Website policies

1. Who is responsible for your information

Waka Natures Limited, operating as Waka Natures, is a Ugandan organisation focused on environmental conservation, climate action and community development. For the website activities described here, Waka Natures Limited determines why and how your information is used and acts as the data controller.

Send privacy questions and rights requests through our contact form, marking your message “Privacy request”. Our postal address and dedicated privacy email, together with any applicable EU representative or data protection officer contact details, will be added once confirmed.

2. Information collected

• Enquiries: your name, email address, message, enquiry category and submission time.
• Travel requests: the above information, the journey you select, preferred dates and number of travellers if supplied.
• Volunteer and partnership requests: your contact information, message and area of interest.
• Donations: name, email, amount, currency, programme preference, transaction references, payment status and relevant timestamps. Flutterwave collects payment details on its checkout; this website does not store full card details.
• Customer reviews: your display name, star rating, comment and submission date are published on the Safari page. Contact us to request removal of your review. Avoid including private or sensitive information in your comment.
• Administration and published content: account identifiers and authentication records; names, biographies or photographs included in content by authorised administrators.
• Technical information: IP addresses and request/browser information received by hosting and service providers. The website uses a hashed IP-based identifier and request count to limit automated abuse.

We receive information directly from you, payment confirmation information from Flutterwave, and content supplied by our administrators. Please do not include identity documents, health information or other sensitive details in general enquiry forms. If information about you appears in a photograph or profile, contact us with the relevant page.

3. Purposes and lawful bases

Where GDPR applies, the intended bases for these activities are:

• Answering general enquiries and coordinating community relationships: legitimate interests in responding to people who contact us and running our organisation, subject to their rights and reasonable expectations.
• Preparing a travel quote you request: steps taken at your request before entering into a contract; administering an agreed booking where necessary to perform that contract.
• Processing and reconciling donations: legitimate interests in carrying out your requested donation, preventing fraud and maintaining reliable financial records.
• Securing administrator access and preventing abuse: legitimate interests in protecting the website and its users.
• Optional uses requiring consent: a separate, specific consent request will explain the purpose. You can withdraw consent without affecting processing that was lawful before withdrawal.

Any reliance on a GDPR legal obligation must identify an applicable EU or Member State law. We do not treat every accounting requirement as that legal basis. The controller must confirm the bases and relevant assessments before this notice is finalised.

Required form fields are needed to respond to your enquiry or process your donation. Without them, we may be unable to provide that service. Other details are optional. Reading this notice is not consent to marketing.

4. Who receives information

Authorised administrators can access enquiries and donation records. Supabase provides database, account authentication and image storage services. Flutterwave processes payments and may handle information for its own regulatory and fraud-prevention purposes. Website hosting and delivery providers receive technical request information.

Published profiles and photographs are visible to website visitors. Uploaded website images are held in a public storage bucket; an unpublished content entry does not make its image private. General enquiries and donation records are not public.

Information may also need to be disclosed to professional advisers or competent authorities where necessary and legally justified. The website does not automatically enrol enquirers or donors in a marketing mailing list.

5. International processing

Waka Natures operates in Uganda. Our providers may process information in other countries, including outside the European Economic Area. GDPR-covered transfers require an applicable transfer mechanism, such as an adequacy decision or appropriate safeguards, which may include standard contractual clauses and additional measures where needed.

The specific hosting locations, recipients and transfer mechanisms for this deployment are being confirmed. This notice does not assert that a particular transfer agreement is already in place. Contact us for the applicable details and how to obtain a copy of relevant safeguards.

6. How long information is kept

Retention is determined by the purpose of the record, whether an enquiry or relationship remains active, any applicable recordkeeping requirement, and the need to resolve disputes. Information should be deleted or anonymised when it is no longer needed. Exact schedules and the deletion process are being confirmed; this website does not currently automate deletion of enquiry or donation records.

Abuse-prevention counters expire after one hour and expired entries are removed when a later rate-limited request is processed. Provider logs and backups may have separate retention arrangements. Replacing an image does not automatically delete the older file from storage.

7. Your rights

Where GDPR applies, and subject to its conditions, you may request:

• Access to your personal data and information about its use.
• Correction of inaccurate or incomplete information.
• Erasure of information or restriction of its processing.
• Portability of data you supplied where automated processing is based on consent or a contract.
• Withdrawal of consent where that is the basis for processing.

You may object to processing based on legitimate interests for reasons relating to your circumstances, and to direct marketing at any time. Rights are not absolute; if a request cannot be fulfilled, we must explain the reason.

Use our contact form to exercise your rights. We may request proportionate information to verify your identity. GDPR requests must normally be answered within one month; a necessary extension of up to two further months must be explained within the first month. Requests are ordinarily free of charge.

You can complain to a supervisory authority, particularly in the EU country where you live, work or consider an infringement occurred. You do not have to contact us first. Find contact details in the European Data Protection Board’s authority directory.

8. Browser storage and external services

Our tawk.to live chat loads an external widget. Read the tawk.to privacy policy. The chat service receives technical connection information and any messages or contact details you choose to share; it may use cookies or browser storage to operate the service. Do not send payment card details or other sensitive information in chat. Administrator sign-in uses browser storage to maintain the authenticated session. The site does not add advertising trackers. The live chat provider may process visitor activity to operate its chat service; see its privacy policy for details. When a production page fails, a limited operational report records only the error category and whether it happened in the public site or admin area; it does not include form data, error messages, URLs or stack traces. The hosting provider processes connection information as part of handling these requests. Google Fonts is loaded externally, so your browser sends Google technical information, including your IP address, when requesting fonts. External image hosts can also receive requests when their images appear on a page.

Flutterwave’s checkout and linked external websites have their own privacy and cookie practices. Browser settings let you manage local storage and cookies; blocking essential storage can prevent administrator sign-in. Any future non-essential tracking must be assessed and, where required, kept inactive until consent is given.

9. Security, children and automated decisions

Access controls limit private website records to authorised administrators, and payment verification takes place on the server. No online service can guarantee absolute security.

These forms are not intended to collect personal information directly from children. A parent, guardian or authorised school representative should contact us about children’s participation. Tell us if a child’s information has been submitted or published inappropriately.

Waka Natures does not use this website to make solely automated decisions with legal or similarly significant effects on individuals. Technical abuse checks may limit requests; contact us if you cannot submit a legitimate enquiry. Flutterwave operates its own payment and fraud checks.

10. Changes and further information

Updates will appear on this page with a revised date. Material changes will be communicated where required, and a new purpose will be explained before information is used for it.

Read the European Commission’s guide to data protection rights.