:

• Accommodation providers — hotels, lodges and camps need your name and the dates of your stay
• Transport operators and driver guides — your name, contact number and pick-up arrangements
• Airlines and flight agents — for domestic flights, the name exactly as it appears on your identity document, and your date of birth where required
• Park authorities — where entry requires a named list of visitors
• Emergency medical and evacuation providers — where cover is included in your package

We share only what each of them needs, and only for your specific booking.

Service providers

We also use a small number of technology providers to run this website:

• Our web hosting company, which stores the website and its database
• Our email provider, which delivers enquiry notifications and confirmations
• Google reCAPTCHA, which analyses form submissions to distinguish people from automated bots
• Google Analytics, which reports on how the website is used

Google is based outside Kenya, which means some of your information is processed abroad. Google publishes its own privacy policy describing what it collects and how.

Legal disclosure

We may disclose information where we are legally required to — for example in response to a valid order from a court or a request from a regulator or law enforcement agency acting within its powers.

What we never do

We do not sell your personal information, rent it, or trade it. We do not pass your details to third-party marketers or advertising networks.

6. Cookies and tracking

A cookie is a small file a website stores on your device. This site uses very few.

You can block or delete cookies through your browser settings. Blocking the session cookie will stop the enquiry forms from working, but the rest of the site will still be readable.

7. How long we keep it

We keep personal information only as long as we have a reason to.

You can ask us to delete your information sooner — see your rights below.

8. How we protect it

We take reasonable steps to keep your information secure:

• The website is served over an encrypted HTTPS connection
• Access to the administration area requires an individual username and password, and passwords are stored hashed rather than in readable form
• Only people who need access to enquiries in order to do their job have it
• Enquiry forms are protected against automated abuse
• The database is backed up regularly

No system is completely secure, and we cannot guarantee that information transmitted over the internet is entirely safe. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner and, where required, you directly.

9. Your rights

Under the Data Protection Act 2019 you have the right to:

• Be informed Know what we hold and what we do with it — which is what this policy is for.
• Access your information Ask for a copy of the personal data we hold about you.
• Correct it Ask us to fix anything inaccurate or incomplete.
• Have it deleted Ask us to erase your information where we no longer need it. We may have to keep some records where the law requires it — booking and payment records, for example.
• Object or restrict Object to how we're using your information, or ask us to pause using it while a concern is resolved.
• Data portability Receive the information you gave us in a commonly used, machine-readable format.
• Withdraw consent Where we rely on your consent, withdraw it at any time. This doesn't affect anything done before you withdrew it.

To exercise any of these, email info@summithorizonjourneys.co.ke. We will respond as soon as we reasonably can, and within the timeframe the law requires. We may need to confirm your identity first, so that we don't hand your information to someone else.

10. Children

This website is intended for adults arranging travel. We do not knowingly collect personal information directly from anyone under 18.

Where a booking includes children, we collect only what the trip requires — typically the number of children travelling, and their names and ages where an airline, park or property needs them. That information comes from the adult making the booking, who is responsible for providing it.

If you believe a child has given us personal information directly, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time — if we change how the website works, add a new service provider, or if the law changes. The date at the top shows when it was last revised.

Where a change materially affects how we use information we already hold about you, we will make reasonable efforts to tell you directly rather than relying on you noticing the update here.

12. How to contact us

For anything relating to this policy or to information we hold about you:

You can also reach the regulator directly: Office of the Data Protection Commissioner, Kenya.