Privacy Policy

This is a draft prepared for the site owner. It describes what the code on this site actually does today, but it has not been reviewed by a lawyer. Have a qualified lawyer review it, and complete the items marked [TO BE COMPLETED], before the site goes live.

This policy explains what Uganda Safaris collects about you, why, where it goes and what you can do about it. It was written by reading the site’s own code rather than from a template, so where it says something is not collected, that is because nothing in the site collects it.

Last updated: 15 September 2026

Who is responsible for your information

This site is operated by [TO BE COMPLETED: the full legal name of the business or individual operating the site, its registered address, and its company or business registration number, if any], referred to below as “we”, “us” and “the site”.

You can reach us about anything in this policy at uganda@ugandasafaris.travel.

[TO BE COMPLETED: whether the operator of this site is registered with a data protection authority, and if so which one and under what reference. Uganda’s Personal Data Protection and Privacy Act, 2019 requires data collectors, controllers and processors to register with the Personal Data Protection Office; the site’s code cannot tell us whether that has been done.]

What this site is

Uganda Safaris is a listings site. Independent, Uganda-based tour companies publish their own safaris here, and travellers use the site to find and compare them. The site does not sell trips, take bookings, or handle payment of any kind. There is no checkout, no deposit and no card processing anywhere on it, so no payment details are ever collected or stored.

Because the site is a place where travellers and operators find each other, the most important thing to understand about your information is this: when you send an enquiry about a safari, it is forwarded by email to the tour operator that sells it. That is the point of the enquiry, and it is set out in full below.

When you send an enquiry about a safari

Safari listings carry an enquiry form. When you submit it, the site collects:

• your name;
• your email address;
• your phone number, if you give one (optional);
• your preferred travel date, if you give one (optional);
• your message;
• which safari listing and which operator the enquiry relates to.

Two things then happen.

The enquiry is stored on this site. It is saved as a private record in the site’s database. These records are not published, do not have a web address and cannot be reached by visitors or by search engines.

The enquiry is emailed to the tour operator. This is a disclosure of your name, email address, phone number, travel date and message to a third party — the independent company that sells the safari. The email is addressed to that operator, and your email address is set as the reply-to address so they can answer you directly. A copy of every enquiry is also blind-copied to the site owner, so that there is a record if an operator does not reply.

If the operator has no working email address on file, the enquiry goes to the site owner instead, to be forwarded by hand. The email says so plainly when that happens.

The operator can also see their own enquiries when they sign in to their operator dashboard on this site, including the name, email address and phone number you gave. Operators only ever see enquiries that were sent to them; the site’s code filters each operator’s list to their own records.

Once your enquiry reaches an operator, what that operator does with it is governed by their privacy policy, not by this one. The site has no control over, and does not monitor, how an operator stores or uses an enquiry after it is delivered. If you want to know how a particular operator handles your information, ask them before you enquire.

The site does not record your IP address when you send a safari enquiry.

When you use the contact form

The contact page has a separate form for messages to the site itself. It collects your name, email address, phone number (optional), subject and message.

These messages are stored as private records in the site’s database and emailed to uganda@ugandasafaris.travel. Contact form messages are not forwarded to tour operators.

Unlike safari enquiries, the contact form does store the IP address you sent the message from, alongside the message. It is kept as a record of where a message came from, which matters for spam and abuse.

Saved safaris (the wishlist)

You can save safaris to a wishlist. How that works depends on whether you are signed in, and the difference is worth stating:

• If you are not signed in — which is the case for nearly every traveller, because travellers do not need accounts here — your saved safaris are held in your own browser’s local storage and are never stored on this site. The site keeps no record of what a signed-out visitor has saved. Clearing your browser’s site data erases the list, and it does not follow you to another device or browser.
• If you are signed in (which in practice means you are a tour operator), the list of safaris you have saved is stored against your account on the site.

Tour operator accounts

Tour companies who want to list on the site register for an account. Travellers do not need an account and cannot create one; self-registration is limited to operators.

At registration, an operator supplies:

• the registered company name;
• the name of a contact person;
• a company email address, which also becomes the account’s login;
• a password (stored only as a cryptographic hash by WordPress, never in readable form);
• a phone or WhatsApp number;
• the location of the company’s physical office in Uganda;
• an operator licence number;
• the regions of Uganda the company covers, and optionally its year of establishment and its specialities;
• a company logo and a profile header photograph.

Some of this is published on the operator’s public profile: the company name, office location, regions, year established, specialities, logo and header photograph, and the contact details the operator chooses to display. The operator licence number is stored but is not currently displayed anywhere on the public site.

Operators who publish listings also upload photographs and write descriptions, which are published. Operators can see the enquiries sent to them, as described above.

Cookies

This site sets no cookies for ordinary visitors. If you browse the site without signing in, no cookie is created by the site, and there is no advertising, tracking or profiling cookie of any kind. That is why you are not asked to accept a cookie banner.

Cookies are used in one situation only: when someone signs in to an account, WordPress sets its standard authentication cookies so that the session works. In practice this applies to tour operators and to the site administrator, not to travellers.

Anti-spam rate limiting

To stop forms being flooded, the site counts how many times a form has been submitted from a given internet connection in a short window. It does this by storing a one-way hash of the IP address together with a counter. The hash is not readable as an IP address, it is not linked to any submission, and it deletes itself automatically after a few minutes.

How the site measures interest

The site counts how many times an operator’s profile has been viewed and how many enquiries a listing has produced, so that operators can see how their listings are doing. These are plain running totals attached to the listing. They record no visitor identifier, no IP address, no cookie and no browsing history, and they cannot be traced back to an individual.

There is no third-party analytics on this site. There is no Google Analytics, no Google Tag Manager, no Facebook pixel and no advertising or remarketing tag anywhere in the site’s code.

Third parties your browser contacts

Two things on this site are loaded from outside it. Neither tracks you, but both mean another company’s server sees a request from your browser, which includes your IP address and the type of browser you are using:

• Google Fonts. The site’s typefaces are loaded from fonts.googleapis.com and fonts.gstatic.com on every page. Google’s handling of those requests is governed by Google’s own privacy policy. Note for the owner: these fonts could be self-hosted, which would remove this disclosure entirely. That is a change to the theme and the plugin’s font settings, not to this policy.
• WordPress.org emoji images. WordPress’s built-in emoji support may load emoji images from s.w.org on pages that contain emoji.

There are no embedded videos, no embedded maps and no social media widgets anywhere on the site, so none of the tracking that normally comes with those is present.

Email delivery and hosting

Enquiries and contact messages are delivered by email, which necessarily passes through whatever mail service the site is configured to use, and the site’s database and files sit on a web host. Both of those providers process your information on the site’s behalf.

[TO BE COMPLETED: the name and country of the web hosting provider, and the name and country of the outbound email or SMTP provider, once the site is live. These are deployment settings and cannot be determined from the site’s code. If either provider is outside Uganda, this section should also say so and explain the basis for the transfer.]

Who else we share your information with

Beyond the tour operator you enquire with, and the hosting and email providers above, we do not share your information with anyone. We do not sell your information, rent it, or pass it to advertisers, data brokers or marketing lists. We may disclose information if we are legally required to, or where it is necessary to establish, exercise or defend a legal claim.

How long your information is kept

We have to be straightforward about this. The site currently has no automatic deletion. Enquiries, contact messages and operator records stay in the database until somebody removes them by hand. The only things that expire on their own are the short-lived anti-spam counters described above.

[TO BE COMPLETED: the retention periods the owner intends to apply — for example, how long a safari enquiry, a contact message, and a closed operator account are kept before deletion. Once decided, these periods should be stated here and actually applied, whether by a scheduled job or by a regular manual clear-out. A retention period that is written down but not carried out is worse than none.]

Security

Passwords are stored only as hashes and are never readable, by us or by anyone else. Enquiries and contact messages are stored as private records that have no public web address and are not searchable. Forms are protected against automated submission and against being submitted from other sites. Uploaded images are checked for their real file type before they are accepted.

No website can promise perfect security, and we do not. [TO BE COMPLETED: confirm that the live site is served over HTTPS with a valid certificate before launch. This local development copy is not.]

Your rights

You can ask us to:

• tell you what information we hold about you;
• give you a copy of it;
• correct it if it is wrong;
• delete it;
• stop using it for a particular purpose.

Write to uganda@ugandasafaris.travel and say what you want. We will need enough information to find your records — usually the email address you used and roughly when you got in touch.

One limit is worth being clear about. If you asked a tour operator for a quote, we can delete our copy of that enquiry, but we cannot delete the copy that is already in the operator’s inbox or their own systems. For that, you have to ask the operator directly. We will tell you which operator received it if you do not remember.

[TO BE COMPLETED: the law under which these rights are being offered and the authority a visitor may complain to — for example Uganda’s Personal Data Protection and Privacy Act, 2019 and the Personal Data Protection Office, and, if the site intends to offer them to visitors from the EU or UK, the corresponding rights and supervisory authority. This is a legal decision about who the site serves, not something the code can answer. A lawyer should also confirm the response deadline stated to visitors.]

Children

This site is not intended for children, and we do not knowingly collect information from anyone under 18. If you believe a child has sent us information, write to uganda@ugandasafaris.travel and we will delete it.

Changes to this policy

If we change this policy, the new version replaces this one on this page and the date at the top changes. If a change materially affects what happens to information already collected, we will say so on the page rather than change it quietly.

Contact

Email uganda@ugandasafaris.travel, or use the contact page. See also the Terms and Conditions.