This policy explains how KARAI processes your personal data when you visit karai.org, contact us, apply for or travel on one of our expeditions, or subscribe to our newsletter. It is written in accordance with the EU General Data Protection Regulation 2016/679 (“GDPR”) and the Belgian Data Protection Act of 30 July 2018.
1. Who is responsible for your data
The data controller is KARAI SRL, a Belgian private limited company, registered office Avenue Jupiter 81, 1190 Forest, Belgium, company and VAT number BE 1011.580.930.
For any question about your data or to exercise your rights, write to us at hello@karai.org. As a small company, we have not appointed a Data Protection Officer; the two directors of KARAI handle privacy requests personally.
2. What data we collect, why, and on which legal basis
Enquiries and expedition applications
- Data: name, email address, phone number, country of residence, photography experience, and any information you choose to share in our application form or by email.
- Purpose: answering your questions, assessing your application and building a balanced group.
- Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
- Retention: 2 years after our last exchange if you do not book.
Bookings and the organisation of your expedition
- Data: identity details, date of birth, nationality, passport details, postal address, emergency contact, flight details, travel insurance details, dietary preferences and payment information.
- Purpose: performing our contract with you: booking accommodation, domestic flights, permits and visas, arranging transport, and keeping you safe during the trip.
- Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with our legal obligations, notably accounting and tax law (Art. 6(1)(c) GDPR).
- Retention: passport copies and travel documents are deleted within 3 months after your return. Invoices and accounting records are kept for 10 years, as required by Belgian tax and VAT law. Other booking data is kept for 3 years after the expedition, to handle any claim and to welcome you back.
Health information
- Data: allergies, medical conditions, medication or fitness information that you choose to share with us so that we can travel safely.
- Purpose: adapting the expedition to your needs and reacting appropriately in an emergency.
- Legal basis: your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time, and, in an emergency, the protection of your vital interests (Art. 9(2)(c) GDPR).
- Retention: deleted within 3 months after your return. Only the expedition leader and, where strictly necessary, local medical or rescue services have access to it.
Newsletter
- Data: email address and, if you give it, your name.
- Purpose: sending you a few letters a year about new expeditions, field notes and photo stories.
- Legal basis: your consent (Art. 6(1)(a) GDPR).
- Retention: until you unsubscribe, which you can do in one click at the bottom of every letter.
Photos and videos taken during expeditions
Group photos and videos may be taken during our expeditions. We will always ask for your agreement before publishing an image in which you can be identified, on our website, social media or elsewhere, and you can ask us to remove it at any time (Art. 6(1)(a) GDPR).
General correspondence
When you write to us, we keep our exchanges for up to 3 years to follow up on your request and keep track of our relationship with partners and clients (legitimate interest, Art. 6(1)(f) GDPR).
3. Cookies and third-party content on our website
Our website does not use advertising cookies, and it currently uses no audience measurement tools. The only information stored in your browser is your cookie choice, so that we do not ask you again on every page. If we add privacy-friendly statistics in the future, they will only run if you click “Accept”.
Some features of the site rely on external services, which receive your IP address when they load:
- Google Fonts (Google Ireland Ltd) to display our typography.
- Google Sheets (Google Ireland Ltd) to show the number of places left on each expedition.
- Tally (Tally BV, Belgium) for our application forms.
- Substack (Substack Inc., United States) for newsletter sign-up, inside a window that only opens when you click “Subscribe”.
- YouTube and Vimeo, whose players only load when you click play on a film. These services may then set their own cookies.
Links to Instagram or Google Maps only send data to these services if you click on them. Their own privacy policies then apply.
4. Who we share your data with
We never sell or rent your personal data. We only share it when necessary, and only what is necessary, with:
- our local partners for the expedition you booked: guides, drivers, translators, host families, hotels, domestic airlines and authorities issuing permits or visas;
- service providers who help us run KARAI: form, newsletter, email and file storage providers, our bank and payment providers, and our accountant, all bound by confidentiality;
- insurers, medical or rescue services in the event of an incident;
- public authorities, when required by law.
5. Transfers outside the European Union
Our expeditions take place outside the European Union. To organise your trip, we have to transfer some of your data to partners in the destination country (for example Mongolia, Madagascar, India or Mauritania). These transfers are necessary for the performance of your contract (Art. 49(1)(b) GDPR) and are limited to what the trip requires.
Some of our service providers are based in the United States. In that case, transfers rely on the EU-US Data Privacy Framework or on the Standard Contractual Clauses approved by the European Commission.
6. How we protect your data
Your data is stored with reputable providers, protected by passwords and two-factor authentication where available, and only accessible to the people at KARAI who need it. We share travel documents with partners through secure channels and delete them once the expedition is over.
7. Your rights
Under the GDPR, you have the right to:
- access the personal data we hold about you and receive a copy of it;
- have inaccurate data corrected;
- have your data erased, unless we must keep it by law;
- restrict or object to certain processing, including at any time to direct marketing;
- receive your data in a structured, commonly used format (data portability);
- withdraw your consent at any time, without affecting what was done before.
To exercise these rights, simply write to hello@karai.org. We will answer within one month, free of charge. We may ask you to confirm your identity first.
If you believe we have not handled your data properly, you can lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données), Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, dataprotectionauthority.be, or with the authority of the EU country where you live. We would be grateful if you contacted us first, so that we can try to sort it out together.
8. Minors
Our expeditions are open to adults. Travellers under 18 may only join with the written consent of a parent or legal guardian, who then provides their data to us.
9. Changes to this policy
We may update this policy when our services or the law change. The date of the latest version is shown below. For significant changes, we will inform travellers with an upcoming booking by email.
Last update: October 2026