Privacy Policy

Avi Expeditions Limited ("Avi Expeditions", "we") is a Nairobi-based adventure company. We are the data controller for personal data collected through this website and our booking channels. Contact: aviexpeditions@gmail.com · +254 720 046 641.

Booking details: your name, email address, phone/WhatsApp number, the trip and date you book, the rate you choose, the number of people, and any notes you give us (for example dietary needs or experience).

Health and safety information you choose to share before a trip (medical conditions, injuries, allergies, limitations). We ask for this only to plan safely, and treat it as sensitive.

Payment records: amounts, dates, payment method and references (for example your M-Pesa receipt number and the phone number used to pay). We do not see or store your M-Pesa PIN or card details.

Account details if you create an account: your name, email, phone and a securely hashed password, plus your trip history and badges.

Technical data needed to run the site securely, such as a sign-in cookie and basic server logs.

To take, confirm and manage your bookings, collect payments, and send trip information (including the trip's WhatsApp group link once your spot is confirmed).

To keep you safe on the mountain: planning guides, transport, permits and emergency support.

To provide your account: booking history, membership status and badges.

To meet legal, tax and accounting obligations, and to prevent fraud and abuse.

To send you quotes, invoices and receipts when you ask for them or when our team sends them to you.

We process your data to perform our contract with you (your booking), to comply with legal obligations, for our legitimate interests in running a safe and efficient business, and with your consent where required (for example health information you choose to share, or use of photos where you opt in or don't opt out).

Guides and partners who operate your trip (for example park authorities, transport and accommodation providers) — only what they need.

Payment providers such as Safaricom M-Pesa to process payments.

Service providers that host and run this website and our systems (cloud hosting, database and email providers), under contracts that protect your data.

Authorities where the law requires it. We never sell your personal data.

Some of our service providers store data outside Kenya. Where that happens we rely on appropriate safeguards as required by the Data Protection Act, 2019.

Booking and payment records are kept for as long as needed for the trip and for our legal and tax obligations (generally up to 7 years). Health information shared for a trip is kept only as long as needed for that trip. You can ask us to close your account at any time.

Under Kenya's Data Protection Act, 2019 you can ask to access, correct or delete your personal data, object to or restrict certain processing, and withdraw consent where we rely on it. Contact us at aviexpeditions@gmail.com. If you are unhappy with our response you may complain to the Office of the Data Protection Commissioner (ODPC).

We may photograph and film trips for promotion. Tell us before the trip if you'd rather not appear and we will honour that (see section 10 of our Terms & Conditions).

We use encrypted connections, hashed passwords, access controls for staff, and reputable infrastructure providers. No system is perfectly secure; if a breach affects you, we will notify you and the authorities as the law requires.

We will update this policy when our practices change and show the new version date here.