Privacy Policy

ATC African Travel Concept (Pty) Ltd
Last updated: 9 September 2026

This Privacy Policy describes how ATC African Travel Concept (Pty) Ltd collects, uses, shares and protects your personal information when you use our website, our AI travel concierge, and the services we provide, and it tells you about your privacy rights and how the law protects you.

We process your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”). By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy.

1. Who we are

ATC African Travel Concept (Pty) Ltd (referred to as “the Company”, “ATC”, “we”, “us” or “our”)
Registration number: 1997/008398/07
Physical address: 5th Floor Graphic Centre, 199 Loop Street, Cape Town
Country: South Africa
Website: www.africantravelconcept.com
Email: info@africantravelconcept.com
Telephone: +27-21-426 0032

For the purposes of POPIA, ATC is the Responsible Party in respect of the personal information described in this policy.

Information Officer

Our appointed Information Officer is responsible for ensuring our compliance with POPIA and for the governance, management and security of the personal information we hold.

Information Officer: Joerg Sims
Email: info@africantravelconcept.com
Telephone: +27-21-426 0032

2. What this policy covers

This policy applies to:

  • our website at www.africantravelconcept.com and www.namibia-safaris.com, together with any sub-domains or related sites we operate;
  • our AI chat bot and AI travel concierge, and any information you share in those conversations;
  • enquiries, bookings, quotes and correspondence handled by our travel consultants;
  • our newsletters and marketing communications.

Internally, our staff are bound by our Data Protection Policy (POPIA), 2025, an internal compliance framework approved by our directors. That document sets the minimum standards our employees must meet when handling personal information, covers all eight POPIA conditions for lawful processing, and includes our data breach plan, data security protocols and password policy. It is an internal document and is not distributed publicly, but the standards it sets are reflected throughout this policy, and our PAIA Manual — which sets out how to request access to, or correction of, the information we hold — is available on our website at www.africantravelconcept.com.

3. Definitions

  • Cookies are small files placed on your computer, mobile device or any other device by a website, containing details of your browsing activity on that website, among other uses.
  • Data Subject means the person to whom personal information relates — in most cases, you.
  • Device means any device that can access the Service, such as a computer, cellphone or tablet.
  • Operator means any person or entity that processes personal information on our behalf in terms of a contract or mandate, without falling under our direct authority.
  • Personal Information means any information relating to an identifiable, living natural person or an identifiable existing juristic person.
  • Processing means any collection, use, storage, sharing, deletion or destruction of personal information.
  • Responsible Party means the party that determines the purpose of and means for processing personal information.
  • Service refers to our website, our AI chat bot and AI travel concierge, and our travel services.
  • Service Provider means any natural or legal person who processes data on our behalf, including third-party companies employed by us to facilitate the Service, to provide the Service on our behalf, to perform services related to the Service, or to assist us in analysing how the Service is used.
  • Special Personal Information means information concerning your religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour. Under POPIA this category may generally only be processed with your consent or where another statutory exception applies.
  • Usage Data refers to data collected automatically, either generated by your use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
  • You means the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service.

4. The information we collect

4.1 Information you give us

When you enquire, request a quote, subscribe, book a trip or contact us, we may ask you to provide information that can be used to contact or identify you. This may include:

  • your name and surname;
  • email address and telephone number;
  • physical and postal address, and country of residence;
  • identity or passport number, date of birth and nationality (required by lodges, airlines, ground operators and immigration authorities);
  • emergency contact details;
  • travel preferences, party composition, travel dates and budget;
  • payment and banking information necessary to process a booking;
  • correspondence between you and our consultants.

Certain travel arrangements require information that POPIA treats as Special Personal Information — for example dietary requirements, allergies, medical conditions, mobility needs or medical insurance details. We collect this only where it is necessary for your safety and comfort or where a supplier requires it, we collect it with your consent, and we share it only with the suppliers who need it to fulfil your booking.

4.2 Usage Data

Usage Data is collected automatically when you use the Service. It may include your device’s Internet Protocol address (IP address), browser type and version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When you access the Service by or through a mobile device, we may collect certain information automatically, including the type of mobile device you use, your mobile device unique ID, the IP address of your mobile device, your mobile operating system, the type of mobile internet browser you use, unique device identifiers and other diagnostic data.

We may also collect information that your browser sends whenever you visit our Service.

4.3 Information from other sources

As far as is reasonably practicable, we collect personal information directly from you. In limited cases we may receive it from another source — for example from a travel agent, tour operator or partner making a booking on your behalf, from a group organiser or a fellow traveller in your party, or from information you have deliberately made public. Where we do so, we will tell you, unless one of the exceptions in POPIA applies.

5. Cookies and tracking technologies

We use cookies and similar tracking technologies to track activity on our Service and store certain information. Tracking technologies used include beacons, tags and scripts to collect and track information and to improve and analyse our Service.

  • Cookies or Browser Cookies. A cookie is a small file placed on your device. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some parts of our Service.
  • Web Beacons. Certain sections of our Service and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags and single-pixel gifs) that permit us, for example, to count users who have visited those pages or opened an email, and to compile related website statistics.

Cookies can be “Persistent” or “Session” cookies. Persistent cookies remain on your device when you go offline, while session cookies are deleted as soon as you close your web browser. We use both, for the purposes set out below.

Necessary / essential cookies

Type: Session cookies. Administered by: Us.
Purpose: These cookies are essential to provide you with services available through the website and to enable you to use some of its features. They help to authenticate users and prevent fraudulent use of user accounts. Without these cookies, the services you have asked for cannot be provided.

Cookie policy / notice acceptance cookies

Type: Persistent cookies. Administered by: Us.
Purpose: These cookies identify whether users have accepted the use of cookies on the website.

Functionality cookies

Type: Persistent cookies. Administered by: Us.
Purpose: These cookies allow us to remember choices you make when you use the website, such as your login details or language preference, so that you do not have to re-enter your preferences every time you visit.

Analytics and targeting cookies

Type: Persistent cookies. Administered by: Us and third parties.
Purpose: These cookies help us understand which pages visitors find most useful (in aggregate), measure the effectiveness of our campaigns, and allow you to share pages with social networks. They are not strictly necessary, and you may decline them.

AI concierge cookies and local storage

Our AI chat bot and travel concierge use cookies and browser local storage to maintain your conversation session, remember your place in a planning conversation, and prevent abuse of the service. See section 7 below.

Our website:

  • remembers where you are in an enquiry or booking process;
  • remembers that you are logged in and that your session is secure;
  • tracks the pages you visit via analytics tools;
  • may offer live chat or AI-assisted chat support.

You can disable cookies already stored on your device through your browser settings, but this may stop parts of our website from functioning properly.

6. How we use your personal information

We may use personal information for the following purposes:

  • To provide and maintain our Service, including to monitor its usage.
  • To respond to your enquiry and prepare a quote or itinerary, including through our AI travel concierge and our human consultants.
  • To manage your account, where you register as a user of the Service.
  • For the performance of a contract: the development, compliance and undertaking of the booking contract for the travel products or services you have purchased, or of any other contract with us through the Service.
  • To make bookings on your behalf with lodges, camps, hotels, airlines, ground handlers, guides and other suppliers.
  • To contact you by email, telephone, SMS or other equivalent forms of electronic communication regarding updates or informative communications related to your booking or to the services you have contracted, including security updates where necessary or reasonable.
  • To provide you with news, special offers and general information about goods, services and events we offer that are similar to those you have already purchased or enquired about, unless you have opted not to receive such information.
  • To manage your requests to us.
  • For business transfers: we may use your information to evaluate or conduct a merger, divestiture, restructuring, reorganisation, dissolution or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation or similar proceedings, in which personal information held by us about our Service users is among the assets transferred.
  • For other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns, and evaluating and improving our Service, products, marketing and your experience.
  • To comply with our legal obligations, resolve disputes and enforce our agreements.

Our lawful basis

Under POPIA, we process your personal information where: you have consented; the processing is necessary to conclude or perform a contract with you; the processing is necessary to comply with a legal obligation; the processing protects a legitimate interest of yours; or the processing is necessary to pursue our legitimate interests or those of a third party to whom the information is supplied. Where we rely on consent, you may withdraw it at any time, although this may mean we can no longer provide part of the Service.

7. Our AI chat bot and AI travel concierge

Our website offers an AI-powered travel concierge and chat assistant (our “AI Concierge”) to help you explore destinations, shape an itinerary, answer questions about our trips, and pass you to a human consultant when you are ready. This section explains how it handles your information. It applies in addition to the rest of this policy.

7.1 What the AI Concierge collects

  • Everything you type into the chat, including messages, questions, and any personal information you choose to share such as your name, email address, telephone number, travel dates, party size, budget and preferences.
  • Conversation history for the duration of your session, and where applicable across sessions, so the assistant can follow the thread of your planning.
  • Technical and contextual data, including a session identifier, IP address, browser and device information, the page you were on when you opened the chat, and the time and duration of the conversation.
  • Feedback you give on a response (for example a thumbs up or down), where that feature is available.

7.2 How the AI Concierge works, and who processes your conversation

The AI Concierge is provided to us by a third-party conversational AI platform, which acts as our Operator under POPIA, and it relies on one or more large language model providers to generate responses. This means the content of your conversation is transmitted to, processed by and stored on the systems of these providers on our behalf.

Our current providers are:

  • AI model provider(s): Google Gemini
  • Hosting: Local Host – WP Engine

We have operator agreements in place requiring these providers to apply security safeguards that meet or exceed our own standards, to process your information only on our instructions, and to notify us immediately if they have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person.

7.3 Training and model improvement

We do not permit our AI providers to use the content of your conversations to train their general-purpose AI models. We do review conversations internally, in a de-identified form wherever practicable, to improve the accuracy and helpfulness of the assistant, to correct errors, and to understand what our travellers are asking for.

7.4 Please don’t share sensitive details in the chat

The AI Concierge is a convenience tool, not a secure channel. Please do not enter payment card details, banking information, passwords, passport or identity numbers, or detailed medical information into the chat. When we need that information to confirm a booking, one of our consultants will request it from you through a secure channel. If you do share such information in a chat, we will treat it in accordance with this policy, but we ask you not to.

7.5 Hand-over to a human consultant

When you ask to speak to a person, or when your enquiry becomes a live quote or booking, the conversation and the contact details you have provided may be passed to one of our travel consultants and stored in our enquiry and customer records so that we can follow up. From that point, the information is handled in the same way as any other enquiry described in this policy.

7.6 Accuracy and automated decision-making

AI-generated responses can be incomplete, out of date or incorrect. Anything the AI Concierge tells you about availability, pricing, itineraries, park fees, visas, health requirements or travel conditions is indicative only and must be confirmed by one of our consultants before you rely on it. Nothing generated by the AI Concierge constitutes a quote, a booking confirmation, or travel, medical, visa or legal advice.

In line with section 71 of POPIA, we do not make decisions about you that have legal consequences or that affect you to a substantial degree based solely on automated processing. A human consultant reviews and confirms every quote and booking.

7.7 Retention of conversations

We retain AI Concierge conversation transcripts for [INSERT PERIOD, e.g. 12 months] from the date of the conversation, and for longer where the conversation formed part of an enquiry or booking, in which case it is retained with the rest of that booking record in accordance with section 10 below. You may ask us to delete your conversation history at any time using the contact details in section 16.

7.8 Children and the AI Concierge

The AI Concierge is not intended for use by children. If you are under 18, please do not use the chat without the consent and supervision of a parent or legal guardian.

8. Who we share your information with

We may share your personal information in the following situations:

  • With travel suppliers: lodges, camps, hotels, airlines, ground operators, transfer companies, guides, activity providers and insurers, to the extent necessary to make and fulfil your booking. Many of these suppliers are located outside South Africa — see section 9.
  • With Service Providers and Operators: including our website host, email and CRM platforms, AI chat platform and model providers, analytics providers, payment processors and marketing platforms, to operate, monitor and analyse our Service and to contact you.
  • With affiliates: we may share your information with our affiliates, in which case we will require those affiliates to honour this Privacy Policy. Affiliates include our parent company and any subsidiaries, joint venture partners or other companies that we control or that are under common control with us.
  • With business partners: we may share your information with our business partners to offer you certain products, services or promotions.
  • For business transfers: we may share or transfer your personal information in connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or a portion of our business to another company. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.
  • With other users: when you share personal information or otherwise interact in public areas of the Service, such as by leaving a comment, that information may be viewed and publicly distributed by others.
  • With your consent: we may disclose your personal information for any other purpose with your consent.

Outsourcing the processing of personal information to an Operator does not release us from our obligations under POPIA. We remain accountable for your information.

Law enforcement and other legal requirements

Under certain circumstances we may be required to disclose your personal information if required to do so by law or in response to valid requests by public authorities, such as a court or a government agency. We may also disclose your personal information in the good faith belief that such action is necessary to comply with a legal obligation; protect and defend our rights or property; prevent or investigate possible wrongdoing in connection with the Service; protect the personal safety of users of the Service or of the public; or protect against legal liability.

9. Transfer of your information across borders

We operate safaris and tours across Africa and we use cloud-based systems. Your information, including personal information, is processed at our operating offices and in any other place where the parties involved in the processing are located. This means your information may be transferred to, and maintained on, computers and premises located outside of your province, country or other governmental jurisdiction, where data protection laws may differ from those in your jurisdiction.

In particular, your information may be transferred to:

  • lodges, camps, ground operators and airlines in the countries you are travelling to, including South Africa, Namibia, Botswana, Zimbabwe, Zambia, Tanzania, Kenya, Uganda, Rwanda, Angola and elsewhere;
  • cloud and software providers whose servers are located outside South Africa, including in the European Union, the United Kingdom and the United States;
  • our AI chat platform and AI model providers, as described in section 7.

In line with section 72 of POPIA, we will not transfer your personal information to a recipient in a foreign country unless that recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection, or you have consented to the transfer, or the transfer is necessary for the performance of a contract with you or in your interests. Your consent to this Privacy Policy, followed by your submission of information, represents your agreement to those transfers. We take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

10. How long we keep your information

We retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your personal information to the extent necessary to comply with our legal obligations (for example, tax and consumer protection record-keeping), to resolve disputes, and to enforce our legal agreements and policies.

Where the purpose for which information was collected has been achieved and no exception applies, the records are destroyed or deleted within 12 months, in a manner that renders them unidentifiable and incapable of reconstruction.

We also retain Usage Data for internal analysis. Usage Data is generally retained for a shorter period, except where it is used to strengthen the security or improve the functionality of our Service, or where we are legally obliged to retain it for longer.

Where a relationship or transaction continues for longer than 12 months, we may contact you to confirm that the information we hold about you is still accurate and complete.

11. Security of your information

The security of your personal information is important to us. We apply appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, and unlawful access or processing. These measures include identifying reasonably foreseeable internal and external risks, establishing and maintaining safeguards against those risks, regularly verifying that the safeguards are effectively implemented, and updating them in response to new risks. Our internal security protocols and password policy are audited annually.

All our employees receive compulsory training on our data protection obligations, and failure to comply with our internal policy may result in disciplinary action.

Please remember, however, that no method of transmission over the internet or method of electronic storage is completely secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

If a data breach occurs, we follow our internal Data Breach Plan and will notify the Information Regulator and affected data subjects as required by section 22 of POPIA.

12. Your rights

Under POPIA, you have the right to:

  • be notified that we are collecting your personal information, and that it has been accessed or acquired by an unauthorised person;
  • request confirmation, free of charge, of whether we hold personal information about you, and to request a description of that information and of the third parties who have had access to it;
  • request the correction, updating or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully;
  • object, on reasonable grounds, to the processing of your personal information;
  • object to your personal information being used for direct marketing by unsolicited electronic communication;
  • withdraw your consent where processing is based on consent;
  • submit a complaint to the Information Regulator;
  • institute civil proceedings regarding an alleged interference with the protection of your personal information.

You may update, amend or delete your information at any time by signing in to your account, if you have one, and visiting the account settings section, or by contacting us using the details in section 16. The formal procedure for requesting access to or correction of your information is set out in our PAIA Manual, available at www.africantravelconcept.com [INSERT DIRECT LINK].

Please note that we may need to retain certain information where we have a legal obligation or lawful basis to do so.

13. Direct marketing

We will only send you electronic direct marketing where you have consented to receive it, or where you are an existing customer and the marketing relates to similar products and services to those you have already purchased or enquired about. Every marketing email includes an unsubscribe link, and you may opt out at any time by clicking it or by contacting us. Opting out of marketing will not stop us sending you operational messages about a booking you have made.

14. Children’s privacy

Our Service is directed at adults and we do not knowingly collect personal information directly from children. Under POPIA, a child is a person under the age of 18, and the processing of a child’s personal information is prohibited unless a competent person, such as a parent or legal guardian, has consented, or another statutory exception applies.

Where a booking includes travelling children, we collect their information from the parent or guardian making the booking, and only to the extent necessary to arrange the travel. If you are a parent or guardian and you become aware that your child has provided us with personal information directly, please contact us and we will take steps to remove that information from our systems.

15. Website comments, media and embedded content

Comments

When visitors leave comments on the site, we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string, to help with spam detection. Visitor comments may be checked through an automated spam detection service. An anonymised string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it; the Gravatar service privacy policy is available at https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment. Comments and their metadata are retained so that we can recognise and approve follow-up comments automatically.

Media

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Accounts

If you leave a comment, you may opt in to saving your name, email address and website in cookies, so that you do not have to fill in your details again next time. These cookies last for one year. If you visit our login page, we set a temporary cookie to determine whether your browser accepts cookies; it contains no personal data and is discarded when you close your browser. When you log in, we set several cookies to save your login information and screen display choices. Login cookies last for two days and screen options cookies for a year. If you select “Remember Me”, your login persists for two weeks. Logging out removes the login cookies. If you edit or publish an article, an additional cookie is saved in your browser; it includes no personal data, simply indicates the post ID of the article you edited, and expires after one day.

For users who register on our website, we also store the personal information they provide in their user profile. All users can see, edit or delete their personal information at any time, except that they cannot change their username. Website administrators can also see and edit that information. If you request a password reset, your IP address will be included in the reset email.

Embedded content from other websites

Articles on this site may include embedded content such as videos, images and articles. Embedded content from other websites behaves in exactly the same way as if you had visited the other website. These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including if you have an account and are logged in to that website.

Links to other websites

Our Service may contain links to other websites that are not operated by us. If you click a third-party link you will be directed to that third party’s site. We strongly advise you to review the privacy policy of every site you visit. We have no control over, and assume no responsibility for, the content, privacy policies or practices of any third-party sites or services.

16. Contact us

If you have any questions about this Privacy Policy, wish to exercise any of your rights, or wish to lodge a complaint about how we handle your personal information, you can contact us:

By email: info@africantravelconcept.com
By telephone: +27-21-426 0032
By post: P.O. Box 15974, Vlaeberg, 8018, SOUTH AFRICA
Attention: The Information Officer

The Information Regulator

You also have the right to lodge a complaint with the Information Regulator of South Africa:

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
General enquiries: enquiries@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
Website: https://inforegulator.org.za

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date at the top. Where the change is material, we will let you know by email and/or a prominent notice on our Service before the change becomes effective. You are advised to review this Privacy Policy periodically. Changes are effective when they are posted on this page.