Last updated: 02/10/2026
Grid Escapes is the trading name of [full legal name], registered in [jurisdiction] under [registration number], with its business address at [address]. In this policy, “we”, “us” and “our” mean that business.
We are responsible for the personal information we collect and use to handle your enquiries and provide our planning services. Contact us at [privacy email] or [postal address]. [Insert any required data protection officer or local representative contact details.]
When you complete our enquiry form, we collect the details you submit. These may include your name, email address, phone number, country of residence, destinations, travel dates, budget, group size, traveller ages, interests and any message or preferences you share. Required fields are identified on the form.
When you contact us on WhatsApp, we receive your phone number, the profile information visible to us, your messages, attachments and information about the conversation. We use this information to respond and manage your enquiry or trip. You can contact us by email instead.
If you proceed with a booking, we may need passport names, dates of birth, nationality, passport details, emergency contacts, loyalty details and relevant travel requirements. We also retain booking confirmations, invoices and payment status records. Please use the secure payment or document collection method we provide, rather than sending card details or passport copies through our enquiry form or WhatsApp.
We may receive information from the lead traveller, your authorised representative, Fora, travel suppliers and payment providers. If you provide another person’s details, tell them about this policy and ensure you have authority to share the information. A parent, guardian or appropriately authorised adult must provide children’s details.
We use your information to arrange your introductory call, understand your requirements, prepare proposals, provide planning services, arrange authorised bookings, communicate trip updates, handle payments and resolve enquiries or complaints.
Where UK or Kenyan law applies, we rely on steps requested before entering a contract and performance of our agreement for these activities, legal obligations for required records, and legitimate interests for proportionate security, service administration and protecting legal claims, where permitted and balanced against your rights. For fellow travellers who are not parties to our contract, we use an appropriate lawful basis, such as legitimate interests in arranging the requested trip, where permitted.
Where UAE federal law applies, we rely on consent unless an applicable statutory exception permits the processing, such as processing necessary for a contract or legal obligation. We do not treat UK legitimate interests as a universal legal basis.
Health, accessibility and some dietary or religious requirements may reveal sensitive information. We request only what is needed to arrange suitable services and, where required, obtain your explicit consent before collecting or sharing it. You may withdraw consent, although this may affect our ability to arrange a particular service. Simply submitting a general enquiry is not explicit consent to process sensitive information.
We send promotional emails or WhatsApp messages only where legally permitted and you have separately opted in. You can unsubscribe by email or reply STOP to a marketing message. This does not stop essential communications about an active enquiry or booking. We do not sell your personal information.
We share relevant information with the travel providers involved in your requested arrangements, such as hotels, airlines, tour operators and transfer providers. Where your enquiry or booking is handled through Fora, we share the information needed with Fora Travel, Inc.
Fora and travel suppliers may act as separate controllers and use information under their own privacy notices. Our technology providers help us operate the website, forms, email, customer records, communications and payments. Our current providers are [insert confirmed providers and functions, including the WhatsApp service provider or integration, if used]. We may also disclose information to professional advisers, insurers, regulators or authorities where necessary and lawful.
WhatsApp processes information under the privacy terms applicable to your location. Deleting your conversation from your own device does not delete records we retain, or records held independently by WhatsApp, Fora or suppliers.
Travel arrangements may require information to be processed in Kenya, the United States, your destination countries and other confirmed hosting or service locations. These countries may have different data protection rules.
For transfers subject to UK GDPR restrictions, we use [insert the verified adequacy decision or transfer safeguards, such as the UK IDTA or UK Addendum, and applicable assessment]. For Kenyan and UAE transfers, we use [insert the documented mechanism meeting the applicable local requirements]. Any exceptional transfer basis will be used only where its legal conditions are met. Contact [privacy email] for information about the safeguards or an available copy.
[Proposed schedule: confirm and remove this note before publication.] Unconverted enquiries and related WhatsApp conversations: up to 12 months after our last meaningful contact. Core planning contracts, booking records, invoices and correspondence needed for accounting or claims: up to six years after the trip ends or the service closes.
Passport copies and sensitive assistance information: delete within 90 days after travel unless a specific legal requirement or unresolved matter justifies keeping the relevant information longer. Marketing records: until you withdraw consent or after 24 months without meaningful engagement, whichever comes first. We retain a minimal suppression record as needed to respect your opt-out.
Necessary evidence may be retained longer for a legal obligation, complaint or claim, and deleted when that reason ends. Deleted information is removed from backups through our [confirmed backup expiry period] cycle and is not restored for routine use. Fora and suppliers determine their own retention periods.
Depending on the law that applies and the circumstances, you may request access to your information, correction, deletion, restriction of processing or a portable copy. You may withdraw consent at any time without affecting the lawfulness of earlier processing. Where relevant, you may challenge decisions made solely by automated processing.
You have the right to object to direct marketing at any time. Where we rely on legitimate interests, you may also object to that processing on grounds relating to your circumstances.
Email [privacy email] with the subject “Personal data request”, or contact our business WhatsApp at [number]. Tell us which contact details or booking reference you used and what you would like us to do. We may ask for proportionate identity verification. Please do not send identity documents unless requested through a secure method.
We respond within the deadline required by the applicable law. If we cannot delete particular records because they are needed for a legal obligation or claim, we will explain what remains, why and for how long. We will address relevant processor and recipient records as required by law; independent controllers may need to handle their own requests.
You can complain directly to the relevant supervisory authority without first contacting us. In Kenya, contact the Office of the Data Protection Commissioner at odpc.go.ke. In the UK, contact the Information Commissioner’s Office at ico.org.uk. Where UAE law applies, you may use the relevant UAE Data Office or applicable free-zone authority complaint procedure. Contact us for assistance identifying the appropriate authority.
Our website and form services may collect IP addresses, browser and device details, access times and technical logs to deliver and secure the service. [Insert the confirmed analytics, advertising and embedded-service tools, or state that none are used.]
Where consent is required, optional tracking will run only after you choose to allow it. You can change that choice through [cookie settings link]. The cookie notice identifies the tools used, their purposes, providers and durations. Declining optional tracking does not prevent you from contacting us.
We use [confirm implemented access controls, multi-factor authentication, protected storage and secure transfer methods] to limit access to people who need the information for their work. No system is completely risk-free, but we take reasonable measures appropriate to the information we handle.
We may use AI-assisted tools for destination research and drafting, with human review. We do not put identifiable client information into those tools. We do not make decisions with legal or similarly significant effects on you solely through automated processing. If our practices change, we will explain the relevant processing and legal basis before introducing it.
We update this policy when our services or data practices change. The date above identifies the current version. We will provide additional notice or seek fresh consent where required.
Share your ideas and we'll design a journey around you.
Bespoke journeys, thoughtfully planned for discerning travellers. Your world. Your way. Your escape.
Bookings made through Fora Travel
Copyright © 2026 Grid Escapes | All Rights Reserved.
Designed in East Africa by Ivory Circuit Design.
