Privacy Policy

This policy explains how we process personal data when you visit www.blackietours.com or contact us.

1. Controller

The controller of your personal data is Alphonce Kai "Blackie" Charo, Watamu 80202, Kenya. Contact: info@blackietours.com, +254 725 026554.

We are based in Kenya, so data you send us is processed outside the EU/EEA. Kenya is not covered by an EU adequacy decision; we transfer your data only where this is necessary to answer your inquiry or to perform a contract with you (Art. 49(1)(b) GDPR).

2. Inquiries via the contact form, e-mail or phone

When you contact us, we process your name, e-mail address, the content of your message and any other details you give us. We use them to answer your inquiry and to prepare an offer or a trip for you.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR). We keep inquiries for as long as necessary to handle them and for no longer than 3 years after the last contact, unless a longer period is required by law (e.g. accounting records for booked trips).

Messages sent through the contact form are delivered to our inbox by the service Web3Forms.

To protect the contact form against spam and automated abuse, we use hCaptcha, provided by Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA. hCaptcha is loaded only when you start filling in the form. It processes your IP address, browser and device information and your interaction with the page (e.g. mouse movements and answers to the verification challenge) to tell people from bots. Legal basis: our legitimate interest in protecting the form against abuse (Art. 6(1)(f) GDPR). Intuition Machines is certified under the EU-U.S. Data Privacy Framework. More information can be found in the hCaptcha privacy policy.

3. Website analytics (Google Analytics)

Only if you give your consent in the cookie banner do we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It helps us understand how visitors use the website. Google Analytics stores cookies (e.g. _ga) and processes pseudonymous identifiers, pages visited, device and browser information and approximate location derived from a shortened IP address.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via “Cookie settings” in the website footer. Data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework. Analytics data is kept for up to 14 months.

4. Hosting and security

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit the website, the hosting provider processes technical data (IP address, date and time of access, requested page, browser type) to deliver the website and protect it against misuse. Legal basis: our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR). Vercel is certified under the EU-U.S. Data Privacy Framework.

Fonts are served from our own website; no data is sent to font providers.

5. Cookies and local storage

Without your consent we store only your cookie choice in your browser’s local storage, which is necessary to respect it. Analytics cookies are stored only after you accept them.

If you use the contact form, hCaptcha may store technical data needed for the security check in your browser.

6. Recipients

Your data may be processed on our behalf by the providers named above (Vercel, Web3Forms, hCaptcha, Google if you consent) and by our e-mail provider. We do not sell your data.

7. Your rights

You have the right to access your data, to rectification, erasure, restriction of processing and data portability, to object to processing based on legitimate interest and to withdraw your consent at any time. To exercise your rights, write to info@blackietours.com.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement. You may also contact the Office of the Data Protection Commissioner of Kenya (odpc.go.ke).

8. Changes

We may update this policy when our services or the law change. Last updated: 16 September 2026.