Our bank details never change by email. Payment links and invoices come only from @blackwillowexperience.com addresses, and every payment is confirmed with you on our verified WhatsApp line before you send it. If anything ever differs — a new account, a new domain, urgency, pressure — stop and call us.
Security, in plain language
How we protect you
Booking a journey across the world means trusting people you have not met with money and personal details. We think you deserve to see exactly how that trust is protected — before you are asked to extend it.
The payment verification ritual
Wire fraud — criminals impersonating a travel company by email and sending guests “updated bank details” — is the most serious risk in this industry. It is defeated by one simple ritual, which we follow without exception:
This paragraph appears in every quote and every invoice we issue. Keep it; hold us to it.
How you can verify us independently
- Reviews on platforms we don’t control: Wanderlog, tourhub and Touristlink carry named, dated guest reviews of our trips.
- Two-way conversation before any deposit: we encourage a WhatsApp video call with your travel designer. Fraudsters avoid faces; we lead with them.
- No pressure by design: we never use countdown timers, fake scarcity or same-day-deposit demands. Genuine availability pressure exists in high season — we explain it with camp names you can check.
Your data, minimized
We collect only what a journey requires: names as they appear in passports (for park permits and flights), dietary and relevant medical notes (for camps and guides), and contact details. We do not sell data, run advertising trackers on this site, or use your information to train anything.
| Passport details | Encrypted at rest; deleted 6 months after your trip ends |
|---|---|
| Medical/dietary notes | Shared only with the camps and guides hosting you; deleted after the trip |
| Chat & enquiry records | Kept while we plan together; deletable any time on request |
| Analytics | Privacy-respecting, cookieless page counts — no cross-site tracking, hence no cookie banner |
Full detail, including your GDPR and Tanzanian PDPA rights: privacy policy.
The boring, load-bearing parts
- This site is served exclusively over HTTPS with modern TLS and strict security headers.
- Two-factor authentication on every system that touches guest data; individually named staff accounts; access reviewed quarterly.
- Email authenticated with SPF, DKIM and DMARC at reject — the technical measures that make our domain hard to spoof.
- Our AI itinerary tools never see payment details, never quote final prices and never confirm availability — a human does, accountably, every time.
- Daily offsite backups, restore-tested quarterly. A security contact is published at /.well-known/security.txt.
If something ever looks wrong
Forward the suspicious message to info@blackwillowexperience.com and message us on WhatsApp before taking any action. Two minutes of verification beats any refund process ever invented.
Questions about any of this?
Ask them before you book. We consider that a feature of the service, not a burden on it.