Sharubu is the data controller responsible for your personal data. This means we determine how and why your personal information is processed.

• Name: Sharubu.com
• Address: Sakina, P.O. BOX 286, Arusha, Tanzania
• Email: info@sharubu.com
• Phone (NL): +31 648 672 836
• Phone (TZ): +255 755 464 821

For any privacy-related questions or requests, contact us at info@sharubu.com. We aim to respond within 30 days.

This Privacy Policy applies to all personal data collected through:

• Our website www.sharubu.com (including the safari calculator and booking form)
• Email correspondence (info@sharubu.com)
• WhatsApp and telephone communications
• Social media interactions (Instagram, Facebook)
• Booking and inquiry forms
• During your safari in Tanzania

This policy applies to all visitors, prospective clients, booked clients, and past clients of Sharubu. By using our website or services, you acknowledge that you have read and understood this Privacy Policy.

We only collect personal data that is necessary to provide our safari services or that you voluntarily provide. The type and amount of data depends on how you interact with us.

a) When you inquire or request a quote:

• Full name
• Email address
• Phone number
• Country of residence
• Travel preferences (dates, group size, accommodation type)

b) When you book a safari:

• Full names of all travellers (as per passport)
• Date of birth
• Nationality and passport details
• Emergency contact information
• Dietary requirements and food allergies
• Medical conditions relevant to safari participation
• Mobility or accessibility needs
• Flight details and arrival/departure information
• Travel insurance details
• Payment information (bank transfer details and reference)

c) Special category data (sensitive data):

Under GDPR, health information and dietary requirements linked to religious or philosophical beliefs are considered "special category" data. We only collect this when strictly necessary for your safety and comfort during the safari, and always with your explicit consent.

d) Children's data:

For families travelling with children, we collect the child's name, age, and any relevant medical or dietary information. This data is collected from the parent or legal guardian and processed solely for safari arrangements. We never collect data directly from children under 16 without parental consent.

When you visit our website, certain data is collected automatically through cookies and similar technologies:

• IP address (anonymised where possible)
• Browser type and version
• Device information (desktop, mobile, tablet)
• Operating system
• Pages visited and time spent on each page
• Referring website (how you found us)
• General geographic location (country/city level)

This data is collected through Google Analytics and is used to improve our website experience. We do not use this data to identify individual users. See Section 10 for our full Cookie Policy.

Under GDPR, we must have a lawful basis for processing your personal data. Below are the purposes and legal bases:

We only share your personal data when necessary to provide our services. We never sell your data to third parties.

a) Safari service providers in Tanzania:

• Hotels, lodges, and campsites (name, nationality, dietary needs)
• TANAPA and Ngorongoro Conservation Area Authority (name, nationality, passport details for park entry)
• Safari guides and drivers (name, group size, special requirements)
• Domestic flight operators (name, passport, weight for charter flights)
• AMREF Flying Doctors (emergency medical evacuation — name, contact, medical info if emergency occurs)

b) Business service providers:

• Bank (ABN AMRO — for processing bank transfer payments)
• Email service provider (for booking confirmations and newsletters)
• Website hosting (servers based in the EU)
• Google Analytics (anonymised website usage data)
• WhatsApp / Meta (for customer communications you initiate)

c) Legal & regulatory bodies (when required by law):

• Dutch tax authorities (Belastingdienst)
• Tanzania Revenue Authority
• Law enforcement (only when legally obligated)

As a Tanzania-based company, your personal data may be transferred between countries. Tanzania does not currently have an EU adequacy decision under GDPR Article 45.

To protect your data during international transfers, we implement the following safeguards:

• Standard Contractual Clauses (SCCs) — where applicable, we use EU-approved contractual clauses with our Tanzanian partners
• Data minimisation — we only share the minimum data necessary (e.g., lodges receive name and dietary needs, not your full passport details)
• Encryption — all digital communications use SSL/TLS encryption
• Access controls — only authorised staff can access your personal data

By booking a safari with us, you acknowledge that certain personal data must be transferred to Tanzania to fulfil the service. We take every reasonable step to ensure your data is treated securely.

Under the GDPR and Dutch UAVG, you have the following rights regarding your personal data:

Right of Access (Article 15)
You can request a copy of all personal data we hold about you. We will provide this free of charge within 30 days.

Right to Rectification (Article 16)
If your data is inaccurate or incomplete, you can ask us to correct it.

Right to Erasure / "Right to be Forgotten" (Article 17)
You can request deletion of your personal data, unless we are legally required to retain it (e.g., tax records for 7 years).

Right to Restrict Processing (Article 18)
You can ask us to temporarily stop processing your data while a complaint or dispute is resolved.

Right to Data Portability (Article 20)
You can request your data in a structured, machine-readable format to transfer to another service provider.

Right to Object (Article 21)
You can object to processing based on legitimate interest or direct marketing at any time.

Right to Withdraw Consent
Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

Right to Complain: If you believe we have mishandled your data, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) at autoriteitpersoonsgegevens.nl.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration:

• SSL/TLS encryption on our website and all forms
• Secure email for sensitive document exchanges
• Password-protected systems with restricted access
• Regular backups stored securely
• Staff awareness — our team is trained on data protection responsibilities
• No unnecessary data storage — we do not retain data beyond what is needed

All payments are made by direct bank transfer. We do not collect, process, or store any card payment details.

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours and inform you without undue delay, as required by GDPR Article 33.

We retain your personal data only for as long as necessary for the purpose it was collected, or as required by law:

• Inquiries (no booking): 12 months after last contact, then deleted
• Booking & travel data: Duration of safari + 2 years (for follow-up and dispute resolution)
• Financial records: 7 years (required by Dutch fiscal law)
• Marketing consent: Until you withdraw consent or unsubscribe
• Website analytics: 26 months (Google Analytics default, anonymised)
• WhatsApp conversations: 12 months after last message

After the retention period expires, we securely delete or fully anonymise your personal data.

Our website uses cookies — small text files placed on your device — to improve your browsing experience.

Essential cookies (always active):

• Session cookies to keep the website functional
• Security cookies to prevent fraud
• Cookie consent preference storage

Analytics cookies (with consent):

• Google Analytics — tracks page views, session duration, traffic sources
• IP addresses are anonymised (_anonymizeIp enabled)
• No personally identifiable information is collected

Marketing cookies (with consent):

• Facebook Pixel — measures ad performance (if active)
• Google Ads — tracks conversions from advertising (if active)

Managing cookies:

You can manage or disable cookies through your browser settings. Disabling essential cookies may affect website functionality. You can also withdraw cookie consent at any time through our cookie banner.

• Google Chrome
• Mozilla Firefox
• Safari
• Microsoft Edge

Our website may contain links to external websites, including:

• WhatsApp (for customer communications)
• Instagram and Facebook (for social media content)
• Google Maps (for location information)
• TripAdvisor or review platforms

These third-party services have their own privacy policies. We are not responsible for their data practices. We encourage you to review their policies before sharing personal information.

When you initiate a WhatsApp conversation with us, Meta (WhatsApp's parent company) may process your data according to their own privacy policy. We use WhatsApp for customer communication only and do not share your WhatsApp data with other parties.

During your safari, our guides may take photographs that include you. We may wish to use these images on our website, social media, or marketing materials.

• We will always ask for your consent before using identifiable photos for marketing purposes
• You can withdraw consent at any time by contacting us
• Landscape and wildlife photos that do not identify individuals may be used without specific consent
• We will never use photos of children for marketing without explicit parental consent

If you see a photo of yourself on our website or social media that you'd like removed, email us at info@sharubu.com and we will remove it promptly.

If you opt in to receive our newsletter during the booking process, we may send you:

• Safari inspiration and travel tips for Tanzania
• Special offers and early-bird discounts
• Updates about new safari packages or destinations
• Seasonal wildlife information (e.g., migration updates)

Your rights:

• You can unsubscribe at any time via the link in every email
• You can email info@sharubu.com to be removed from our mailing list
• Unsubscribing from marketing will not affect transactional emails related to your booking

We do not share your email with any third parties for their own marketing purposes.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. When we make changes:

• The "Last updated" date at the top of this page will be revised
• For significant changes, we will notify existing clients by email
• We encourage you to review this page periodically

Continued use of our website or services after changes constitutes acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:

• Email: info@sharubu.com (subject: "Privacy Request")
• Phone (NL): +31 648 672 836
• WhatsApp: +31 648 672 836
• Post: Sharubu.com, Sakina, P.O. BOX 286, Arusha, Tanzania

We will respond to all privacy-related requests within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with:

• Autoriteit Persoonsgegevens (Dutch DPA) — autoriteitpersoonsgegevens.nl