Your information, and what we do with it

1. About this notice

CDPA ss. 15 & 16 — disclosures on collection

Wild Horizons has been operating in Victoria Falls since 1981. We arrange adventure activities, river cruises, scenic flights, transfers, dining and lodge accommodation across Zimbabwe, Zambia and Botswana, and we handle the personal information of guests, enquirers, travel agents and website visitors in doing so.

This notice explains what personal information we collect about you, why we collect it, who we share it with, how long we keep it, and what rights you have. It applies to:

• our websites, including wildhorizons.co.za, theelephantcamp.com, olddriftlodge.com, wallowlodge.com, thelookoutcafe.com, victoriafalls-wedding.com and agents.wildhorizons.co.za;
• bookings and enquiries made by phone, email, WhatsApp, social media, in person or through a travel agent, tour operator or online travel agent;
• your stay at our lodges and field sites, your participation in our activities, and your visit to The Lookout Café;
• events, weddings and private functions we host.

Employees, applicants and suppliers

This notice is written for guests, enquirers and website users. If you work for us, apply to work for us, or supply us, the privacy information relevant to you is provided separately — through your employment contract and HR onboarding documentation, or through your supplier agreement. Contact our Data Protection Officer if you would like a copy.

Community and conservation programmes

Where we collect personal information from participants in or beneficiaries of our conservation and community programmes, we do so on the same principles set out here, and we tell you at the point of collection what we are collecting and why.

Where a specific product has additional privacy terms — a third-party activity operator's own indemnity form, for example — those terms apply alongside this notice. This notice does not cover other companies whose websites we link to, or travel agents and airlines who book on your behalf.

2. Who we are and how to reach us

CDPA s. 3 controller · s. 20(5) DPO · S.I. 155 of 2024 licensing

Data controller

We decide the purposes and means of processing your personal information, and are therefore the data controller as defined in section 3 of the Act. We hold a current data controller licence from POTRAZ under S.I. 155 of 2024, renewed annually, and we notify POTRAZ of our processing activities as section 10(2) of those regulations requires.

Data Protection Officer

We have appointed a Data Protection Officer as required by S.I. 155 of 2024, and the appointment is registered with POTRAZ. The DPO is the primary point of contact for you, for our staff and for POTRAZ on anything to do with personal data.

Who is allowed to collect your information

Only staff in roles specifically authorised to do so may collect personal information from you. Reservations staff collect booking details; activity and lodge staff collect health declarations and registration details. If someone asks you for personal information and you are unsure whether they should be, ask to speak to the lodge manager or contact our DPO.

Associated properties. Your booking may involve 310 Office, The Elephant Camp, Old Drift Lodge, Waterfalls Lodge, The Wallow Lodge or The Lookout Café.

3. Terms we use

Definitions per CDPA s. 3

4. What we collect

CDPA ss. 15 & 16 · ss. 11(1) & 12(1) sensitive and health data

What you give us

When you enquire or book. Your name, email address, telephone or WhatsApp number, country of residence, the property or experience you are interested in, your travel dates, the number and names of people travelling with you, and the content of your enquiry.

When you confirm a booking. Your full name as it appears on your passport, nationality, passport or national identity number and expiry date, date of birth, home and billing address, payment details, arrival and departure details, flight numbers, and any special requests.

When you stay with us. Guest registration details required under Zimbabwean tourism, immigration and local authority law, room preferences, restaurant and bar charges, spa or activity bookings, and any assistance you request.

When you book an adventure activity. Rafting, the gorge swing, the zipline, canopy tours, helicopter flights and game drives carry physical risk. We take signed indemnity forms, and we collect:

• your body weight, required for helicopter load calculations, rafting and harness-based activities;
• your age;
• declared medical conditions, injuries, disabilities, pregnancy, allergies and current medication;
• your emergency contact's name and telephone number;
• travel or medical insurance details, where relevant.

When you dine or attend an event. Reservation details, dietary requirements and allergies, seating preferences, and — for weddings and private functions — guest lists, menus, supplier details and the information you give us for planning.

When you contact us. The content of your emails, WhatsApp messages, social media messages, live-chat conversations and call notes, plus recordings where we tell you a call is being recorded.

When you leave a review or enter a promotion. Your name or display name, your comments and images, and your contact details.

When you work with us as a travel agent. Agent portal credentials, company details, and commission and settlement information.

Information about other people that you give us

If you book for others, provide a guest list, name an emergency contact, or book for a child, you are giving us their personal information. You are responsible for making sure they know, and that they have seen this notice. Where you give us health or other sensitive information about another adult, you must have their written consent — section 11(1) of the Act requires it.

What we collect automatically

When you use our websites we collect your IP address, approximate location derived from it, browser and device type, operating system, language settings, referring website, pages viewed, links clicked, search terms, session dates and times, and information collected through cookies and similar technologies.

What we receive from others

• Travel agents, tour operators and online travel agents who book on your behalf and pass us your details through their booking platforms.
• Our sister lodges and properties, where you have booked more than one part of your trip.
• Activity and transfer suppliers, for example after an incident, a medical issue, a complaint or an outstanding account.
• Payment providers and banks, for payments, refunds, chargebacks and suspected fraud.
• Insurers, medical evacuation providers and clinics, if you need assistance during your trip.
• Public sources and social media, where we need to verify a booking, investigate an incident, or respond to a review.

Where we obtain information about you from someone other than you, we give you the information required by section 16 of the Act when we first record it or first contact you — unless you already have it, or doing so would be impossible or take disproportionate effort.

Sensitive data, and why we ask you to sign

You may withdraw your consent at any time, without giving a reason and free of charge. Withdrawal does not affect anything we did before you withdrew, and may mean we can no longer offer you certain activities.

We treat sensitive data as Restricted under our internal classification, which limits access to staff with a genuine operational need and requires it to be encrypted and access-controlled.

We may still process health information without your consent in the narrow situations the Act allows — most relevantly, to prevent imminent danger or protect your vital interests or those of another person when you cannot consent. In a medical emergency in the field, we will share what is necessary with medics, evacuation services and hospitals.

5. Why we use it

Purpose limitation — CDPA ss. 9 & 13(c)

We collect your information for these specified, explicit and legitimate purposes and will not go on to use it in a way incompatible with them. Information collected for one purpose — a booking, for instance — is not reused for an unrelated purpose such as marketing unless we have a separate lawful basis, normally your consent.

6. Our lawful basis

CDPA s. 10 non-sensitive · ss. 11 & 12 sensitive and health

Section 10 of the Act does not list performance of a contract as a separate ground for processing non-sensitive information, so where we act to fulfil your booking we rely on your consent and, where relevant, on our legitimate interests. Contract performance is expressly available as a ground for transferring information outside Zimbabwe, and we rely on it there.

Where you have consented, you can withdraw that consent at any time, free of charge and as easily as you gave it, by contacting our DPO. We will then stop the processing that relied on it.

7. Marketing

Right to object — CDPA ss. 15(1)(c) & 16(1)(d)

We ask you to opt in before we send you marketing. We do not add you to a marketing list simply because you made a booking or an enquiry.

You have the right to object, by request and free of charge, to the use of your information for direct marketing. Click unsubscribe in any marketing email, reply STOP to a marketing message, or contact our DPO. We stop promptly and at no cost to you, and we keep a record of your withdrawal so that we do not contact you again in error.

8. Children

CDPA s. 10(1) consent · s. 26 representation of a child

Families are welcome at our lodges and children take part in age-appropriate experiences. Under the Act a child is anyone under eighteen, and we collect a child's personal information only from a parent, legal guardian or the adult making the booking.

• Parental or guardian consent is obtained before we collect personal information about a minor guest — for activity participation, for example — except where the information is needed to protect the child's safety in an emergency.
• A child's rights under the Act are exercised by their parent or legal guardian.
• We do not direct marketing at children, and we do not knowingly collect a child's information for marketing without parental consent.
• We collect only what is needed: name, age or date of birth, passport details where required, dietary and medical information, and — for certain activities — weight, because minimum age and weight limits are safety requirements.
• Photography or video of an identifiable child for marketing use requires separate, explicit written consent from a parent or guardian, distinct from any consent given for the activity itself.
• We do not subject a child's information to automated decision-making.
• We carry out regular data protection impact assessments on our processing of children's information, and design that processing to be privacy-protective by default, as S.I. 155 of 2024 requires.
• Safeguarding records involving minors are classified as Restricted and handled under heightened access and retention controls.

If you believe we hold a child's information without proper consent, tell our DPO and we will investigate and delete it where appropriate.

9. Who we share it with

Processor safeguards — CDPA s. 18(4)–(5)

We share your personal information only where necessary. Where a third party processes information on our behalf, we require a signed data processing agreement setting out the purpose, scope and duration of the processing and their obligations under the Act, together with confidentiality, security, sub-processing, audit, breach-notification and data-return commitments.

Suppliers who deliver part of your trip. Helicopter and scenic flight operators, rafting and adventure operators, cruise and boat operators, transfer and vehicle-hire companies, restaurants, partner lodges and camps in Zimbabwe, Zambia, Botswana and South Africa, and cross-border operators for Chobe and Livingstone day trips. What we share is limited to what they need — typically names, ages, weights where a safety limit applies, arrival times, dietary and relevant medical information, and pick-up details.

Our booking, payment and business systems. These are operated for us by third-party providers under data processing agreements, and include our property management (reservation) system, our payment gateway, our accounting platform, Microsoft 365 for email and productivity, and Digital Ocean for cloud hosting. Our IT support providers may have technical access to systems containing personal information in the course of maintaining them.

Online travel agents and travel trade partners. Where an OTA or travel agent made your booking, we exchange booking information with them so that it can be fulfilled and reported.

Government and regulatory bodies. The Zimbabwe Tourism Authority, immigration and border authorities, the Zimbabwe Parks and Wildlife Management Authority, the Zimbabwe Revenue Authority, local authorities, aviation and maritime safety regulators, and the police, where they lawfully require it or an incident must be reported.

Insurers, brokers, loss adjusters and medical assistance providers. For claims, incidents and medical emergencies.

Medical and emergency services. Clinics, hospitals, doctors, air ambulance and evacuation providers, where you need care.

Professional advisers. Lawyers, auditors, accountants and consultants, bound by professional confidentiality.

A purchaser or successor. If the business or part of it is sold, restructured or merged, information may transfer as part of that transaction, subject to equivalent protections.

10. Sending information outside Zimbabwe

Transborder flow — CDPA ss. 28 & 29

We operate across borders and use international service providers, so your information will leave Zimbabwe. Transfers include:

• Zambia for Livingstone activities and Botswana for Chobe day trips, where operators deliver part of your trip;
• South Africa, for Cape Town experiences and for group services provided within our corporate group;
• the countries where our cloud, software and payment providers operate — including Microsoft 365, Digital Ocean, our payment gateway and OTA booking platforms.

Section 28 of the Act allows us to transfer your information abroad only where an adequate level of protection is ensured and the transfer is solely to let us carry out our own tasks. Separately, section 10(2)(c) of S.I. 155 of 2024 requires us to notify POTRAZ of any intention to transfer or share your information outside Zimbabwe. Our DPO assesses the level of protection in the destination country, files that notification, and maintains a record of all cross-border transfers.

Where a country does not assure an adequate level of protection, section 29 permits the transfer in specific cases. We rely on:

• your unambiguous consent to the proposed transfer;
• the transfer being necessary to perform our contract with you, or to take steps at your request before it — sending your details to a Botswanan operator so your Chobe day trip can go ahead, for example;
• the transfer being necessary for a contract concluded in your interest between us and a third party, such as an activity operator or transfer company;
• the transfer being necessary to protect your vital interests, for instance in a medical evacuation;
• the transfer being necessary to establish, exercise or defend legal claims.

Contracts with overseas suppliers and platforms include appropriate safeguards — standard contractual clauses, an adequacy framework or equivalent. Ask our DPO for details of the safeguards applying to a particular transfer.

11. How we protect it

Security — CDPA s. 18 · breach notification s. 19

We take appropriate technical and organisational measures to protect your information against negligent or unauthorised destruction, loss, alteration, access or other unauthorised processing. These include:

• classifying information by sensitivity, with the strictest controls applied to Restricted data;
• restricting access to staff whose role requires it, and to specifically authorised data collectors;
• encryption in transit and, where appropriate, at rest;
• multi-factor authentication and VPN-protected remote access for staff and suppliers;
• secure hosting, backups, and firewall and endpoint protection;
• card details handled through our payment gateway rather than stored by us, with paper card authority forms securely destroyed once processed;
• physical security at our offices, lodges and field sites, including locked storage for paper indemnity and registration forms;
• staff confidentiality obligations and periodic data protection and security awareness training;
• written data processing agreements and security requirements with every supplier who handles your information, with due diligence before engagement and periodic review afterwards;
• a documented incident response and breach management process, with an annual review of our controls.

If something goes wrong

We maintain a breach register recording every reported data loss or breach event, and every notification decision.

We then cooperate with any POTRAZ enquiry, answer information requests within 14 days, and submit our concluded breach investigation report within 21 days of notification.

Where a breach originates with one of our suppliers, we remain the data controller and our own deadlines still apply. Our suppliers are contractually required to tell us within 24 hours of becoming aware.

If you believe information we hold about you has been compromised, contact our DPO immediately.

12. Cookies and website tracking

Consent basis — CDPA s. 10(1)

Our websites use cookies and similar technologies, including tag management and analytics tools, social media plug-ins for Instagram, Facebook, X, YouTube and Pinterest, a review widget, and advertising and remarketing pixels.

Accept or decline non-essential cookies through the banner on our site, and change your choice at any time via [cookie settings link]. You can also block or delete cookies in your browser — but blocking strictly necessary cookies will break parts of the site.

Some of these tools are provided by companies outside Zimbabwe, which involves the transfers described in section 10.

13. Photography, filming and CCTV

CDPA s. 10(3)(e) · written consent for identifiable images

Marketing imagery. Our guides and photographers take photographs and video at the lodges, on cruises and during activities. We obtain your written consent before using any image in which you are identifiable in our marketing, on our website or on social media. You can refuse, or later withdraw consent, by contacting our DPO or speaking to the lodge manager, and we will stop using the image going forward. Images of identifiable children require the separate written consent of a parent or guardian.

Activity media. Some activities include a photo or video package. Those images are yours and are made available to you; we keep a copy only for the period stated at the time of purchase, or where it is linked to a safety incident.

Reviews and testimonials. If you post a public review, we may quote it with your first name or display name.

CCTV. We operate CCTV in guest and operational areas for the safety of guests, staff and property. Signage identifies monitored areas. Footage is retained for 90 days and then automatically overwritten, and is disclosed only to the police, insurers or legal advisers where there is a legitimate reason.

Drones. Where drones are used for filming, we operate in accordance with Civil Aviation Authority of Zimbabwe requirements and will not deliberately film identifiable guests without consent.

14. How long we keep it

Retention — CDPA ss. 7(1)(c) & 13 · ZIMRA and immigration minimums

We keep your personal information only for as long as it is needed for the purpose it was collected, or for as long as Zimbabwean law requires. Where a law such as the Act, ZIMRA recordkeeping rules or the Labour Act sets a minimum period, that minimum applies.

When information reaches the end of its retention period it is securely destroyed or anonymised — digital records permanently deleted, paper records cross-cut shredded or destroyed by a certified contractor, and devices wiped or physically destroyed. Simply ceasing to use information is not enough.

15. Your rights

CDPA s. 14 · s. 25 automated decisions · ss. 26–27 representation

Automated decisions. Under section 25 of the Act you have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. We do not make such decisions. If that ever changes, we will tell you first.

On behalf of others. A parent or legal guardian may exercise these rights for a child. A parent, guardian, legal representative or court-appointed person may do so for someone physically, mentally or legally incapable of exercising them, on proof of incapacity by a physician or other competent person.

How to exercise them

If we have to say no. Occasionally we cannot act on a request — where a legal retention obligation such as a ZIMRA or immigration requirement still applies, or where the information is under legal hold. We will explain why, and tell you what you can do next.

16. Complaints

CDPA s. 6 complaints · s. 34 appeals

If you are unhappy with how we have handled your personal information, tell our DPO — in person, by email, or using the contact details above. We acknowledge your complaint promptly, investigate it, and give you a substantive response explaining the outcome and any action we have taken.

If we cannot resolve it to your satisfaction, we will tell you about your right to escalate to POTRAZ, Zimbabwe's Data Protection Authority, which is empowered to receive and investigate complaints about data processing. You can go to POTRAZ directly at any time.

Anyone aggrieved by a decision of the Authority may appeal to the Administrative Court.

17. Guests from the EU and UK

EU GDPR · UK GDPR, where applicable

Many of our guests travel from Europe and the United Kingdom. Where the EU General Data Protection Regulation or the UK GDPR applies to our processing — because we offer services to people in those territories — we will honour the rights those laws give you, including access, rectification, erasure, restriction, portability, and objection to processing and to direct marketing.

Contact our DPO and tell us where you are located, and we will apply whichever standard gives you the stronger protection.

18. Changes to this notice

Openness of processing — CDPA s. 23

We review this notice at least once a year, and update it when our services, systems or legal obligations change. The current version is always at wildhorizons.co.za/privacy, with its effective date at the top.

Where a change materially affects how we use your information, we will take steps to tell you before it takes effect — by email if we hold your address, or by a prominent notice on our website.

19. Contact us

Controller identity — CDPA s. 15(1)(a)