Privacy Policy & Data Protection Manual

01.Legislative Framework & Definitions

This Privacy Policy and Compliance Manual constitutes the statutory disclosure of Kampvuur Safaris (Pty) Ltd (“Kampvuur Safaris”, “the Responsible Party”, “we”, “us”, or “our”) pursuant to the provisions of:

• Section 14 of the Constitution of the Republic of South Africa, 1996 (the constitutional right to privacy);
• The Protection of Personal Information Act No. 4 of 2013 (“POPIA”);
• The Promotion of Access to Information Act No. 2 of 2000 (“PAIA”);
• The Electronic Communications and Transactions Act No. 25 of 2002 (“ECTA”);
• The Consumer Protection Act No. 68 of 2008 (“CPA”);
• The National Environmental Management: Biodiversity Act 10 of 2004 (“NEMBA”) and provincial nature conservation legislation (Limpopo Environmental Management Act 7 of 2003, Mpumalanga Nature Conservation Act 10 of 1998, North West ordinances) governing hunting outfitter permits, TOPS registers, and CITES export certificates; and
• International Data Privacy Standards, including the European Union and United Kingdom General Data Protection Regulation (Regulation (EU) 2016/679 / UK GDPR) and United States state consumer privacy statutes (California Consumer Privacy Act as amended by the CPRA).

02.Lawful Grounds & Justification for Processing

In terms of Section 11(1) of POPIA and Article 6(1) of the GDPR, Kampvuur Safaris processes personal information strictly under one or more of the following lawful grounds:

• Performance of a Contract (POPIA s11(1)(b) / GDPR Art 6(1)(b)): Processing is necessary to execute your private safari expeditions, reserve exclusive concession suites, issue outfitter gear store shipments, and fulfill outfitter contracts.
• Statutory & Regulatory Obligations (POPIA s11(1)(c) / GDPR Art 6(1)(c)): Processing is mandatory to comply with South African law, including provincial nature conservation guest registers, NEMBA TOPS registers, CITES trophy export documentation, South African Police Service (SAPS 520) temporary firearm import permits, and the Tax Administration Act No. 28 of 2011 (maintaining commercial invoices for 5 years).
• Vital Interests of the Traveler (POPIA s11(1)(d) / GDPR Art 6(1)(d)): Processing medical fitness notes, emergency contact coordinates, and blood-group/allergy data to safeguard guest life and physical wellbeing during remote wilderness emergencies and medical evacuation (medevac).
• Legitimate Operational Interests (POPIA s11(1)(f) / GDPR Art 6(1)(f)): Processing is required to secure our digital platform, process fraud-screened payments, maintain outfitter inventory, and coordinate airport and airstrip transfers.
• Voluntary & Explicit Consent (POPIA s11(1)(a) / GDPR Art 6(1)(a)): Where explicit consent is provided to receive custom safari proposals, subscribe to wilderness field journals, or request bespoke expedition itineraries.

03.Categories of Personal Information Collected

In compliance with the Principle of Minimality (Section 10 of POPIA), we collect only the personal information strictly necessary for safari operations, conservation compliance, and outfitter store orders:

04.Compliance with the 8 Conditions for Lawful Processing

Our operations embed the eight statutory conditions of Chapter 3 of POPIA:

05.Special Personal Information: Hunting Dossiers, Firearms & Wilderness Health

Operating licensed hunting expeditions in remote African wilderness concessions with dangerous big game requires heightened safety and confidentiality standards. In terms of Sections 26 to 32 of POPIA and Article 9 of the GDPR, Special Personal Information is handled under strict safeguards:

• Firearm Particulars & SAPS 520 Permits (Firearms Control Act 60 of 2000): Firearm make, model, caliber, barrel length, and serial numbers are collected strictly to facilitate temporary import/export permits with the South African Police Service (SAPS 520) and to comply with shooting range safety registers. This information is shared exclusively with accredited firearm clearing agents, SAPS border control, and authorized camp armories.
• NEMBA TOPS & CITES Wildlife Permit Registers: Foreign hunter passport biodata and proof of overseas residence are strictly required by the Department of Forestry, Fisheries and the Environment (DFFE) and provincial conservation authorities to issue statutory hunting licenses, Threatened or Protected Species (TOPS) permits, and CITES export certificates.
• Wilderness Medical Fitness & Emergency Medevac: Blood type, medical conditions, and emergency contacts collected in your confidential Traveler Dossier are accessible strictly by our Lead Outfitter & Professional Hunter (PH) and emergency medical flight teams to provide life-saving medevac care in the bush.
• Pastoral & Fireside Discretion: Personal conversations, family travel circumstances, and campfire discussions are held in the highest standard of personal, ethical, and professional confidence.

06.Financial Transactions & Secure Payment Gateway Integrity

Every transaction across our website is governed by strict financial encryption standards:

• Server-Side Price Calculation: All transaction totals are calculated dynamically on the server from verified database prices with zero client-side manipulation.
• PCI-DSS Level 1 Encrypted Settlement: Online card payments, Instant EFT, and SnapScan transactions are processed through authorized payment gateway infrastructure on 256-bit SSL encrypted banking rails.
• Direct Bank Transfers (Bank Zero Mutual Bank EFT): For clients paying via direct bank wire, proof of payment receipts are processed directly by our finance desk into Bank Zero Mutual Bank (Branch 888000, Account 80204889621).
• Zero Local Storage of Card Details: Kampvuur Safaris never stores credit card numbers, CVV codes, or banking passwords on its servers.

07.Authorized Operators & Cloud Infrastructure (Section 72 POPIA)

We do not sell, rent, or trade client information. Personal data is disclosed to authorized Operators solely to execute safari and outfitter services:

• Cloud Database (Supabase PostgreSQL): Encrypted database tables with Row Level Security (RLS) guaranteeing strict multi-tenant isolation.
• Web Platform Hosting (Google Firebase / GCP): Web application delivery under Section 72(1)(a) of POPIA governed by binding enterprise data protection standards.
• Authorized Payment Gateway Operators: Transaction settlement and instant payment clearing under PCI-DSS Level 1 compliance.
• Insured Express Courier & Logistics Networks: Delivery addresses and contact phone numbers provided to vetted domestic and international express couriers solely to fulfill local and worldwide merchandise deliveries under Incoterms 2020 DAP.
• Authenticated Mail Servers (Truehost Cloud): Transactional vouchers and dispatch notifications dispatched through authenticated SSL SMTP servers (mail.kampvuursafaris.co.za).

08.Security Safeguards & Breach Protocol (Sections 19–22)

We implement comprehensive technical, administrative, and operational safeguards to defend traveler records against unauthorized loss, breach, or damage:

Section 22 Breach Protocol: In the unlikely event of a suspected or confirmed security compromise, Kampvuur Safaris will notify the South African Information Regulator and affected travelers as soon as reasonably possible in writing.

09.International Data Protection Standards: EU/UK GDPR & US CCPA/CPRA

Because Kampvuur Safaris predominantly serves international guests and hunters from North America, the United Kingdom, Europe, and worldwide, we maintain rigorous cross-border privacy parity:

10.Local Industry Cooperation & Accredited Shooting Range Data Protocols

In our collaboration with local industry partners, accredited shooting ranges, private game reserves, and registered taxidermists:

• Certified Shooting Ranges: When you purchase or validate a digital shooting range pass, client identity and caliber details are transmitted securely to range management solely to verify safety qualification, validate digital liability waivers (ECTA §13), and maintain range safety logs under the Firearms Control Act 60 of 2000.
• Registered Taxidermists & Dip-and-Pack: Trophy tagging identifiers and hunter export permits are transferred to veterinary-certified South African taxidermy partners strictly to prepare and export legal hunting trophies under DFFE/CITES oversight.
• Zero Unauthorized Disclosure: We strictly prohibit the unauthorized distribution, commercial sharing, or list rental of our client dossiers across partner networks.

11.Retention & Destruction of Records (Section 14 POPIA)

Personal data is retained only as long as necessary to fulfill statutory, conservation, or contractual requirements:

• Financial & Invoicing Records: Retained for a mandatory statutory period of five (5) years under the Tax Administration Act No. 28 of 2011 and Companies Act 71 of 2008.
• Provincial Hunting & CITES Registers: Retained in accordance with Nature Conservation Ordinance and DFFE biodiversity audit requirements.
• Outfitter Store Order Records: Archived after delivery completion, retaining only the order reference for warranty and return tracking.
• Destruction Protocol: Expired digital records are purged using cryptographic deletion routines.

12.Data Subject Rights & Information Officer Contact

Under Sections 23, 24, and 25 of POPIA, the provisions of PAIA, and Articles 15 to 22 of the GDPR, you have the following enforceable statutory rights:

• Right of Access: Request confirmation whether we hold your personal information and obtain a formal copy.
• Right to Rectification: Request correction or updating of inaccurate, outdated, or incomplete records.
• Right to Erasure / Deletion: Request destruction or deletion of personal information where retention is no longer authorized.
• Right to Object: Object on reasonable grounds to the processing of your personal information (Form 1 of the POPIA Regulations).
• Right to Withdraw Consent: Withdraw consent for non-essential communications at any time.

13.Direct Marketing, Cookies & reCAPTCHA v3

Electronic Direct Marketing (Section 69 POPIA): We strictly adhere to Section 69 of POPIA. We only send safari announcements or new outfitter gear release notifications where you have given explicit opt-in consent or where you are an existing customer who booked or ordered with us previously. Every newsletter contains an immediate 1-click unsubscribe link.

Strictly Necessary Cookies: Cookies required for our website to operate (such as shopping cart storage, multi-currency display, and session authentication tokens) do not require prior consent under South African law as they are strictly necessary to deliver services requested by the user.

Non-Essential Cookies & Analytics Opt-In: Analytics (Google Analytics 4), performance measurement, and advertising tracking pixels process personal identifiers and require informed, voluntary opt-in consent under POPIA. We uphold a strict no pre-ticked boxes standard: non-essential cookies remain disabled until you actively opt in.

• Shopping Cart Persistence (kvs_cart): Preserves your selected outfitter gear in your expedition pack across page navigation.
• Currency Calculation (kvs_currency): Stores your preferred currency denomination.
• Session Navigation State (sb-*-auth-token): Preserves your traveler account authentication session.
• Google reCAPTCHA v3: Evaluates risk scores to defend against malicious spam and automated bot submissions on our inquiry and booking forms.

14.Lodging a Complaint with the Information Regulator

While we encourage travelers and clients to resolve any concerns directly with our Information Officer, you have the statutory right under Section 74 of POPIA to lodge a formal complaint with the South African Information Regulator: