Introduction
Welcome to African Lions Tours ("African Lions," "we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website africanlions.tours, use our booking services, interact with our mobile applications, or engage with us through third-party platforms including Meta (Facebook/Instagram).
We are committed to protecting your privacy and ensuring that your personal data is handled responsibly and in accordance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and Egypt's Personal Data Protection Law (Law No. 151 of 2020).
Important
By using our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please discontinue use of our services and contact us to request deletion of any data already collected.
Who We Are
African Lions Tours is a luxury travel and entertainment company headquartered in Cairo, Egypt. We specialize in royal heritage expeditions, desert safari experiences, fleet logistics, high-end music festivals, and bespoke travel concierge services across Egypt.
Data Controller
African Lions Tours
Registered Location
Cairo, Egypt
Contact Email
privacy@africanlions.toursWebsite
africanlions.toursData We Collect
We collect various types of information depending on how you interact with our services. Below is a detailed breakdown organized by data category.
Account & Booking Data
When you make a booking inquiry, subscribe to our newsletter, or create an account, we may collect:
| Data Category | Specific Data Points | Collection Method |
|---|---|---|
| Identity | Full name, nationality, passport number (for visa-required expeditions) | Booking forms, concierge inquiries |
| Contact | Email address, phone/WhatsApp number, preferred language | Booking forms, newsletter signup, WhatsApp chat |
| Booking Details | Trip selections, event ticket tiers, travel dates, group size, special requirements (dietary, accessibility, VIP preferences) | Booking drawer, trip designer, inquiry forms |
| Payment | Payment method type, transaction reference (we do not store full card numbers — payment is processed by PCI-DSS compliant third-party processors) | Payment gateway redirect |
| Preferences | Language preference, currency selection, shortlisted expeditions/events, recently viewed items | Browser localStorage, session activity |
Meta Platform Data (Facebook / Instagram)
When you connect your Meta (Facebook or Instagram) account to African Lions Tours — for example, to enable automated social media publishing or to log in via Facebook — we may receive the following data from the Meta Graph API in accordance with Meta Platform Terms:
| Permission Scope | Data Received | Purpose |
|---|---|---|
| public_profile | Name, profile picture URL, Facebook User ID | Account identification, personalization |
| Primary email address associated with Meta account | Account creation, booking confirmations | |
| pages_manage_posts | OAuth access token for authorized Facebook Pages | Automated publishing of expedition highlights, event announcements, and social wall content to authorized Pages |
| instagram_basic | Instagram profile information, media metadata | Social wall integration, displaying curated travel content |
| pages_read_engagement | Page post insights, engagement metrics | Analyzing content performance for trip planning content |
Meta OAuth Tokens
OAuth tokens are stored encrypted at rest and are used exclusively for the authorized purposes described above. You may revoke these permissions at any time through your Facebook Business Integrations settings or by following our Data Deletion Instructions.
Cookies & Analytics
We use the following technologies to enhance your experience and analyze site performance:
| Technology | Type | Purpose | Retention |
|---|---|---|---|
| Essential Cookies | Strictly necessary | Session management, language/currency preferences, CSRF protection | Session / 1 year |
| localStorage | Client-side storage | Shortlisted items, recently viewed expeditions, preferred language/currency | Until cleared by user |
| Analytics | Performance | Anonymous page view counts, interaction patterns, device type, referral sources | 26 months |
| Meta Pixel | Marketing | Conversion tracking for advertising campaigns (if enabled) | 180 days |
Purpose of Processing
We process your personal data for the following specific purposes:
- Booking Fulfillment — Processing expedition reservations, event ticket purchases, fleet transport arrangements, and luxury concierge services.
- Communication — Sending booking confirmations, itinerary updates, visa requirement notifications, and responding to concierge inquiries via email or WhatsApp.
- Social Media Management — Publishing content to authorized Facebook Pages and Instagram profiles using Meta Graph API tokens you have explicitly granted.
- Personalization — Displaying content in your preferred language and currency, showing recently viewed expeditions, and curating recommendations based on your interests.
- Marketing — Sending newsletters about new expeditions, upcoming music festivals, seasonal offers, and desert glamping packages (only with your explicit opt-in consent).
- Analytics & Improvement — Understanding how visitors interact with our website to improve user experience, optimize content, and enhance our booking flow.
- Legal Compliance — Meeting tax reporting obligations, regulatory requirements, and responding to lawful government requests.
Legal Basis for Processing
Under GDPR and applicable data protection laws, we rely on the following legal bases:
| Legal Basis | Applies To |
|---|---|
| Contract Performance | Processing bookings, delivering travel services, managing event registrations |
| Consent | Newsletter subscriptions, Meta OAuth token grants, marketing communications, Meta Pixel tracking |
| Legitimate Interest | Website analytics, fraud prevention, service improvement, security monitoring |
| Legal Obligation | Tax records, regulatory reporting, lawful data disclosure requests |
Data Sharing & Third Parties
We do not sell your personal data. We may share data with the following categories of third parties strictly for the purposes outlined in this policy:
- Payment Processors — PCI-DSS compliant payment gateways to process booking transactions securely.
- Meta Platforms, Inc. — When you authorize Facebook/Instagram integration, data flows through Meta's Graph API under your granted permissions. Subject to Meta's Privacy Policy.
- Email & Communication Providers — For transactional emails (booking confirmations, itinerary delivery) and newsletter distribution.
- Cloud Infrastructure — Hosting providers with data processing agreements (DPAs) ensuring GDPR-compliant data handling.
- Analytics Partners — Anonymized, aggregated analytics data to improve our services.
- Travel Partners — Hotel chains, desert camp operators, transport fleet providers, and event venue partners who require guest details to fulfill your booking (shared only on a need-to-know basis).
- Law Enforcement — When required by applicable law, court order, or governmental regulation.
Data Retention Periods
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law:
| Data Type | Retention Period | Rationale |
|---|---|---|
| Booking Records | 7 years from completion | Tax and accounting obligations under Egyptian law |
| Account Profile | Until account deletion request | Active service delivery |
| Newsletter Subscription | Until unsubscribe | Consent-based; revocable at any time |
| Meta OAuth Tokens | Until revoked by user or token expiry | Required for authorized social publishing |
| Analytics Data | 26 months (anonymized) | Service improvement |
| Communication Logs | 3 years | Customer service records, dispute resolution |
| Server Logs | 90 days | Security monitoring, incident response |
Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
Right of Access
Request a copy of all personal data we hold about you.
Right to Rectification
Request correction of inaccurate or incomplete personal data.
Right to Erasure
Request deletion of your personal data ("right to be forgotten"). See our Data Deletion Instructions.
Right to Restrict Processing
Request limitation of how we process your data in certain circumstances.
Right to Data Portability
Receive your data in a structured, machine-readable format.
Right to Object
Object to processing based on legitimate interests or direct marketing.
Right to Withdraw Consent
Withdraw consent at any time where processing is consent-based (e.g., newsletters, Meta tokens).
CCPA Rights
California residents: right to know, delete, opt-out of sale (we do not sell data), and non-discrimination.
To exercise any of these rights, email us at privacy@africanlions.tours. We will respond within 30 calendar days (or within the timeframe required by your applicable law).
Security Measures
We implement robust technical and organizational measures to protect your personal data:
- Encryption in Transit — All data transmitted between your browser and our servers is encrypted using TLS 1.3.
- Encryption at Rest — Sensitive data (including Meta OAuth tokens) is encrypted at rest using AES-256.
- Access Controls — Role-based access control (RBAC) ensures only authorized personnel can access personal data.
- Infrastructure Security — Our servers run in hardened environments with regular security patches, firewall rules, and intrusion detection systems.
- Database Security — PostgreSQL databases with enforced authentication, encrypted connections, and regular automated backups.
- Monitoring & Incident Response — 24/7 server monitoring, automated alerts, and a documented incident response procedure.
- Vendor Due Diligence — All third-party processors are vetted for GDPR compliance and bound by data processing agreements (DPAs).
International Data Transfers
As we serve an international clientele, your data may be transferred to and processed in countries outside your jurisdiction (including Egypt, the European Economic Area, and the United States). When transfers occur, we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Data Processing Agreements (DPAs) with all processors
- Encryption and access controls during transit and storage
Children's Privacy
Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us at privacy@africanlions.tours and we will promptly delete such data.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the “Last updated” date at the top of this page
- Notify you via email if the changes are significant (for registered users)
- Post a visible notice on our website for at least 30 days
We encourage you to review this page periodically to stay informed about how we protect your data.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out to us:
Privacy Inquiries
privacy@africanlions.toursGeneral Support
support@africanlions.toursData Deletion Requests
privacy@africanlions.toursResponse SLA
Within 30 calendar days
If you are not satisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority (DPA).