Legal & Compliance

Privacy Policy

Effective Date: [TBC: launch date]Last Updated: [TBC: launch date]

This policy explains how Summit collects, uses and protects your personal information when you visit our website, make an enquiry or book a journey with us.

Article 1: Who We Are

[TBC: Company Name Ltd] (“Summit”, “we”, “us” or “our”) is committed to protecting and respecting your privacy. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the data controller.

  • Registered office address: 66 Paul Street, London, England, EC2A 4NA
  • Company registration number: 17236605
  • ICO registration number: [TBC]
  • Data privacy contact: [TBC: email address, e.g. privacy@domain.com]

Article 2: Information We Collect About You

Types of Personal Data

We may collect, use, store and transfer the following kinds of personal data about you:

  • Identity Data: first name, last name, title and, where your journey requires it, date of birth and nationality.
  • Travel Document Data: passport number and expiry, and visa or entry-permit details, which we need for park permits, hotels and border formalities.
  • Contact Data: email address, telephone and WhatsApp numbers, billing address and emergency contact details.
  • Financial Data: payment card and bank details. These are processed securely by our booking and payment provider [TBC: WeTravel] and its payment processors. We do not store full card details.
  • Transaction Data: details of payments to and from you, and of the journeys and services you have booked with us.
  • Technical Data: internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
  • Profile Data: your enquiries, bookings, preferences, feedback and survey responses.

Health and Dietary Information

To plan a safe and comfortable journey, we may ask about allergies, dietary requirements, medical conditions and accessibility needs. Some of this is “special category” data: health information, and dietary requirements that can reveal religious belief. We collect it only with your explicit consent and use it only to plan and deliver your journey. You can withdraw your consent at any time, although we may then be unable to cater for your needs.

Methods of Collection

  • Direct interactions: when you complete an enquiry or booking form, or contact us by email, WhatsApp, telephone or social media.
  • Automated technologies: as you use our website, we collect Technical Data using cookies and similar technologies. See Article 9.
  • Third parties: our booking and payment provider and our analytics providers.

Article 3: How We Use Your Personal Data

We will only use your personal data when the law allows us to. Most commonly, we use it:

  • To perform the contract we are about to enter into or have entered into with you, for example to respond to your enquiry, manage your booking and plan and deliver your journey.
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests, for example to keep our website secure and to understand how it is used.
  • To comply with a legal obligation.
  • With your consent, where the law requires it: for health and dietary information, for non-essential cookies, and for marketing emails.

We will only send you marketing about our journeys if you have asked us to or have opted in, and you can opt out at any time.

Article 4: Disclosures of Your Personal Data

We may share your personal data with trusted third parties so that we can run our business and deliver your journey:

  • Local partners who deliver your journey, such as our ground operator, guides, hotels and transport providers. They receive only the details they need, for example your name, passport details, dietary needs and arrival information.
  • Service providers acting as processors, including IT and system administration providers, hosting providers (such as Vercel), content management platforms (such as Sanity), our booking and payment provider [TBC: WeTravel], and analytics providers (such as Google Analytics, only if you consent).
  • Professional advisers including lawyers, bankers, auditors and insurers.
  • HM Revenue & Customs, regulators and other authorities based in the United Kingdom who require reporting of processing activities in certain circumstances and, where your journey requires it, authorities in the countries you travel to, such as national park and immigration authorities.

We do not sell your personal data.

Article 5: International Transfers

Your journey takes place outside the UK, so we and our partners need to use your personal data in other countries, including Tanzania [TBC: and Kenya, where part of our website and systems is maintained]. Some of these countries do not have the same data protection laws as the UK.

If we transfer your personal data out of the UK, we make sure it receives a similar degree of protection by using safeguards approved by the UK Information Commissioner's Office, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Where a transfer is necessary to carry out your booking, we may instead rely on the exceptions the law allows. Contact us if you would like more information on the safeguards we use.

Article 6: Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to those employees, partners and contractors who have a business need to know, and they are subject to a duty of confidentiality. We have procedures to deal with any suspected data breach, and we will notify you and the Information Commissioner's Office where we are legally required to do so.

Article 7: Data Retention

We keep your personal data only for as long as we need it for the purposes we collected it for, including to satisfy legal, accounting or reporting requirements. [TBC: retention periods, for example booking and financial records for six years; enquiries that do not lead to a booking for [x] months; health and dietary information deleted [x] days after your journey ends.]

Article 8: Your Legal Rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data, including the right to:

  • Request access to your personal data.
  • Request correction of your personal data.
  • Request erasure of your personal data.
  • Object to processing of your personal data.
  • Request restriction of processing of your personal data.
  • Request transfer of your personal data.
  • Withdraw consent at any time.

We try to respond to all legitimate requests within one month. To exercise any of these rights, contact us at [TBC: email address]. If you are unhappy with how we handle your personal data, you also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Article 9: Cookies and Similar Technologies

Our website uses cookies and similar technologies. Essential cookies keep the site working. We use analytics and marketing cookies only if you accept them through our cookie banner, and you can change your choice at any time. See our [Cookie Policy] for details.

Article 10: Changes to This Privacy Policy

Any changes we make to this policy in the future will be posted on this page and, where appropriate, notified to you by email.

Article 11: Contact for Inquiries

For any question about this policy or your personal data, contact [TBC: email address].