Privacy Policy

This privacy policy sets out how Exploits Travel collects, uses, discloses and protects your information.

Your privacy and trust are important to us, and this Privacy Policy (“Policy”) provides important information about how Exploits Travel (“we” or “us”) handle personal information. It sets out the types of personal information we receive and collect when you use our services, how we collect it, and what we do with it, as well as some of the steps we take to safeguard information.

This Policy applies to personal information that we process in the course of doing business, including information processed through Exploits Travel’s website and in the course of providing you with our travel services (collectively, our “Services”).

We will ensure that any personal information you provide to us will only be collected, used and disclosed in accordance with this Privacy Policy.  We hope this will help you make an informed decision about sharing personal information with us. In all your dealings with us you must ensure that others you represent are aware of the content of our Privacy Policy and consent to your acting on their behalf.

Please read this Policy carefully and contact us if you have any questions about our privacy practices or your personal information choices. You can always check back for updates to this Policy. If we make changes we consider important, we will notify you by placing a notice on our website and/or contacting you using other methods, such as email.

Information we collect about you

Depending on the circumstances, in the course of providing a service to you, Exploits Travel may collect and hold personal information such as:

• your name, date of birth, gender, postal address, telephone number, email address, passport details, medical information and travel insurance details (where applicable);
• details of the products and services you have purchased from us or which you have enquired about, together with any additional information necessary to deliver those products and services and to respond to your enquiries; and
• any additional information relating to you that you or a third party has provided to us directly or indirectly through our travelers’ or agents’ phone enquiry lines, websites, online presence, customer surveys or to our in-store or other representatives.

Information that we collect (such as about your health, age, sex) may be considered “sensitive information” under the Privacy Act.  We collect it to provide you with our services, cater to your needs, or act in your interest, and we are only prepared to accept sensitive information on the condition that we have your consent.

If you visit our website, we may also collect information that is not personal information to improve the experience for our customers. This information may include the pages you visit, your IP address, browser type and language, and the date and time of your visit. We cannot identify you individually from this information. Some of this information is collected using cookies.

When you are travelling with us, we may take video and images of you that may be used in brochures, in our advertising or on our website. All participants of Exploits Travel trips authorize us to use his/her image (such as a photograph, videotape, film or pictorial representation or recorded voice). If you do not wish for this to happen, please notify us in writing at exploitstravel@gmail.com.

How we collect personal information

You may volunteer this information when you request information from us, contact us (and vice versa), make a booking, register interest for and/or enter a competition, subscribe to one of our newsletters, use our website(s), link to or from our website(s), connect with us via social media, by speaking to a consultant in-store or any other engagement we or our business partners have with you.

We may also receive the information from a third party, for example:

• from individuals making travel bookings on your behalf;
• from market research and data companies contracted by us to obtain information so that we may improve and market our products and services;
• from other companies within the Exploits Travel and our related entities;
• from partners performing services on our behalf; and
• your insurer, their agents or medical staff may disclose relevant information and sensitive personal information with us in circumstances where we/they need to act on your behalf or in the interest of passengers or in an emergency.

We will always update your information whenever we can to keep it current, accurate and complete.

You represent and warrant to us that you have obtained all required consents and are fully authorized to disclose all personal information you provide to us including without limitation personal information of your friends and family members provided in connection with making travel bookings.

Why do we collect, use, hold and disclose your information?

We collect personal information about you so that we can perform our business activities and functions and to provide the best possible quality of customer service.

We may collect, hold, use and disclose your information for the following purposes:

• administering services we are providing to you such as arranging your tour booking
• some countries will only permit travel if you provide your advance passenger data.  These requirements may differ depending upon your destination and you are advised to check.  Even if not mandatory, we may exercise our discretion to assist where appropriate
• manage our relationship with you, including updates about your tour booking and handling complaints
• to contact you in the event of an emergency
• combining information collected from you at different times for the purpose of research and analysis to provide a better customer experience, including customizing online content for you
• to identify and tell you about services we think you may be interested in, including sending email newsletters or sending printed materials to your postal address
• providing relevant information, which may include sensitive personal information, to insurers, their agents and medical staff in circumstances where we/they need to act on your behalf or in the interest of passengers or in an emergency.
• to make improvements to our site(s) and make it easier to find the information you are looking for
• for identification of fraud or error or for regulatory reporting and compliance

1. You have booked or are booking your travel through Exploits Travel

When you book your travel through us, we collect certain personal information from you so we can provide our Services to you. We have set out the type of personal information we collect, the purpose for collecting it, the lawful basis for collecting it, and the length of time we keep that information.

When you provide your personal information to Exploits Travel to make an online booking, they may be retained even if the transaction is not completed. These details are captured using a secure service. This is so we can assist you with future online bookings, and as a result of this you may receive a follow up enquiry email. This email will contain information on what action, if any, you can choose that will direct us to cease any further contact with you or destroy the personal information we have collected about you.

We are only permitted to store your personal information for as long as necessary having regard to the purposes for which it was collected or a related or ancillary purpose.  We may therefore delete your personal information after a reasonable period of time and, if you have not used our services for some time, you may have to re-enter or re-supply your personal information to us..

2. You are a prospective customer

We will collect and store personal information, including contact details, of those who have completed our website enquiry form, expressed an interest in arranging a safari through Exploits Travel, or signed up to receive our newsletters.

We may contact you in response to your enquiry. We may also provide you with information about other trips, news, or events that we think you might find interesting and that are relevant to your initial enquiry, unless you have opted out of being contacted in this way. We believe that it is in our legitimate interests to market to you and that you would reasonably expect us to process your personal information in this way, and that such processing does not have an impact on you in a way that would make this processing unfair.

We will not send you general marketing information as part of a group mailing, e-mailing, or telephone campaign unless you have consented to being contacted in this way.

We have set out the type of personal information we collect, the purpose for collecting it, the lawful basis for collecting it, and the length of time we keep that information:

3. You are a supplier, travel partner or tour operator

We will collect and store personal information, including contact details of our partners, destinations, and other suppliers and their employees who provide services to us or with whom we have a contract relating to the provision of Services to our customers. We process this information in accordance with and for the performance of the contract between us. We will retain this information and any information relating to the contract between us for a period of up to six years following the completion of the contract(s) between us so that we can review your performance if any complaints or issues arise after the completion of the contract.

We may also contact you about new business opportunities and keep you informed of our activities. We believe that it is in our legitimate interests to develop our business, that you would reasonably expect us to process your personal information in this way, and that such processing does not have an impact on you in a way that would make this processing unfair.

We will not send you general marketing information as part of a group e-mailing campaign unless you have consented to being contacted in this way.

4. You are a prospective supplier or partner

We will collect and store personal information about people with whom we reasonably consider doing business as suppliers or travel partners.

We may collect this information from you when you contact us (including through this website), at an event, or through a mutual contact. We will only collect contact information from your website or another third-party website if we have identified you specifically as someone who may be interested in working with us.

We may contact you about our services, events, and new business opportunities and keep you informed of our activities. We believe that it is in our legitimate interests to develop our business and that you would reasonably expect us to process your personal information in this way, and that such processing does not have an impact on you in a way that would make this processing unfair.

Where your information is stored in our contacts database but is not kept in a customer or supplier file, we carry out a review of our contacts database every 2 years when we consider whether or not we still have a legitimate interest in keeping your contact information. Where we consider that we no longer have a legitimate interest in keeping your contact information, we will delete it.

We will not send you general marketing information as part of a group mailing, e-mailing, or telephone campaign unless you have consented to being contacted in this way.

5. You are a third party with whom we are in contact during the delivery of Services to our customers or the possible delivery of Services to prospective customers

We will collect and store personal information, including contact details of third parties with whom we are in contact during the delivery of services to our customers or discussions relating to services with prospective customers. We process that information for our legitimate interests, which include providing services to customers and proposing travel arrangements to prospective customers. We believe that you would reasonably expect us to process your personal information in this way and that such processing does not impact you in a way that would make this processing unfair.

Where your personal information is kept as part of a file relating to the performance of a contract with one of our customers, we will also retain that information and any information relating to that contract in accordance with our file retention policy following completion of that contract(s) so we can review the file if any complaints or issues arise after completion of the contract.

Where your information is stored in our contacts database but is not kept in a customer or supplier file, we carry out a review of our contacts database every 2 years when we consider whether or not we still have a legitimate interest in keeping your contact information. Where we consider that we no longer have a legitimate interest in keeping your contact information, we will delete it.

We may also contact you about new business opportunities and keep you informed of our activities. We believe that it is in our legitimate interests to develop our business, that you would reasonably expect us to process your personal information in this way, and that such processing does not have an impact on you in a way that would make this processing unfair.

We will not send you general marketing information as part of a group mailing, e-mailing, or telephone campaign unless you have consented to being contacted in this way.

6. You are an employee

Employees can refer to the Staff Handbook for further information about our privacy policy with respect to employees.

Where an employee has provided us with personal information about a spouse, civil partner, or other family member/friend (perhaps in relation to sharing a company car, private medical insurance, or other benefits or as an emergency contact), it is the employee’s responsibility to inform that person that they (employee) have provided us with their details and that we will be processing it as an emergency contact or in connection with the relevant benefit and/or policy in accordance with this privacy policy.

7. You are a prospective employee

If we have received your details in response to a recruitment initiative, we will store the personal information that either you, your recruitment agent, or another third party has provided us with. We process that information so we can assess the suitability of your application for the advertised role and make an informed decision about whether to interview you and, ultimately, recruit you. We may ask for details about your previous experience, education, referees, and answers to questions relevant to the role you have applied for. Therefore, processing your personal data is necessary to take steps at your request prior to potentially entering into an employment contract.

We may also contact those individuals who are referred to in any information you provide us with, for example, referees unless you request us not to do so. The contact may be made by telephone, e-mail, or post. We will only do this if we have your express permission to contact them in this way.

If you are unsuccessful, then the information you have provided up to that point will be retained for six months following the date on which the role was filled. If you are successful, the information you have provided throughout the recruitment process will be retained as part of your employee file.

8. We have received your information from a third party

If we have received your personal information from a third party, for example, your employer, that third party will normally be the controller in relation to that personal information, and we will be processing it on their behalf. You should therefore contact that third party to review their privacy policy.

9. Your relationship with us is not covered by any of the above

We may hold your contact details and personal information as a result of an interaction between you and one of our employees. We are processing your personal information in this way because it is in our legitimate interests to retain a record of our employee’s engagement with third parties. We believe that you would reasonably expect us to process your personal information in this way and that such processing does not impact you in a way that would make this processing unfair. We review our contact database every 2 years to consider whether or not we still have a legitimate interest in keeping your contact information. Where we consider that we no longer have a legitimate interest in keeping your contact information, we will delete it.

Where you provide us with personal information about another person

If you give us personal information about another person, for example, as part of a group booking, you must ensure that:

(a) you are legally entitled to give us that information;

(b) the disclosure is in accordance with any applicable data protection or privacy laws; and

(c) such other person has also read this privacy policy.

When we share personal information

We will not disclose your personal information otherwise than as described in this Privacy Policy without your consent unless we reasonably believe that disclosure is necessary to lessen or prevent a threat to life, health or safety or for certain action to be undertaken by an enforcement body (e.g. prevention, detection, investigation, prosecution or punishment of criminal offences), disclosure is authorized or required by law or disclosure is otherwise permitted by applicable privacy laws.

We will not share your personal data with third parties for marketing purposes. However, it may be necessary to share your data with third parties in the course of operating our business. Any third parties with whom we may share your data are obliged to keep your details secure and to use them only to support the fulfillment of the service we are providing to you.

The third-party entities we pass your information onto are as follows:

1. Our travel partners, travel destinations, and other suppliers who are engaged in relation to the fulfillment of your travel arrangements.
2. Service providers acting as processors who provide platform, cloud hosting and IT, and system administration services.
3. Uganda Revenue Authority (URA), regulators, and other authorities who require reporting of processing activities in certain circumstances.
4. Platform and other IT Software Providers acting as processors
5. Professional advisers acting as processors or joint controllers, including lawyers, bankers, and accountants who provide consultancy, banking, legal, debt recovery, insurance, and accounting services.

Many of our travel partners, travel destinations, and other suppliers engaged in relation to the fulfillment of your travel arrangements would require us to transfer your personal data for the provision of our Service. We will not transfer your personal data except where it is necessary to do so in order to provide our Services.

We may also share personal information when we believe it is required, such as:

(a) to comply with legal obligations and respond to requests from government agencies, including law enforcement and other public authorities;

(b) in the event of a merger, sale, restructure, acquisition, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings);

(c) to protect our rights, users, systems, and Services.

How long we keep personal information

We will only retain your personal data for as long as necessary to fulfill the purposes for which we collected it, including satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Details of retention periods for different aspects of your personal data are set out in the above Section: Purpose, legal basis, and duration of the processing.

Cookies

A cookie is a small file that asks permission to be placed on your computer’s hard drive. Once you agree, the file is added, and the cookie helps analyze web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes, and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyze data about webpage traffic and improve our website in order to tailor it to customer needs. We use this information for statistical analysis purposes, and then the data is removed from the system. Overall, cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Your legal rights

We respect your right to access and control your information, and we will respond to requests for information and, where applicable, will correct, amend, or safely delete your personal information.

• Access to personal information: You have the right to request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. If you request access to your personal information, we will gladly comply, subject to any relevant legal requirements and exemptions, including identity verification procedures. Before providing data to you, we will ask for proof of identity and sufficient information about your interaction with us so that we can locate any relevant data.
• Object to processing: of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation that makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object if we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information that override your rights and freedoms.
• Request the erasure: of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us to continue to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see above), where we may have processed your information unlawfully, or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request for erasure for specific legal reasons, which will be notified to you, if applicable, at the time of your request.
• Request a restriction on the processing: of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise, or defend legal claims; or (d) if you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer: of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information that you initially provided consent for us to use or where we used the information to perform a contract with you.
• Correction of your data: You have the right to request that we correct your personal information if it is inaccurate or require updating or complete your personal information if the information, we hold is incomplete.
• Withdrawal of consent: If we are processing your personal information on the basis that you have given your consent to us processing that personal information, you have a right to withdraw your consent at any time by using the “Contact Us” option on our website or by letting us know in writing, by email, or by telephone.
• Filing a complaint: If you are not satisfied with how Exploits Travel manages your personal data, you have the right to make a complaint to the Personal Data Protection Office (PDPO – UG | https://www.pdpo.go.ug/).