Privacy policy
Plain English, because a privacy policy you cannot read protects nobody.
Who we are
Black Willow Experience (“Black Willow”, “we”), Mbweni/Chukwani, Zanzibar, Tanzania. Data controller for this website and our booking operations. Contact: info@blackwillowexperience.com.
What we collect, and why
| Data | Why | Kept for |
|---|---|---|
| Name, email, phone/WhatsApp | Answering your enquiry; planning your journey | 3 years after last contact, or deletion on request |
| Passport details | Park permits, gorilla permits, internal flights — required by authorities | Encrypted; deleted 6 months post-trip |
| Dietary & relevant medical notes | Camp catering and guide safety planning | Deleted after the trip |
| Itinerary-builder inputs & chat messages | Producing your draft; continuity if you contact us | 12 months, or deletion on request |
| Payment records | Legal/accounting obligations | As required by Tanzanian law |
What we deliberately do not do
- No sale or rental of personal data — ever.
- No advertising trackers or cross-site cookies on this site; analytics are cookieless page counts. That is why there is no cookie banner.
- No use of your messages or data to train AI models. Our itinerary assistant processes your inputs only to answer you, via a contracted API under a data-processing agreement.
- Card details never touch our systems — payments run through licensed payment providers on their secured pages.
Who we share data with
Only the suppliers delivering your trip (camps, airlines, park authorities — names and permits only), our email and hosting providers, and our AI API provider for the assistant, each under data-processing agreements. Authorities where the law requires (e.g., park permits).
Your rights
Under the GDPR (EU/UK guests) and Tanzania’s Personal Data Protection Act 2022 you may request access, correction, deletion, restriction or a portable copy of your data, and object to processing. Write to info@blackwillowexperience.com; we respond within 30 days. EU/UK guests may also complain to their local supervisory authority; Tanzanian residents to the Personal Data Protection Commission.
Breach response
If a breach affecting your data ever occurs, we will notify you and the relevant authorities within the legally required windows (72 hours under GDPR), tell you plainly what happened, and what we are doing about it.
Changes
We will update the date above and, for material changes affecting active guests, tell you directly.