Privacy Policy

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data refers to any information that can be used to identify you personally. For detailed information on data protection, please refer to our Privacy Policy set out below.
Data Collection on This Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find the operator’s contact details in the section entitled “Information on the Controller” in this Privacy Policy.

How do we collect your data?

Some data is collected when you provide it to us. This may include, for example, information you enter into a contact form.
Other data is collected automatically or with your consent when you visit the website through our IT systems. This mainly includes technical data (e.g. your internet browser, operating system, or the time of the page request). This data is collected automatically as soon as you access this website.

What do we use your data for?

Some of the data is collected to ensure that the website is provided without errors.
Other data may be used to analyze your user behavior.

If contracts can be concluded or initiated via the website, the transmitted data will also be processed for contract offers, orders, or other business inquiries.

What rights do you have regarding your data?

You have the right, at any time and free of charge, to obtain information about the origin, recipients, and purpose of your stored personal data. You also have the right to request the correction or deletion of this data.
If you have given your consent to data processing, you may revoke this consent at any time with effect for the future.
Furthermore, under certain circumstances, you have the right to request the restriction of the processing of your personal data.
You also have the right to lodge a complaint with the competent supervisory authority.
If you have any questions regarding data protection or your personal data, you may contact us at any time.

Analytics Tools and Third-Party Tools

When you visit this website, your browsing behavior may be statistically analyzed. This is primarily done using analytics programs.
Detailed information about these analytics programs can be found in the Privacy Policy below.

2. Hosting

We host the content of our website with the following provider:
This website is hosted externally. The personal data collected on this website is stored on the servers of the hosting provider. This may include, in particular, IP addresses, contact requests, metadata and communication data, contract data, contact details, names, website access data, and other data generated through the use of a website.
External hosting is carried out for the purpose of fulfilling contracts with our prospective and existing customers (Article 6(1)(b) GDPR) and in the interest of ensuring the secure, fast, and efficient provision of our online services by a professional hosting provider (Article 6(1)(f) GDPR).
Where your consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG), insofar as the consent includes the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time with future effect.
Our hosting provider(s) will process your data only to the extent necessary to fulfill their contractual obligations and will follow our instructions with regard to such data.
We use the following hosting provider:
Crystal Webhosting
MM Plaza Luwum Street
Kampala, Uganda

3. General Information and Mandatory Information

Data Protection

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the applicable data protection laws and this Privacy Policy.
When you use this website, various types of personal data are collected. Personal data is any information that can be used to identify you personally. This Privacy Policy explains what data we collect, what we use it for, and how and for what purpose it is processed.
Please note that data transmission over the Internet (e.g. when communicating by email) may have security vulnerabilities. Complete protection of data against access by third parties is not possible.

Information on the Controller

The controller responsible for data processing on this website is:
Nalia Adventures Ltd.
Entebbe Road
Kampala, Uganda
Telephone: +256 704 073 306
Email: karibu@naliaadventures.com
The controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data (e.g. names, email addresses, etc.).

Data Retention

Unless a more specific retention period is stated in this Privacy Policy, your personal data will remain with us until the purpose for processing the data no longer applies.
If you submit a legitimate request for deletion or withdraw your consent to data processing, your personal data will be deleted unless we have other legally permissible grounds for retaining your personal data (e.g. tax or commercial law retention periods). In the latter case, the data will be deleted once those legal grounds no longer apply.

General Information on the Legal Basis for Data Processing

If you have given your consent to data processing, we process your personal data on the basis of Article 6(1)(a) GDPR or, where special categories of personal data pursuant to Article 9(1) GDPR are processed, Article 9(2)(a) GDPR.
If you have expressly consented to the transfer of personal data to third countries, processing is also based on Article 49(1)(a) GDPR.
Where you have consented to the storage of cookies or access to information on your device (e.g. through device fingerprinting), processing is additionally based on Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Consent may be withdrawn at any time with future effect.
Where your data is required for the performance of a contract or for pre-contractual measures, we process your data on the basis of Article 6(1)(b) GDPR.
We also process your data where necessary to comply with a legal obligation pursuant to Article 6(1)(c) GDPR.
Data processing may also be carried out on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR.
The specific legal basis applicable in each individual case is explained in the relevant sections of this Privacy Policy.

Recipients of Personal Data

As part of our business operations, we cooperate with various external parties. In some cases, it is necessary to transfer personal data to these external parties.
We only disclose personal data to external parties where this is necessary for the performance of a contract, where we are legally obliged to do so (e.g. disclosure to tax authorities), where we have a legitimate interest pursuant to Article 6(1)(f) GDPR, or where another legal basis permits the disclosure.
Where we use data processors, we transfer our customers’ personal data only on the basis of a valid Data Processing Agreement (DPA).
Where data is processed jointly with another controller, a Joint Controller Agreement is concluded.

Withdrawal of Your Consent to Data Processing

Many data processing operations are only possible with your explicit consent.
You may withdraw your consent at any time with future effect. The lawfulness of the data processing carried out before the withdrawal remains unaffected.

Right to Object to Data Processing in Certain Cases and to Direct Marketing (Article 21 GDPR)

WHERE YOUR PERSONAL DATA IS PROCESSED ON THE BASIS OF ARTICLE 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO THE PROCESSING OF YOUR PERSONAL DATA. THIS ALSO APPLIES TO PROFILING BASED ON THOSE PROVISIONS. THE LEGAL BASIS ON WHICH ANY PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY.
IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR THE PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, EXERCISE, OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ARTICLE 21(1) GDPR).
IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING PURPOSES. THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION PURSUANT TO ARTICLE 21(2) GDPR).

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or the place of the alleged infringement.
This right exists without prejudice to any other administrative or judicial remedies.

Right to Data Portability

You have the right to receive the data that we process automatically on the basis of your consent or in fulfilment of a contract in a commonly used, machine-readable format, either for yourself or for transmission to another controller.
If you request the direct transfer of the data to another controller, this will only be carried out where technically feasible.

Right of Access, Rectification, and Erasure

Within the framework of the applicable legal provisions, you have the right at any time to obtain, free of charge, information about your stored personal data, its origin, its recipients, and the purpose of the data processing.
You also have the right to request the correction or deletion of your personal data.
If you have any questions regarding personal data, you may contact us at any time.

Right to Restriction of Processing

You have the right to request the restriction of the processing of your personal data. You may contact us at any time to exercise this right.
The right to restriction of processing applies in the following cases:
If you contest the accuracy of your personal data stored by us, we generally require time to verify this. During the verification period, you have the right to request restriction of the processing of your personal data.
If the processing of your personal data is or has been unlawful, you may request restriction of processing instead of deletion.
If we no longer require your personal data, but you need it for the establishment, exercise, or defence of legal claims, you have the right to request restriction of processing instead of deletion.
If you have objected pursuant to Article 21(1) GDPR, a balancing of interests between your interests and ours must be carried out. Until it has been determined whose interests prevail, you have the right to request restriction of the processing of your personal data.
Where the processing of your personal data has been restricted, such data may—apart from being stored—only be processed with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State.

SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the website operator, this website uses SSL or TLS encryption.
You can recognize an encrypted connection by the change in your browser’s address bar from “http://” to “https://” and by the padlock symbol in your browser.
When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

4. Data Collection on This Website

Contact Form

If you submit inquiries to us via the contact form, the information you provide in the form, including the contact details you enter, will be stored by us for the purpose of processing your inquiry and in the event of any follow-up questions. We will not disclose this data without your consent.
The processing of this data is based on Article 6(1)(b) GDPR where your inquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the efficient handling of inquiries addressed to us (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR), where such consent has been requested. Consent may be withdrawn at any time with future effect.
The data you enter into the contact form will remain with us until you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. after your inquiry has been fully processed). Mandatory statutory provisions, in particular legal retention periods, remain unaffected.

Inquiries by Email or Telephone

If you contact us by email or telephone, your inquiry, including all personal data arising from it (such as your name and the details of your inquiry), will be stored and processed by us for the purpose of handling your request. We will not disclose this data without your consent.
The processing of this data is based on Article 6(1)(b) GDPR where your inquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the efficient handling of inquiries addressed to us (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR), where such consent has been requested. Consent may be withdrawn at any time with future effect.
The data you send to us through contact inquiries will remain with us until you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. after your request has been fully processed). Mandatory statutory provisions, in particular legal retention periods, remain unaffected.

5. Social Media

Instagram

This website incorporates features of the Instagram service. These features are provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
When the social media element is active, a direct connection is established between your device and the Instagram server. As a result, Instagram receives information about your visit to this website.
If you are logged into your Instagram account, you can link the content of this website to your Instagram profile by clicking the Instagram button. This enables Instagram to associate your visit to this website with your user account.
Please note that, as the website operator, we have no knowledge of the content of the data transmitted to Instagram or how Instagram uses such data.
The use of this service is based on your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). You may withdraw your consent at any time with future effect.
Where personal data is collected on our website using the tool described above and transmitted to Facebook or Instagram, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, are jointly responsible for this data processing pursuant to Article 26 GDPR.
This joint responsibility is limited exclusively to the collection of the data and its transmission to Facebook or Instagram. Any processing carried out by Facebook or Instagram after the data has been transmitted is not part of this joint responsibility.
Our respective obligations have been set out in a Joint Controller Agreement. The wording of this agreement is available at:
https://www.facebook.com/legal/controller_addendum
Under this agreement, we are responsible for providing the required data protection information when using the Facebook or Instagram tools and for ensuring the data protection-compliant implementation of these tools on our website. Facebook is responsible for the security of the Facebook and Instagram products.
You may exercise your data subject rights (e.g. requests for access) regarding the data processed by Facebook or Instagram directly with Facebook. If you exercise these rights with us, we are obliged to forward your request to Facebook.
Data transfers to the United States are based on the European Commission’s Standard Contractual Clauses (SCCs). Further information can be found at:

For more information, please refer to Instagram’s Privacy Policy:
https://privacycenter.instagram.com/policy/
The company is certified under the EU–US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards for data processing in the United States. Every company certified under the DPF commits to complying with these data protection standards.
Further information is available from the provider at:
https://www.dataprivacyframework.gov/participant/4452

6. Plugins and Tools

Google Maps

This website uses the Google Maps mapping service. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
This service enables us to integrate maps into our website. To use the functions of Google Maps, it is necessary to store your IP address. This information is generally transmitted to and stored on a Google server in the United States. The operator of this website has no influence over this data transfer.
When Google Maps is activated, Google may use Google Fonts to ensure the consistent display of fonts. When you access Google Maps, your browser loads the required web fonts into its browser cache to display text and fonts correctly.
The use of Google Maps is in the interest of providing an attractive presentation of our online services and making the locations indicated on our website easy to find. This constitutes a legitimate interest within the meaning of Article 6(1)(f) GDPR.
Where your consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG), insofar as your consent includes the storage of cookies or access to information on your device (e.g. device fingerprinting). You may withdraw your consent at any time with future effect.
Data transfers to the United States are based on the European Commission’s Standard Contractual Clauses (SCCs). Further information is available at:

Further information on how Google processes personal data can be found in Google’s Privacy Policy:
https://policies.google.com/privacy?hl=en
Google is certified under the EU–US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards for data processing in the United States. Every company certified under the DPF undertakes to comply with these data protection standards.
Further information is available from the provider at:
https://www.dataprivacyframework.gov/participant/5780

Mapbox

This website uses the Mapbox mapping service. The provider is the Mapbox API of the American software company Mapbox Inc., 740 15th Street NW, 5th Floor, Washington, DC 20005, USA.
Mapbox is an online mapping tool (open-source mapping) that is accessed through an application programming interface (API). When you use this service, your IP address is transmitted to and stored by Mapbox.
Through its certification under the former EU–US Privacy Shield, Mapbox represented that it complied with European data protection requirements when processing personal data in the United States. The legal basis for processing is Article 6(1)(f) GDPR.
When you visit a page on our website that includes Mapbox, Mapbox stores a cookie on your device through your web browser. As a result, information about your use of our website, including your IP address, is transmitted to a Mapbox server in the United States and stored there.
This data is processed for the purpose of displaying the website and ensuring the proper functionality of the Mapbox service. Mapbox may disclose this information to third parties where required by law or where such third parties process the information on Mapbox’s behalf.
The Mapbox Terms of Service provide further information about the use of Mapbox and the data collected by Mapbox:
https://www.mapbox.com/tos/#maps
If you do not agree with this processing, you may prevent the installation of cookies by adjusting the appropriate settings in your web browser.
Further information about the collection and use of data, as well as your rights and options for protecting your privacy, is available in Mapbox’s Privacy Policy:
https://www.mapbox.com/privacy/

Google Fonts

This website uses Google Fonts, provided by Google, to ensure the consistent display of fonts.
When you access a page, your browser loads the required fonts into its browser cache to display text and fonts correctly. For this purpose, the browser you use must establish a connection to Google’s servers. As a result, Google becomes aware that this website has been accessed via your IP address.
The use of Google Fonts is based on Article 6(1)(f) GDPR. The website operator has a legitimate interest in ensuring a consistent presentation of the website’s typography.
Where your consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG), insofar as your consent includes the storage of cookies or access to information on your device (e.g. device fingerprinting). You may withdraw your consent at any time with future effect.
If your browser does not support Google Fonts, a standard font installed on your computer will be used instead.
Further information about Google Fonts is available at:
https://developers.google.com/fonts/faq
Further information on Google’s processing of personal data can be found in Google’s Privacy Policy:
https://policies.google.com/privacy?hl=en
Google is certified under the EU–US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards for data processing in the United States. Every company certified under the DPF undertakes to comply with these data protection standards.
Further information is available from the provider at:
https://www.dataprivacyframework.gov/participant/5780

Need help ?