Privacy Policy
This policy explains what personal information Volcan Tours & Travel collects when you use this website or travel with us, why we collect it, who sees it, and what you can ask us to do with it.
Last updated: 29 October 2026.
Who we are
Volcan Tours & Travel Limited is a tour operator registered in Kenya and licensed by the Tourism Regulatory Authority, with offices at 1st Floor, Luther Plaza, Nyerere Road, Nairobi (postal address: P.O. Box 50 – 90125, Konza Technopolis). For anything in this policy you can reach us at info@volcantours.com or +254 716 692 555.
Under Kenya’s Data Protection Act 2019 we are the data controller for the information described below. Where you are in the European Union or the United Kingdom, we also follow the General Data Protection Regulation (GDPR and UK GDPR) when we handle your information.
What we collect, and when
When you send us an enquiry
Our enquiry and quote forms ask for your name, email address, phone number, and whatever you choose to tell us about the trip you have in mind. We cannot answer you or price a safari without it.
When you book a call
Our Book a call form asks what you want to talk about, your preferred date, time and way of talking, your name, email address and mobile number, and any notes you add. We use these only to arrange and hold that call, and delete them automatically after 12 months unless the call leads to a booking.
When you book
To confirm a booking we need more: passport details for park permits and internal flights, dates of birth where an airline or park authority requires them, and any dietary or medical information you choose to share so that camps and guides can look after you properly.
Health and dietary information is sensitive personal data. We collect it only when you volunteer it and give your consent, we share it only with the specific camp, lodge or guide who needs it to look after you, and we delete it once your trip is over unless you ask us to keep it on file for a future booking.
When you sign up for our newsletter
If you tick the newsletter box, we keep your email address to send you a few emails a year about the migration, new routes and the best months to travel. We never add you because you sent an enquiry, and every email has a link to unsubscribe.
When you visit the site
Our hosting provider keeps standard server logs, including IP addresses, for security and troubleshooting. Google Analytics runs, and its cookies are set, only if you accept it in the cookie banner (see Cookies below). We also count page views on our own server without cookies: IP addresses are not stored, a one-way code that changes every day counts each device once per day, and these counts are deleted after about 13 months.
Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering enquiries and preparing quotes | Steps you asked us to take before a contract |
| Arranging and holding a call you booked | Your consent, given on the form |
| Arranging and running your safari, including permits, lodges and flights | Performance of our contract with you |
| Health and dietary details | Your explicit consent, which you can withdraw at any time |
| Newsletter | Your consent |
| Website analytics cookies | Your consent, given in the cookie banner |
| Accounting, tax and licensing records | Our legal obligations in Kenya |
| Keeping the website secure | Our legitimate interest in protecting the site and our customers |
What we do not do
- We do not sell your personal information, to anyone, for any purpose.
- We do not use your information to build an advertising profile of you, and we do not run advertising cookies on this site.
- We do not make decisions about you by automated means alone.
Who we share it with
Running a safari means other people have to know you are coming. Depending on your itinerary we share what is strictly necessary with:
- the camps, lodges and hotels you are staying at;
- park and conservancy authorities, for permits and entry, including gorilla trekking permits which are issued against your name;
- airlines and charter operators, for internal flights;
- our own guides and drivers.
We also use service providers who process data on our behalf and only on our instructions: our website host, our email provider, Trustindex (review widget) and Google (website analytics, only with your consent). Pesapal, which processes card payments, and WhatsApp, which carries messages you choose to send us, handle your information as independent providers under their own privacy policies.
Sending information outside Kenya
Some of the parties above are in Tanzania, Uganda, Rwanda, the European Union, the United States or elsewhere. We send only what your trip or the service requires. We do so because the transfer is necessary to perform our contract with you, because you have consented, or because the recipient gives appropriate safeguards for your information, as the Data Protection Act 2019 and the GDPR allow.
How we keep it safe
The site runs over an encrypted connection, access to booking records is limited to the staff who need it, card details are entered on Pesapal’s secure page and never reach us, and we keep our systems updated and protected by a firewall. If a breach ever put your information at risk, we would notify the Office of the Data Protection Commissioner and you, as the law requires.
How long we keep it
Enquiries that do not become bookings are kept only for as long as we need them to answer you and follow up, and we delete them sooner if you ask. Call requests are deleted automatically after 12 months. Booking records are kept for as long as Kenyan tax and accounting law requires. Sensitive health and dietary details are deleted after your trip unless you ask otherwise. Newsletter details are kept until you unsubscribe.
Children
We collect details about children only from the parent or guardian booking for them, and only what lodges, airlines and park authorities need. This website is not aimed at children and we do not knowingly collect information from them directly.
Your rights
Under the Data Protection Act 2019, and the GDPR where it applies, you can ask us to:
- tell you what personal information we hold about you, and give you a copy;
- correct anything that is wrong;
- delete information we no longer have a reason to keep;
- restrict or object to how we use your information;
- hand your information to you or another provider in a portable format;
- withdraw any consent you have given, at any time, without affecting what we did before.
Write to info@volcantours.com. We will reply within the time the law sets and never charge for a reasonable request. If you are not satisfied, you can complain to the Office of the Data Protection Commissioner in Kenya, or to the data protection authority in the country where you live.
Cookies
When you first visit, a banner asks whether you accept Google Analytics. Until you accept, the Google Analytics script is not loaded and nothing about your visit is sent to Google. If you accept, your browser loads Google’s analytics script, Google receives your IP address, the pages you view and technical details about your browser and device, and the cookies below are set. If you decline, or later withdraw your choice, the script is not loaded again and any Google Analytics cookies are removed. You can change your mind at any time from the Cookie settings link at the foot of every page, and every part of the site works whichever choice you make.
| Cookie | Set by | Purpose | Needs consent |
|---|---|---|---|
| volcan_consent | This site | Remembers your cookie choice for 6 months | No, strictly necessary |
| _ga, _ga_* | Google Analytics | Counts visits and shows which pages are useful | Yes |
| wordpress_*, wp-settings-* | This site | Only for staff logged in to the administrator area | No |
You can also block or delete cookies in your browser settings; the site works without them.
If you message us on WhatsApp, your messages are handled by WhatsApp (part of Meta) under its own privacy terms. We use them only to answer you and to plan your trip.
Online payments
Card payments made through the secure link we send you are handled by Pesapal on its own secure payment page. We receive confirmation of the payment, never your card details.
Reviews
Our Google reviews are shown on this site through a review widget provided by Trustindex. When a page with reviews loads, your browser fetches the widget files from Trustindex (cdn.trustindex.io) and the reviewers’ profile pictures from Google (lh3.googleusercontent.com). As with any file fetched from another website, those requests carry your IP address and standard browser details. Trustindex provides the widget as our service provider; Google receives the picture requests as an independent controller under its own privacy policy. We send neither of them anything else about you.
Changes to this policy
If we change how we handle personal information we will update this page and the date at the top. Material changes affecting existing customers will be sent by email.
See all our policies and legal information in one place.
