Who is responsible
PISFA Tour and Travel Limited trading as PISFA Tours and Travels, of Kampala, Uganda, decides how and why your personal information is used, and is the data collector and processor for it under the Uganda Data Protection and Privacy Act 2019. You can reach us at info@pisfatoursandtravel.com or on +256771755952.
What we collect
Only what a booking actually needs, and it varies by service:
- Everyone: your name, email address and telephone number, and what you asked us about.
- Travellers on a tour: the names, nationalities and passport details required by the Uganda Wildlife Authority to issue permits, and anything you tell us about mobility or a medical condition that affects the itinerary.
- Self-drive hirers: a copy of your driving permit and an identity document, which the law and our insurers require us to verify and keep.
- People who pay us: a record of the payment, the method used, and a reference. We never store full payment card numbers — card payments are handled by the payment provider, and their systems hold those details, not ours.
- Anyone using this site: the technical information a web server records — the pages requested, the time, and the browser used — which we use to keep the site working and secure.
Why we use it, and on what basis
Most of what we hold is used to perform the contract you have with us: arranging your trip, issuing quotations and invoices, and keeping you informed about a booking you have made. Some is held because the law requires it — tax records, and the driver verification our insurance is conditional on. A small amount is used for our legitimate interest in running the business safely, such as keeping an audit trail of who changed what.
We send marketing only to people who have asked for it, and every such message carries a way to stop receiving them. Booking confirmations, reminders and invoices are not marketing and are sent whether or not you subscribe.
Who else sees it
Your information is shared only with those who need it to deliver what you booked: the lodge or hotel you are staying at, the Uganda Wildlife Authority for permits, an airline where we are ticketing for you, our insurers, our payment providers, and our accountants and advisers. We do not sell personal information, and we do not share it for anyone else's marketing.
Where the law requires disclosure — to the Uganda Revenue Authority, the police, or a court — we comply, and we tell you unless we are prohibited from doing so.
Some of the services we rely on, such as email delivery and hosting, process data outside Uganda. Where that happens we satisfy ourselves that the information is protected to a comparable standard.
How we protect it
Connections to this website are encrypted. Passwords are stored only as irreversible hashes, never as text. Documents you upload — a permit, an identity page — are held on private storage that is not reachable from the public web, and are served only to people authorised to see them. Staff accounts that can reach personal data are protected by two-factor authentication, and changes to records are recorded against the person who made them.
How long we keep it
Booking and financial records are kept for the period Ugandan tax law requires, which is currently six years. Verification documents for a hire are kept for the duration of the hire and for as long afterwards as an insurance claim could still arise. Enquiries that do not become bookings are removed once they are plainly no longer live. Anything we no longer have a reason to hold is deleted.
Your rights
Under the Data Protection and Privacy Act 2019 you may ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything that is wrong or out of date;
- delete what we no longer need to keep;
- stop using it for a particular purpose, including marketing;
- complain to the Personal Data Protection Office if you are not satisfied with how we have handled a request.
Write to info@pisfatoursandtravel.com and we will answer within thirty days. We may ask you to confirm who you are first — handing somebody's records to the wrong person is the failure this whole policy exists to prevent.
Cookies
This site sets the cookies it needs to work: one that keeps you signed in, and one that protects forms against cross-site request forgery. Both are required for the site to function and cannot be turned off while you use it. We do not use advertising or cross-site tracking cookies.
Changes and questions
When this policy changes we update the date at the top of the page. Where a change materially affects how we use information we already hold, we tell affected customers directly.
For anything to do with your information, use the contact form or write to us at the address above. See also the booking terms.