1. Data we collect
We collect only what is needed to process your booking and run your visit:
- Booking data: full name, email address, WhatsApp number, country, visit date and session, number and category of guests, and any notes you write (e.g. allergies or special needs).
- Transaction data: payment status and amount. We never receive or store your card number, PIN or banking credentials; these are handled directly by the payment provider.
- Technical data: IP address and device information processed during security verification (Cloudflare Turnstile) and hosting, to prevent abuse.
- Donation or adoption data (if you use them): name, contact and amount.
2. How we use it
Your data is used to:
- create and send your e-ticket and booking confirmation by email;
- validate tickets at the entrance and manage daily quotas so wildlife is not disturbed;
- contact you about schedule, weather or safety changes;
- process cancellations and refunds;
- internal and financial reporting, and to meet legal obligations;
- prevent fraud and misuse of the booking system.
3. Legal basis
We process data based on your consent when you submit the booking form, the need to perform our visit agreement with you, and applicable legal obligations. We do not sell your personal data and do not use it for third-party advertising.
4. Who processes data with us
To run the service, data may be processed by the following providers, only as far as necessary:
- Supabase — database for bookings and site content.
- Cloudflare — site hosting and security verification (Turnstile).
- Brevo and/or Resend — e-ticket email delivery.
- Payment provider — transaction processing (to be named once connected).
- KOMPPASS staff and guides on duty — only the data needed for your visit.
5. Retention and security
Booking data is kept as long as needed for operations and bookkeeping, generally up to 2 years after the visit date, then deleted or anonymised unless the law requires longer.
Admin access is role-based and login-protected, and the site uses HTTPS. No system is entirely risk-free; if a breach affects you, we will notify you as required by law.
6. Your rights
You may request access to, correction, deletion or restriction of your personal data, withdraw consent, and object to processing. Send your request to the contact below with your booking code and email. We respond within a reasonable time, no later than 14 working days. Deletion may be limited for data we must keep by law.
7. Children
Bookings for guests under 17 must be made by a parent, guardian or responsible school. We do not directly request personal data from children beyond the guest's name where needed.
8. Browser storage (cookies)
This site uses no advertising or tracking cookies. Your browser may store temporary data to load pages faster (e.g. a copy of site content) and security-verification tokens. Admin users have a login session. You can clear this data any time in your browser settings.
9. Changes
We may update this policy. The latest version is always on this page with the date above. Material changes will be announced on the site.
10. Contact us
Questions or requests about personal data can be sent through the contact below.