Privacy Policy

1. Introduction & scope

This Privacy Policy explains what personal information we collect, why we collect it, how long we keep it, who we share it with, and the choices available to you. It applies to:

• Visitors to our website at safariherbs.com and related subdomains;
• Individuals who contact us via forms, email, phone, or social media;
• Newsletter and marketing subscribers;
• Wholesale buyers, distributors, and export partners in Kenya, the EU, UK, UAE, and other markets;
• Farm visitors, auditors, media contacts, and job applicants where relevant;
• Growers, suppliers, and contractors in our supply chain where personal data is processed.

By using our website or providing information to us, you acknowledge that you have read this policy. If you do not agree, please discontinue use of our services and contact us to withdraw consent where applicable.

2. Who we are (data controller)

The data controller responsible for your personal information is:

For data-protection enquiries, please use the contact details above with the subject line “Privacy Request”. We will respond within the timelines required by applicable law.

3. Information we collect

Depending on how you interact with Safari Herbs, we may collect the following categories of personal information:

3.1 Identity & contact information

• Full name, job title, and company or organisation name;
• Email address, telephone number, and postal or billing address;
• Country of residence and target export market;
• Communication preferences and language.

3.2 Enquiry & transaction information

• Messages submitted through our contact form (including inquiry type, volumes, timelines, and certification needs);
• Wholesale, export, and private-label quotation details;
• Order history, invoices, delivery addresses, and payment references (we do not store full payment card numbers on our servers);
• Sample requests, quality audits, and farm-visit arrangements.

3.3 Professional & compliance information

• Business registration numbers, tax identifiers, and import licences where required for B2B trade;
• Certification documentation (organic, KEPHIS, Global G.A.P., HCDA) linked to your organisation;
• Due-diligence records for supply-chain traceability and food-safety compliance.

3.4 Technical & usage information

• IP address, browser type, device identifiers, operating system, and referring URL;
• Pages viewed, time on site, click patterns, and approximate geographic location derived from IP;
• Cookie identifiers and similar technologies (see Section 9).

3.5 Marketing & newsletter data

• Email address and subscription status;
• Open and click rates where email analytics are enabled;
• Consent records and unsubscribe requests.

3.6 Information we do not intentionally collect

We do not seek to collect special categories of personal data (such as health, biometric, or political opinions) unless you voluntarily provide them in correspondence and we have a lawful basis to process them. Please avoid submitting sensitive information through general contact forms.

4. How we collect information

Personal data is collected through:

• Direct interactions — when you fill in forms, email us, call our office, visit our farm, meet us at trade events, or sign a contract;
• Automated technologies — cookies, server logs, and analytics tools when you browse our website;
• Third parties — logistics partners, payment processors, certification bodies, referral partners, or publicly available business directories where lawful;
• Social media — when you engage with our official channels or send us direct messages on platforms such as Instagram, LinkedIn, or Facebook.

5. Legal bases for processing

We process personal information only where a lawful basis applies. The table below summarises our typical bases:

Where we rely on legitimate interests, we have assessed that our processing is necessary, proportionate, and does not override your fundamental rights. You may object to processing based on legitimate interests (see Section 13).

6. How we use your information

We use personal information to:

• Respond to contact, wholesale, export, certification, and partnership enquiries;
• Prepare quotations, samples, specifications, and supply agreements;
• Process and fulfil orders, arrange cold-chain logistics, and manage deliveries;
• Provide traceability documentation, batch records, and compliance packs;
• Send service-related communications (order updates, scheduling, documentation requests);
• Deliver newsletters and marketing content you have opted into;
• Improve our website, products, and customer experience through aggregated analytics;
• Protect against fraud, abuse, and security incidents;
• Comply with Kenyan law, export regulations, and requests from competent authorities;
• Establish, exercise, or defend legal claims.

7. Sharing & third-party processors

We may share personal information with trusted parties who assist our operations, including:

• Hosting & IT providers — website hosting, email, cloud storage, and backup services;
• Logistics & freight partners — cold-chain carriers, customs brokers, and warehouse operators for order fulfilment;
• Payment processors — banks and payment gateways (they handle card data under their own privacy policies);
• Professional advisers — lawyers, accountants, and auditors bound by confidentiality;
• Certification & inspection bodies — KEPHIS, organic certifiers, Global G.A.P., and HCDA where required for compliance;
• Marketing platforms — email delivery and analytics tools, only where you have consented or applicable law permits.

All processors are required to process data only on our instructions and implement appropriate security measures. We maintain records of key processing agreements as required by the Kenya Data Protection Act.

7.1 Disclosure to authorities

We may disclose information where required by law, court order, or a valid request from the Office of the Data Protection Commissioner (ODPC), KEPHIS, Kenya Revenue Authority, or other competent regulatory bodies.

7.2 Business transfers

If Safari Herbs undergoes a merger, acquisition, or sale of assets, personal information may transfer to the successor entity subject to equivalent privacy protections. We will notify affected individuals where required by law.

8. International data transfers

Safari Herbs is based in Kenya. When you access our website or engage our export services from the European Union, United Kingdom, United Arab Emirates, or other jurisdictions, your information may be transferred to and processed in Kenya or in countries where our service providers operate.

Where transfers occur to jurisdictions without an adequacy decision, we implement appropriate safeguards—such as standard contractual clauses, binding corporate rules, or explicit consent—consistent with applicable data-protection law.

Export documentation shared with overseas buyers (certificates, invoices, traceability records) is transferred as necessary to perform our contract with you and meet import regulations in your market.

9. Cookies & similar technologies

Our website uses cookies and similar technologies to enable core functionality, remember preferences, and—where enabled—understand how visitors use our site.

You can control cookies through your browser settings. Blocking strictly necessary cookies may affect site functionality. Where analytics or marketing cookies are introduced, we will request consent via a cookie banner and update this policy accordingly.

10. Marketing communications

We send promotional emails and farm updates only where you have subscribed through our newsletter form or explicitly opted in. Each marketing email includes an unsubscribe link. You may also contact us at any time to opt out.

Even if you unsubscribe from marketing, we may still send transactional or service-related messages about active orders, documentation, or account matters.

11. Data retention

We retain personal information only for as long as necessary to fulfil the purposes described in this policy, unless a longer period is required or permitted by law.

• General enquiries — up to 24 months after last contact, unless a business relationship develops;
• Active customers & contracts — for the duration of the relationship plus up to 7 years for tax, audit, and legal purposes;
• Traceability & food-safety records — as required by KEPHIS, export regulations, and buyer agreements (often 2–5 years minimum);
• Newsletter subscribers — until you unsubscribe, plus a suppression record to honour opt-out requests;
• Server logs — typically 12–90 days unless needed for security investigations;
• Legal claims — for the limitation period applicable under Kenyan law.

When data is no longer needed, we securely delete or anonymise it so it can no longer be associated with you.

12. Security measures

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, or destruction, including:

• HTTPS encryption for data transmitted through our website;
• Access controls limiting staff access to personal data on a need-to-know basis;
• Secure storage, password policies, and device protections for office systems;
• Vendor due diligence for cloud and logistics partners handling personal or commercial data;
• Staff awareness of data-protection obligations under Kenyan law.

No method of transmission over the internet is completely secure. While we strive to protect your information, we cannot guarantee absolute security. Please notify us immediately at order@safariherbs.com if you suspect unauthorised access to your data.

13. Your rights

Under the Kenya Data Protection Act, 2019—and, where applicable, the GDPR or UK GDPR—you may have the following rights in relation to your personal information:

• Right of access — obtain a copy of personal data we hold about you;
• Right to rectification — request correction of inaccurate or incomplete data;
• Right to erasure — request deletion where there is no compelling reason to continue processing;
• Right to restrict processing — ask us to limit use in certain circumstances;
• Right to data portability — receive your data in a structured, machine-readable format where applicable;
• Right to object — object to processing based on legitimate interests or direct marketing;
• Right to withdraw consent — where processing is consent-based, without affecting prior lawful processing;
• Right not to be subject to automated decision-making — we do not make solely automated decisions with legal or significant effects.

To exercise any of these rights, email order@safariherbs.com with sufficient detail to verify your identity. We respond within 30 days (or the period required by applicable law). We may refuse requests that are manifestly unfounded, excessive, or prohibited by law.

14. Children's privacy

Our website and B2B services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

15. Third-party websites & social media

Our website may contain links to third-party sites (e.g. Google Maps, certification registries, social networks). We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before providing personal information.

Content you post on our public social media channels may be visible to others. Please exercise caution when sharing personal information in public forums.

16. Changes to this policy

We may update this Privacy Policy to reflect changes in law, technology, or our business practices. Material changes will be posted on this page with an updated effective date. Where required, we will notify you by email or a prominent website notice.

Continued use of our website after changes are posted constitutes acceptance of the revised policy, except where further consent is required by law.

17. Contact & complaints

For privacy questions, data subject requests, or concerns about how we handle your information, contact us at:

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), the independent supervisory authority in Kenya. EU/UK residents may also contact their local data protection authority where GDPR or UK GDPR applies to our processing.

You may also reach us through our contact page for general enquiries.