Privacy policy

Who processes the data

The data controller is John Nyale, trading as JamboJohn, based in Watamu, Kilifi County, Kenya. For any question or request about personal data the address is info@jambojohn.com: the request comes straight to me. The business is based in Kenya and also deals with people located in the European Union: this page therefore describes the rights granted by European Regulation 2016/679, because that is the framework most of the people who write to me deal with.

What data the contact form collects

The form on the site asks for the minimum needed to answer a travel enquiry. Specifically, it collects:

• the name you want to be called by;
• the contact detail you choose, e-mail or WhatsApp number: one of the two, not necessarily both;
• the travel period, even if given only as a month or as “still to be decided”;
• the number of people and, if children are travelling, only the age ranges, with no names and no dates of birth;
• the interests selected, for example savannah, sea, nature or culture;
• the free-text message you write, with whatever you decide to tell me.

No identity documents, payment details, health information or other data not listed on the form are requested. If you spontaneously write further information in the free-text message, it stays in the message: it is not organised into records and it is not used for profiling.

Why they are collected, for how long and with whom

The only stated purpose is to answer the enquiry and, if it leads to a booking, to manage it. There are two legal bases: answering an enquiry and preparing a possible proposal are pre-contractual steps you have asked for; handling a confirmed booking is performance of the agreement. Retention periods are these: enquiries that do not become bookings are kept for 180 days from the last exchange of messages and then deleted; actual bookings are kept for 5 years from the travel date, so that disputes can be answered and accounting obligations met; newsletter subscribers are kept until they unsubscribe, and every email carries an unsubscribe link.

To organise an experience, some information necessarily has to go out: a lodge needs the names in order to register an arrival, a transport supplier needs to know how many people there are and at what time. The recipients are only those needed to make the experience happen: the places you sleep (name and number of people), the suppliers of vehicles and park entries (number of people, date and time), the email provider I write to you with, and the site's hosting provider. There are no other recipients, and the data is neither sold nor passed to anyone for advertising.

Your rights, and how to exercise them

• to know which data is held and to obtain a copy of it;
• to have it corrected if it is wrong or incomplete;
• to ask for it to be erased;
• to ask for the processing to be restricted, or to object to certain uses;
• to receive the data in a readable format;
• to withdraw a consent already given, without that making what happened beforehand unlawful;
• to complain to a supervisory authority.