Privacy Policy for NairobiPark.org

Last updated: 26 August 2026

This Privacy Policy explains how personal data is handled when you browse NairobiPark.org, use its safari calculator, submit an enquiry or quote request, communicate with the website team, or proceed with a safari quotation or booking.

NairobiPark.org is an independent visitor-information and safari-enquiry website. It is not Kenya Wildlife Service. Kenya Wildlife Service manages Nairobi National Park, official park entry, park rules and official ticketing.

NairobiPark.org is a website and brand operated by Kambu Campers Ltd, a private limited company incorporated in Kenya under the Companies Act (Cap 486, Laws of Kenya) in December 2022, company number PVT-AJUX6P9Z, holder of Tourism Regulatory Authority Class C tour or safari operator licence No. TRA1/22/C01/21003, of Kisiwa Close, Kianjogu, Nairobi, Kenya, postal address P.O. Box 948–00517, Uhuru Gardens, Nairobi, Kenya. Kambu Campers Ltd is the data controller for all the personal data described in this notice, from website browsing and enquiries through to quotations, bookings, payments and safari delivery.

1. Who is responsible for your personal data

The organisations below handle different parts of your interaction.

To avoid ambiguity, this notice names Kambu Campers Ltd directly instead of using “we”. NairobiPark.org is a website and brand, not a separate legal person, so a reference to NairobiPark.org is a reference to Kambu Campers Ltd acting through that website.

2. Scope of this policy

This policy applies when you:

• browse NairobiPark.org;
• use the safari calculator;
• submit the homepage safari quote form or another form specifically identified as covered by this notice;
• contact Kambu Campers Ltd by email, telephone or messaging service;
• request or receive a quotation;
• confirm, pay for or participate in a safari service; or
• provide a review, photograph, correction or other content.

It does not govern Kenya Wildlife Service, eCitizen, banks, mobile-money services, hotels, airlines, attractions or other independent websites and services. Their own privacy notices apply when you interact with them.

3. Personal data collected

Website and technical data

When you visit the site or submit the homepage quote form, Kambu Campers Ltd, its hosting service and relevant form or security providers process the technical data listed below where their configurations collect it:

• IP address;
• browser, device and operating-system information;
• requested page, referring page, date and time;
• form-delivery, spam, fraud and security signals; and
• SiteGround server access, cache and error logs, and the page-view records held by the site’s first-party Independent Analytics plugin, which records visits without cookies and without sending data to a third party.

Enquiry and quote-request data

Depending on the information you choose to provide, an enquiry may contain:

• name, email address, telephone or WhatsApp number;
• country of residence or KWS visitor category;
• preferred safari date and tour format;
• number of travellers in adult and broad child pricing bands;
• pickup area and, if you enter it, an optional hotel, airport terminal, residence or other precise pickup location;
• safari interests and practical-arrangement contact requests;
• the message or notes you enter; and
• the estimate, currency, source page and submission time attached to the quote request.

The general quote form is not intended to collect a child’s name, exact date of birth, contact details or health information. It is also not intended to collect passport or identity-document numbers, payment-card data or other sensitive personal data.

The exact pickup-location field is optional and is used only to assess pickup feasibility and prepare the requested quote. A precise pickup address can instead be collected after booking confirmation if it is not needed at the quote stage.

Quotation, booking and payment records

If you proceed with a safari, Kambu Campers Ltd may process quotation details, availability, itinerary, invoice information, deposit and balance status, transaction references, payer name, booking date, safari date, pickup and drop-off details, assigned vehicle or driver-guide, service notes and related correspondence.

The NairobiPark.org enquiry form does not collect full payment-card numbers, card-verification codes or mobile-money credentials. The relevant bank, mobile-money service or payment provider handles those details under its own privacy notice. Payments are taken through Pesapal, and by direct bank transfer or mobile money where that is agreed in writing for a specific booking. Kambu Campers Ltd receives a confirmation, payer name and transaction reference, not the underlying card or wallet credentials.

Sources of personal data

Personal data may come directly from you, from an adult authorised to act for a travel party or organisation, from a payment provider as a limited confirmation or transaction reference, or automatically from the website and its necessary technical services.

If you provide another person’s information, you must be authorised to do so for the relevant enquiry or booking purpose and provide only what is necessary.

4. Purposes and lawful bases

The following table describes the processing under Kenya’s Data Protection Act, 2019.

Requesting a quote does not enrol you in unrelated marketing. A required acknowledgement beside the quote form confirms that you have seen this Privacy Policy. It is not consent to every use of personal data. Any optional marketing choice must be separate, unchecked and voluntary.

5. Safari calculator and quote form

The calculator produces a non-binding planning estimate from the selections you make. Calculator selections are processed in your browser and are not transmitted as an enquiry until you submit the Formspree request or choose and send the email fallback. The email fallback creates a message containing calculator information for you to review in your email application before you send it. A final price, availability and service details are reviewed by Kambu Campers Ltd before a booking is confirmed or payment is requested.

Fields marked as required are needed to identify and respond to your quote request. If you do not provide them, the form cannot send the request or the recipient cannot answer it. Free-text fields not marked as required are optional. Some select and number controls display a default value; the value shown is sent unless you change it, so review every displayed selection before submitting.

Immediately before submission, the form identifies Formspree, explains the recipient and states that processing in the United States is involved. The flow is: Kambu Campers Ltd owns and controls the Formspree account for form mvzybyqv; your submission is sent from your browser to Formspree in the United States; Formspree screens it for spam and delivers it to the bookings mailbox that Kambu Campers Ltd’s reservations team monitors. No separate organisation sits between you and Kambu Campers Ltd. The required checkbox is a Privacy notice acknowledged field. It records that you saw the notice; it is not consent to every activity described in this policy.

6. Form service provider: Formspree

Kambu Campers Ltd owns the Formspree account and uses Formspree, Inc. for the homepage safari quote form. When you submit that form, the fields you complete, the estimate attached to the request and associated technical information are sent directly from your browser to Formspree. Formspree screens and routes the submission to the bookings mailbox monitored by Kambu Campers Ltd’s reservations team. It also stores the submission in dashboard history if storage is enabled for the account.

Formspree may process the form fields, IP address, browser type, referring page, access time and information used to detect spam, fraud or security threats. Its current documentation states that submissions are stored in the Formspree account unless storage has been disabled, and that copies may also be sent to a target email or enabled integration.

For homepage form ID mvzybyqv:

• the account is owned and controlled by Kambu Campers Ltd;
• Formspree dashboard storage is enabled;
• the configured recipient is the Kambu Campers Ltd bookings mailbox;
• access is limited to the Kambu Campers Ltd reservations team and the authorised account administrator;
• no autoresponder, webhook, CRM integration or third-party workflow is enabled for this form; and
• the applicable dashboard, spam, trash and backup retention periods are listed in Section 14.

To the extent that Formspree processes submissions only on Kambu Campers Ltd’s documented instructions, it acts as Kambu Campers Ltd’s processor. Any processing Formspree performs for its own stated purposes is described in the Formspree Privacy Policy. The account operates under Formspree’s published Data Processing Addendum and the subprocessors listed there, together with the documented instruction that submissions are used only to route and answer the enquiry.

Formspree states that its services are hosted on Amazon Web Services infrastructure in the United States and that it applies technical and organisational security controls described in its security information. The international-transfer issue is addressed in Section 13.

7. Kambu Campers Ltd and safari delivery

When Kambu Campers Ltd receives a safari request through the form described in Section 5, it uses the enquiry data to prepare and explain the quote, check availability, follow up on your request and, if you proceed, administer and deliver the booking.

For a confirmed safari, Kambu Campers Ltd may provide the minimum information needed to an authorised driver-guide, vehicle or transfer provider, attraction, accommodation provider or other supplier involved in the agreed itinerary. This normally means practical details such as the lead guest’s name, contact number, group size, pickup point, timing and itinerary. The supplier categories used are driver-guides and safari vehicle operators, accommodation and camp providers, transfer and airport-pickup providers, and balloon or activity operators where the itinerary includes them. Only the details each supplier needs for its own part of the itinerary are shared.

This notice covers the quotation, payment, booking, accounting and operational processing by Kambu Campers Ltd described here. Kambu Campers Ltd will give additional information at the collection point if it later asks for personal data for a new purpose not fully explained in this notice.

8. Other recipients

Personal data may be disclosed only where necessary for the stated purpose and with an appropriate legal basis. In addition to Formspree, relevant recipients may include the website’s hosting, email and security providers; Kambu Campers Ltd’s confirmed service suppliers; banks or payment providers; professional advisers; and a regulator, court or law-enforcement body where disclosure is legally required.

The current providers and recipients, verified against the published site on 25 August 2026, are:

• Hosting and content delivery: SiteGround, serving the site from Google Cloud infrastructure in the europe-southwest1 region, Madrid, Spain;
• Website platform: WordPress with the Astra theme, together with the GTranslate, Independent Analytics, Link Whisper, Tainacan, Sheets to WP Table Live Sync and Xagio SEO plugins;
• Web fonts: Google, which receives your IP address when the Astra theme loads its fonts from fonts.googleapis.com and fonts.gstatic.com;
• Form delivery and spam screening: Formspree, Inc., in the United States;
• Email: the provider hosting the bookings@nairobipark.org mailbox;
• Messaging: WhatsApp, where you choose to contact the team that way;
• Payments: Pesapal, and the receiving bank or mobile-money service for a direct transfer;
• Analytics: Independent Analytics only, which runs on the site’s own server, sets no cookies and sends nothing to a third party. No Google Analytics, advertising tag or social pixel is used; and
• Safari suppliers: the driver-guides, accommodation, transfer and activity providers described in Section 7.

The Formspree description in Section 6 applies only to the foooter form identified there. Other active forms on the site, their providers, fields, recipients and storage arrangements.

Kambu Campers Ltd does not send a visitor’s form submission to Kenya Wildlife Service or eCitizen merely because the website links to those services. If you use an official ticketing link, you provide information directly to the relevant official system.

9. Service communications and optional marketing

Kambu Campers Ltd may contact you by email, telephone or the messaging method you requested to answer an enquiry, prepare or explain a quote, check availability, administer a booking, coordinate logistics, provide a payment instruction, deliver support or communicate another service-related matter.

Optional marketing, if offered, uses a separate, voluntary choice and includes a simple withdrawal method. Opting out of marketing does not stop communications necessary for an active enquiry or booking.

10. Sensitive personal data and practical assistance

Do not enter medical information, diagnoses, allergies, passport or identification numbers, payment-card details, or information revealing religion, ethnicity or other sensitive personal data in the website form.

If you need practical assistance, use only the neutral option asking the team to contact you. Do not describe the underlying condition or diagnosis in the form. If further information is genuinely necessary for a confirmed service, Kambu Campers Ltd will explain an appropriate collection channel, purpose, lawful basis, access restriction and retention period before asking for it.

Formspree’s published Privacy Policy tells its customers not to use the service to collect sensitive personal data. Accordingly, the NairobiPark.org form does not invite medical, health, belief or similar information.

If sensitive personal data is submitted accidentally, Kambu Campers Ltd will restrict access and stop unnecessary onward sharing, remove the data from Formspree, email, integrations and exports where deletion is permitted, and retain only the minimum compliance record needed to document the response. If practical assistance is still needed, Kambu Campers Ltd may contact you through a more appropriate channel without repeating the sensitive detail.

11. Children’s data

The website and quote form are intended for adults aged 18 or over. A child should not submit personal data through the form.

For an initial family quote, provide only aggregate numbers in the broad pricing bands shown. Do not submit a child’s name, exact date of birth, contact information, health information or another identifying detail.

If information about a child later becomes necessary for a confirmed booking, the adult providing it must be the child’s parent or guardian, or be authorised by that person. Kambu Campers Ltd processes only the minimum information required, in the child’s best interests and with the authority and safeguards required by law.

12. Cookies and similar technologies

The essential cookies, local-storage items and similar technologies used to deliver pages, preserve necessary settings, protect forms or secure the website are:

• WordPress session and security cookies, which are set only if you log in to the site or post a comment. Ordinary visitors browsing and using the quote form are not logged in and do not receive them;
• a GTranslate language-preference cookie, set only if you choose a language other than the site default, so that the choice survives between pages;
• SiteGround caching and load-balancing identifiers used to serve pages correctly; and
• browser local storage used by the safari calculator to keep your selections on the page while you build an estimate. That information stays in your browser and is not transmitted until you submit the form.

On the pages checked on 25 August 2026 the site ran no Google Analytics, no advertising or remarketing tag, no social pixel, no embedded video and no embedded map. Two points still deserve a clear statement:

• Analytics: visits are measured by Independent Analytics, which runs on the site’s own server, sets no cookie, and does not send data to any third party. Because it neither stores information on your device nor profiles you across sites, it does not require a consent banner; and
• Web fonts: the Astra theme loads its fonts from Google. That sets no cookie, but it does disclose your IP address to Google each time a page loads. This is treated as a transfer in Section 13.

Where applicable law requires a choice, a non-essential technology is activated only after that choice has been obtained. If analytics, advertising, video or map embedding is added later, this section and a consent mechanism must be updated before that technology goes live.

You can manage cookies through your browser. Blocking a necessary technology may prevent part of the website from working.

13. Transfers outside Kenya

Formspree states that its services are hosted on Amazon Web Services infrastructure in the United States. Submitting the website form therefore transfers personal data outside Kenya.

Sections 48 and 49 of Kenya’s Data Protection Act and regulations 40 to 48 of the Data Protection General Regulations require an actual documented transfer basis. Formspree’s reference to European Standard Contractual Clauses does not, by itself, establish compliance with Kenya’s transfer rules.

The Kenyan basis relied on for the Formspree transfer is section 49(1)(b) of the Data Protection Act, 2019: the transfer is necessary to take steps at your request before entering a contract, because submitting the quote form is how you ask Kambu Campers Ltd to prepare a quotation. Without that transfer the form cannot deliver your request.

The safeguards relied on are Formspree’s published Data Processing Addendum and subprocessor list, its documented instruction to use submissions only to route and answer the enquiry, and its published security measures, which state at least TLS 1.2 in transit and AES-256 encryption at rest. Kambu Campers Ltd limits the data exposed to this transfer by keeping identity-document numbers, payment credentials and sensitive personal data out of the form entirely.

The other transfers outside Kenya are:

• SiteGround hosts the website on Google Cloud infrastructure in Madrid, Spain, so browsing the site processes your IP address and request logs in the European Union. The basis is necessity for the performance of the service you have asked for, supported by SiteGround’s data-processing terms and the European Union’s own data-protection framework;
• Google receives your IP address when the theme loads its web fonts. The basis is Kambu Campers Ltd’s legitimate interest in rendering the site’s typography. This transfer is avoidable, and Kambu Campers Ltd intends to remove it by serving the fonts from its own server; and
• Google Sheets receives content synchronised into the site’s published tables through the Sheets to WP Table Live Sync plugin. Those sheets hold published rate and planning information, not visitor personal data.

Pesapal processes payments within Kenya. Where a supplier for a confirmed itinerary is outside Kenya, only the practical details described in Section 7 are shared, and only for that booking.

14. Retention and deletion

Kambu Campers Ltd retains personal data only for the period necessary for the stated purpose. It then deletes or irreversibly anonymises the data unless an applicable law or active dispute requires a longer period. The schedule below states the trigger, period, reason, responsible controller and system or deletion executor. Where a period runs for seven years, that reflects the seven-year accounting-record period in section 636 of the Companies Act, 2015, which is longer than the five-year tax period in section 23 of the Tax Procedures Act, 2015 and therefore governs.

Kambu Campers Ltd may restrict and retain a record for longer where necessary to comply with a specific law, investigate fraud, resolve a dispute or establish, exercise or defend a legal claim. It must document the reason and delete the record when that exception ends.

15. Security and personal-data breaches

Kambu Campers Ltd uses technical and organisational measures appropriate to the personal data and risk. The measures applied to website and booking data are:

• Transport security: the whole site is served over HTTPS, and the quote form posts over TLS to Formspree;
• Access control: WordPress, Formspree, the bookings mailbox and the reservations records are reachable only through named individual accounts, with no shared logins, and access is limited to the reservations team and the authorised administrator;
• Authentication: multi-factor authentication is enabled on the WordPress administrator, Formspree and mailbox accounts, with unique passwords held in a password manager;
• Updates: WordPress core, the Astra theme and all plugins are kept current, and SiteGround applies server-level patching, firewalling and malware scanning;
• Backups: SiteGround takes daily backups on the 30-day cycle described in Section 14;
• Devices: company devices used for bookings require a screen lock and full-disk encryption;
• Confidentiality: staff and contracted driver-guides are told in writing to use guest data only for the assigned booking and to delete operational copies at service completion; and
• Data minimisation as a control: the quote form is deliberately built not to collect identity-document numbers, payment credentials or sensitive personal data, so that category of risk is largely designed out.

Formspree publicly states that it uses at least TLS 1.2 for network traffic, AES-256 encryption for databases at rest and access controls. These are Formspree’s statements about its service and do not replace Kambu Campers Ltd’s own assessment or responsibilities. No online service or transmission can be guaranteed completely secure.

Where unauthorised access to or acquisition of personal data creates a real risk of harm, Kambu Campers Ltd will notify Kenya’s Office of the Data Protection Commissioner without delay and within 72 hours after becoming aware of the breach. It will also communicate with affected people within a reasonably practicable period, subject to statutory exceptions. A processor must notify its controller without delay and, where reasonably practicable, within 48 hours.

16. Your privacy rights

Under Kenyan data-protection law, you may ask to:

• be informed about the use of your personal data;
• access personal data held about you;
• correct inaccurate, outdated or misleading data;
• object to processing and request restriction where applicable;
• request erasure where the law permits;
• receive portable data where applicable;
• withdraw consent for processing that relies on consent; and
• object to direct marketing at any time.

Withdrawal of consent does not affect processing that was lawful before withdrawal. Rights are subject to the limits and exceptions in applicable law.

Kenya’s Data Protection General Regulations provide response periods that include seven days for access, fourteen days for rectification, fourteen days to respond to an erasure request, fourteen days for an objection, and thirty days for portability, subject to the regulation’s conditions, exceptions and any permitted reasonable cost.

Send a request to the contact in Section 20. State whether it concerns website browsing, a Formspree submission, a safari quote or a confirmed booking, so the right record can be found quickly. Kambu Campers Ltd may request only the information reasonably needed to verify your identity and locate the record. Do not email an identity document unless Kambu Campers Ltd first explains why it is necessary and provides an appropriate method.

Where EU or UK data-protection law applies, additional rights and a right to complain to the relevant supervisory authority may apply.

17. Official systems and external websites

Kenya Wildlife Service and relevant government systems handle official Nairobi National Park entry, tickets, park rules and official support. Kambu Campers Ltd does not control those systems.

Links to eCitizen, Kenya Wildlife Service, airlines, hotels, payment services, maps, attractions, social platforms and other websites are provided for information or service delivery. The external organisation’s privacy notice applies when you use its website or service.

18. Reviews, photographs and other submitted content

Sending a review, photograph or other content does not automatically authorise public or marketing use. Identifiable guest content is published only after Kambu Campers Ltd records specific consent for the named content, purpose and publication channels.

Before sharing content, make sure you have the right to provide it and permission from every identifiable person shown or described. A parent or guardian must give the required authority for identifiable content involving a child. A person may withdraw consent for future use by contacting Kambu Campers Ltd. It will stop new use and remove controlled copies where applicable, subject to lawful limits and copies outside its control.

19. Changes to this policy

This policy may be updated when the website, forms, service providers, booking process, operating relationships or legal requirements change. The revised notice applies from the date shown at the top.

If a change introduces a new purpose that is incompatible with the purpose originally explained, Kambu Campers Ltd will provide additional notice and obtain fresh consent where the law requires it. Continued browsing is not treated as consent where a specific affirmative choice is required.

20. Contact details and complaints

Data controller for everything described in this notice

Controller: Kambu Campers Ltd
Company type: private limited company incorporated in Kenya under the Companies Act (Cap 486, Laws of Kenya) in December 2022
Company number: PVT-AJUX6P9Z
Tourism Regulatory Authority licence: Class C tour or safari operator, No. TRA1/22/C01/21003
Physical address: Kisiwa Close, Kianjogu, Nairobi, Kenya
Postal address: P.O. Box 948–00517, Uhuru Gardens, Nairobi, Kenya
Designated privacy contact: the Reservations Manager, Kambu Campers Ltd. No Data Protection Officer is appointed, because Kambu Campers Ltd does not carry out the large-scale or systematic monitoring that would require one
Privacy email: bookings@nairobipark.org
Telephone: +254 769 103 670
ODPC registration: :registration@odpc.go.ke

You may complain first to Kambu Campers Ltd, using the contact details above. You may also contact or lodge a complaint with Kenya’s Office of the Data Protection Commissioner. If another country’s data-protection law applies, you may also contact the competent authority there.