Privacy Policy

Sambora — Legal

Last updated: July 2026

At a glance

We collect the information needed to plan and deliver your stay or journey — your contact details, travel preferences, booking information, and, where required for permits, passport details. We never sell your information.

We share it only with the partners essential to your trip — our booking and payment providers, the Rwanda Development Board for permits, and the suppliers delivering your itinerary. You may ask us at any time what we hold about you, correct it, or ask us to delete it.

Who we are

This policy covers Sambora Kinigi (Sambora Ltd – 121039316 – Rwanda – samborakinigi.com), a lodge at the edge of Volcanoes National Park, and Sambora Private Journeys (Sambora Private Journeys Ltd – 122286985 – Rwanda – samboraprivatejourneys or samborajourneys.com), our bespoke travel planning service, and Sambora Holdings Ltd (sambora.com) together referred to as “Sambora”, “we”, or “us”. It applies to information collected through our websites, our enquiry and booking channels, and in the course of planning and delivering your stay or journey. Our registered address in Rwanda is Sambora House, KG19 Avenue, Kibagabaga, Kigali, Rwanda.

The information we collect

Information you give us

Enquiry and contact details — your name, email address, phone number, country of residence, and the details of your planned travel when you complete an enquiry form, email us, or contact us by phone or WhatsApp.
Booking information — the details required to reserve your stay, including guest names, party composition, arrival and departure dates, and room preferences, processed through our reservation system.
Permit and identity information — where your itinerary includes gorilla trekking or other park permits, the Rwanda Development Board requires passport details (full name, nationality, passport number, date of birth) which we collect and submit on your behalf.
Preferences you choose to share — dietary requirements, accessibility needs, or health information relevant to your stay or trekking. Because this can include sensitive information, we collect it only where you volunteer it and use it solely to look after you.
Payment information — payments are processed by our payment providers. We receive confirmation of payment but do not store your card numbers on our systems.

Information collected automatically

Website usage — technical information such as your device type, browser, and the pages you visit, collected through cookies and similar technologies. Our Cookie Policy explains this in detail.

How we use your information

To respond to your enquiries and prepare proposals and quotations.
To make, manage, and fulfil your booking, including reserving accommodation, securing permits, and arranging the services in your itinerary.
To process payments and issue invoices and receipts.
To look after you during your stay, including catering to dietary, accessibility, and safety needs you have told us about.
To comply with our legal obligations, including immigration, tax, and park authority requirements in Rwanda.
To send you updates about Sambora where you have asked us to — you can opt out at any time.
To improve our website and services using aggregated, non-identifying usage information.

The legal grounds we rely on

We process personal information in accordance with Rwanda’s Law No. 058/2021 relating to the protection of personal data and privacy. Where guests contact us from the European Economic Area or the United Kingdom, we also have regard to the GDPR and UK GDPR.

Performance of a contract — most of our processing is necessary to plan and deliver the stay or journey you have asked us for.
Consent — for marketing communications, for sensitive information you volunteer (such as health or dietary details), and for non-essential cookies.
Legal obligation — where Rwandan law, park authorities, or tax rules require us to collect or retain information.
Legitimate interests — for the day-to-day administration of our business, provided your rights do not override those interests.

Who we share it with

We never sell your personal information. We share it only where necessary to deliver your trip or meet our legal obligations:

Our reservation system — bookings and availability are managed through ResRequest, whose systems process guest and booking details on our behalf.
Our enquiry management system — enquiries submitted through our website forms may be managed in HubSpot or within the website, which processes your contact details and enquiry information on our behalf.
Our website host — our websites are hosted by Kinsta, whose infrastructure processes technical data as you use the site.
Payment providers — payments are handled by our payment processors, who receive the information needed to complete your transaction. These are Stripe and DPO Pay.
The Rwanda Development Board — passport details are submitted to the RDB to secure gorilla trekking and other park permits.
Itinerary suppliers — for Sambora Private Journeys itineraries, we share the details necessary with the lodges, transfer providers, guides, and experience partners delivering your journey.
Professional advisers and authorities — where required by law or to protect our legal rights.

International transfers

Sambora operates from Rwanda and welcomes guests from around the world, so your information may be transferred to and processed in countries other than your own — including Rwanda and the countries where our service providers host their systems. Wherever your information travels, we require that it is protected to the standards described in this policy.

How long we keep it

We keep personal information for as long as needed to deliver your trip and for a reasonable period afterwards to handle any follow-up, meet legal and tax record-keeping requirements, and maintain our guest history where you remain in contact with us. When information is no longer needed, we delete it or anonymise it.

How we protect it

We take appropriate technical and organisational measures to protect your information — including access controls, encrypted connections to our website and booking systems, and limiting access to guest information to the team members who need it to look after you. No system is perfectly secure, but we work to protect your information as carefully as we look after you at the lodge.

Your rights

You may ask us at any time to:

Confirm what personal information we hold about you and receive a copy of it.
Correct information that is inaccurate or incomplete.
Delete your information, where we no longer have a lawful reason to keep it.
Object to or restrict certain processing.
Withdraw consent you have given — including unsubscribing from marketing at any time.

To exercise any of these rights, contact us using the details in section 12. If you are not satisfied with our response, you may complain to Rwanda’s data protection supervisory authority (the National Cyber Security Authority), or, if you are in the EEA or UK, to your local data protection authority.
10

Children

We collect information about children only as part of a family booking made by a parent or guardian — for example names, ages, and dietary needs — and only to the extent needed to deliver the stay safely. Our websites are not directed at children and we do not knowingly collect information from them directly.

Changes to this policy

We may update this policy from time to time as our services or legal obligations change. The date at the top of the page shows when it was last revised, and material changes will be highlighted on this page.
12

Contact us

For any question about this policy or your personal information, contact our reservations office:

Phone: +250 794 416 409
Email: reservations@samborakinigi.com

Contact hello@sambora.com for privacy matters. Sambora is undergoing registration and compliance with NCSA as a data controller — pursuant to Rwanda Law 058/2021.