Gorille Africain

    Privacy Policy

    Last updated: August 2026

    At Gorille Africain Tours ("we", "us", or "our"), we are committed to protecting your privacy and ensuring that your personal data is handled in a safe, transparent, and responsible manner. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website, interact with our forms, or book our safari and travel services.

    This policy is designed to comply with the General Data Protection Regulation (GDPR) (EU) 2016/679, as well as Rwanda's Law N°058/2021 of 13/10/2021 relating to the Protection of Personal Data and Privacy, and any other applicable data protection laws in the jurisdictions where our travellers reside.

    1. Data Controller

    Gorille Africain Tours is the data controller responsible for your personal data. We are a Rwandan-registered company based in Kigali, Rwanda, fully licensed by the Rwanda Development Board under Licence Number RDB/TL/2025/03/TO/00883.

    If you have any questions about this Privacy Policy or how we handle your data, you may contact us at:

    • Email: hello@gorilleafricaintours.com
    • Phone: +250 787 161 314
    • Address: Gorille Africain Tours, Kigali, Rwanda

    2. Lawful Basis for Processing Your Data

    Under GDPR Articles 6(1), we process your personal data only when we have a lawful basis to do so. The lawful bases we rely on are:

    • Consent (Art. 6(1)(a)): You have given clear consent for us to process your personal data for a specific purpose (e.g., subscribing to our newsletter, requesting a guide, or submitting an enquiry form).
    • Contract (Art. 6(1)(b)): Processing is necessary to take steps before entering into a contract with you (e.g., preparing a custom itinerary quotation) or to perform a contract you have entered into (e.g., executing your booked safari).
    • Legal Obligation (Art. 6(1)(c)): We must process your data to comply with a legal obligation, such as sharing passport details with national park authorities to secure gorilla trekking permits.
    • Legitimate Interests (Art. 6(1)(f)): We process data for our legitimate business interests, such as improving our services, website analytics, and fraud prevention, provided these do not override your rights and freedoms.

    3. Information We Collect

    We may collect personal information from you in a variety of ways, including but not limited to:

    • Personal Identification Information: First name, last name, email address, phone number, passport details, nationality, and date of birth required for booking safaris, gorilla permits, and flights.
    • Travel Preferences: Preferred destinations, travel dates, party size, budget range, experience preferences, and dietary requirements collected through our custom safari enquiry form.
    • Health and Dietary Information: Information regarding medical conditions, physical limitations, or dietary requirements to ensure your safety and comfort during our tours. This is considered "special category data" under GDPR Art. 9 and is processed based on your explicit consent.
    • Payment Information: Credit card details, billing address, and transaction history. Note that payment processing is handled by secure third-party payment gateways, and we do not store full credit card numbers.
    • Usage Data: Information on how the website is accessed and used, including your IP address, browser type, pages visited, time spent on our site, and device information. This is collected through cookies and similar technologies.
    • Marketing Data: Your preferences in receiving marketing communications from us, and how you respond to them.

    4. How We Use Your Information

    The information we collect is used for the following purposes:

    • To process and manage your safari bookings, including securing necessary permits (e.g., gorilla and chimpanzee trekking permits) from relevant wildlife authorities like the Rwanda Development Board (RDB) and Uganda Wildlife Authority (UWA).
    • To arrange accommodations, domestic flights, ground transportation, and guided activities.
    • To communicate with you regarding your itinerary, payments, and any updates to your travel plans.
    • To ensure your health, safety, and dietary requirements are met during your trip.
    • To respond to your enquiries, provide customer support, and schedule trip consultations.
    • To improve our website, services, and customer experience.
    • To send promotional emails about new destinations, special offers, or travel guides (only with your explicit consent, which you can withdraw at any time).
    • To analyze website traffic and user behavior through analytics tools (only with your consent, which you can manage via our cookie consent banner).
    • To deliver relevant advertising and measure campaign performance through platforms like Google Ads (only with your consent).

    5. Data Retention

    We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

    • Enquiry & quotation data: Retained for up to 24 months after your last interaction, in case you wish to resume planning.
    • Booking & travel data: Retained for up to 7 years after trip completion to comply with tax, audit, and legal record-keeping requirements.
    • Marketing data: Retained until you withdraw consent or unsubscribe.
    • Cookie & analytics data: Retained in accordance with the retention period set by the analytics provider (e.g., Google Analytics default is 14 months for user-level data).

    When your data is no longer needed, we will either delete it or anonymize it so that it can no longer be associated with you.

    6. Sharing Your Information

    We do not sell, trade, or rent your personal data to others. We may share your information with third parties only in the following circumstances:

    • Service Providers (Data Processors): We share necessary information with our trusted partners — including hotels, lodges, airlines, ground handlers, and local guides — to fulfill your travel arrangements. These parties act as data processors under our instructions and are bound by confidentiality obligations.
    • Government Authorities: We are required to share passport details and other relevant information with government bodies (such as national park authorities and immigration) to secure trekking permits and park entries. This is done under our legal obligation.
    • Analytics & Marketing Platforms: With your consent, we share anonymized usage data with platforms like Google Analytics and Google Ads for website improvement and campaign measurement.
    • Legal Requirements: We may disclose your information if required to do so by law or in response to valid requests by public or judicial authorities.

    7. International Data Transfers

    Your personal data may be transferred to, stored, and processed in countries outside Rwanda, including countries that may not have the same data protection standards. This includes transfers to analytics and marketing platforms (such as Google) that may process data in the United States or the European Union.

    Where we transfer data outside of Rwanda or the EEA, we ensure that appropriate safeguards are in place to protect your data, such as:

    • Standard Contractual Clauses (SCCs) approved by the European Commission for data transfers to third countries.
    • Ensuring third-party processors are certified under frameworks such as the EU-US Data Privacy Framework.
    • Binding corporate rules where applicable.

    8. Your Rights Under GDPR and Rwandan Law

    Under GDPR Articles 12–22 and Rwanda's Law N°058/2021, you have the following rights regarding your personal data:

    • Right of Access: You can request a copy of the personal data we hold about you.
    • Right to Rectification: You can ask us to correct any information that is inaccurate or incomplete.
    • Right to Erasure ("Right to be Forgotten"): You can ask us to delete your personal data in certain circumstances (e.g., when the data is no longer necessary for the purpose it was collected).
    • Right to Restrict Processing: You can ask us to restrict the processing of your personal data in certain situations.
    • Right to Data Portability: You can request that we transfer your data to you or to another service provider in a structured, machine-readable format.
    • Right to Object: You can object to our processing of your personal data based on legitimate interests or for direct marketing purposes.
    • Right to Withdraw Consent: Where we rely on your consent to process your data, you can withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before withdrawal.
    • Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority. For Rwanda, this is the National Cyber Security Authority (NCSA). For EU residents, you may lodge a complaint with your local Data Protection Authority.

    To exercise any of these rights, please contact us at hello@gorilleafricaintours.com. We will respond to your request within 30 days, as required by GDPR.

    9. Cookies and Tracking Technologies

    We use cookies and similar tracking technologies to track the activity on our website and store certain information. Cookies are small files that may be placed on your device. We use the following categories of cookies:

    • Strictly Necessary Cookies: Essential for the website to function correctly. These cannot be disabled as they enable core features such as security, session management, and form submission.
    • Analytics Cookies: Help us understand how visitors interact with our website by collecting and reporting information anonymously (e.g., Google Analytics). These are only set with your consent.
    • Marketing & Advertising Cookies: Used to deliver relevant ads and track campaign performance, including through platforms like Google Ads. These are only set with your consent.

    When you first visit our website, you will see a cookie consent banner that allows you to accept all cookies, reject all non-essential cookies, or customize your preferences by category. You can change your cookie preferences at any time by clearing your browser cookies and revisiting our site, or by contacting us directly.

    For more details on how Google Analytics processes data, please refer to Google's Privacy & Terms.

    10. Data Security

    We implement a variety of technical and organizational security measures to maintain the safety of your personal information. These measures include:

    • Encryption of data in transit using TLS (Transport Layer Security) / SSL protocols.
    • Restricted access to personal data, limited to authorized personnel who require it to perform their duties.
    • Regular security assessments and updates to our systems.
    • Secure third-party payment gateways for all financial transactions — we never store full credit card numbers.
    • Staff training on data protection and privacy best practices.

    However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security.

    11. Children's Privacy

    Our services are not directed to individuals under the age of 15 (the minimum age for gorilla trekking in Rwanda). We do not knowingly collect personal data from children under 15 without parental consent. If you believe we have collected data from a child under 15, please contact us immediately so we can delete it.

    12. Third-Party Websites

    Our website may contain links to third-party websites. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services. We encourage you to review the privacy policies of those websites before providing any personal information.

    13. Changes to This Privacy Policy

    We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the updated Privacy Policy on this page and updating the "Last updated" date at the top. We encourage you to review this page periodically to stay informed about how we protect your data.

    14. Contact Us

    If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

    If you wish to lodge a complaint about how we handle your data, you may contact the National Cyber Security Authority (NCSA) of Rwanda, or your local Data Protection Authority if you reside in the EU/EEA or UK.