Privacy Policy
PRIVACY POLICY
Wild Springs ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, how we use it, and your rights under the Data Protection Act 2019 of Kenya.
────────────────────────────────────
1. DATA CONTROLLER
The data controller is Wild Springs Adventures Limited.
Address: Valley View Office Park, Tower A, First Floor, Room 4, Sixth Avenue Parklands, off Limuru Road, Nairobi, Kenya.
Phone: +254 721 957 652
For all data privacy questions, contact us at [email protected] with the subject line "Privacy Query".
────────────────────────────────────
2. WHAT DATA WE COLLECT
When you visit our site, place an order, or contact us, we may collect:
IDENTIFICATION DATA
- Full name
- Email address
- Phone number
- Delivery and billing address
- National ID or KRA PIN (only if required for tax invoicing)
TRANSACTION DATA
- Items purchased
- Order amounts and dates
- Payment method (we do NOT store full card numbers — handled by certified payment processors)
- M-Pesa transaction reference
TECHNICAL DATA
- IP address
- Browser type and device
- Pages visited and time spent
- Referring website
- Cookies and similar tracking (see Section 8)
COMMUNICATION DATA
- Email and WhatsApp messages with our team
- Customer support tickets and feedback
- Reviews you submit
We do not knowingly collect data from children under 18. If you believe a child has submitted data, contact us and we will delete it.
────────────────────────────────────
3. HOW WE USE YOUR DATA
We use your personal data to:
- Process and deliver your orders
- Communicate about purchases, deliveries, and customer queries
- Issue invoices and comply with tax requirements
- Improve our products, website, and service
- Send promotional offers (only with your consent — you can unsubscribe at any time)
- Detect and prevent fraud, abuse, or unauthorised access
- Comply with our legal obligations
────────────────────────────────────
4. LAWFUL BASES FOR PROCESSING
Under the Data Protection Act 2019, we process your data based on one or more of these lawful bases:
- Contract — when we need data to fulfil your order
- Legitimate interest — to operate, improve, and secure our business
- Legal obligation — to meet tax, accounting, and statutory requirements
- Consent — for marketing emails (you may withdraw at any time)
────────────────────────────────────
5. WHO WE SHARE DATA WITH
We share data only with parties necessary to deliver our service:
- Payment processors — for processing card and M-Pesa payments (Pesapal, Safaricom M-Pesa, etc.)
- Couriers — for delivering orders (Sendy, Glovo, Wells Fargo Courier, etc.)
- Email and SMS providers — for order confirmations and communications
- Hosting and IT providers — for running our website
- Tax and audit professionals — when required by law
We never sell or rent your personal data to advertisers, marketers, or any third party.
────────────────────────────────────
6. INTERNATIONAL TRANSFERS
Some of our service providers (e.g., Google Workspace, payment gateways) operate outside Kenya. When data is transferred internationally, we ensure adequate protection through:
- Approved providers compliant with Kenya's Data Protection Act
- Standard contractual clauses
- Encryption in transit and at rest
────────────────────────────────────
7. HOW LONG WE KEEP YOUR DATA
- Order and transaction data: 7 years (required by Kenyan tax law)
- Account data: until you delete your account
- Marketing data: until you unsubscribe, plus 30 days for confirmation
- Customer support data: 3 years for service improvement
- Technical logs: 90 days
After these periods, data is securely deleted or anonymised.
────────────────────────────────────
8. COOKIES & TRACKING
Our site uses cookies to:
- Keep you logged in
- Remember items in your cart
- Measure site traffic and performance (Google Analytics)
- Show you relevant content
You can disable cookies in your browser settings. Disabling cookies may limit functionality (e.g., your cart may not save).
────────────────────────────────────
9. YOUR DATA RIGHTS
Under the Data Protection Act 2019, you have the right to:
- Access — request a copy of your personal data
- Correction — fix inaccurate or incomplete data
- Deletion — request we delete your data (subject to legal obligations)
- Objection — refuse certain types of processing
- Restriction — limit how we use your data
- Portability — receive your data in a portable format
- Withdraw consent — for marketing or other consent-based processing
- Lodge a complaint — with the Office of the Data Protection Commissioner of Kenya (odpc.go.ke)
To exercise any of these rights, email [email protected]. We respond within 30 days.
────────────────────────────────────
10. SECURITY
We use reasonable technical and organisational measures to protect your data:
- SSL encryption on our website
- Secure payment processing through certified providers
- Restricted internal access to personal data
- Regular security reviews
No system is 100% secure. If a data breach occurs that affects you, we will notify you and the Data Protection Commissioner as required by law.
────────────────────────────────────
11. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. The latest version is at wildsprings.co.ke/shop/privacy-policy. Material changes will be communicated via email or site notice.
────────────────────────────────────
12. CONTACT US
For privacy questions, requests, or complaints:
Phone: +254 721 957 652
Postal address: Wild Springs Adventures Limited, Valley View Office Park, Tower A, First Floor, Room 4, Sixth Avenue Parklands, Nairobi, Kenya.
