Helicopter Charter East Africa (“HCEA”, “we”, “us”, “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you interact with us, in accordance with Kenya’s Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021 (together, the “Data Protection Laws”).

Data controller: Helicopter Charter East Africa
Address: Mbaruk Airfield (HKBD), Soysambu Estate, Nakuru, P.O. Box 2226, 20100
Email: toby@hcea.co.ke
Telephone: +254 722 220100

If we appoint a Data Protection Officer (DPO), we will publish their contact details here.

1) The personal data we collect

We may collect and process the following categories:

• Identity & contact data (e.g., name, company, email, phone, address).

• Business & transaction data (e.g., inquiries and correspondence about helicopter sales/services, contract details, invoices).

• Marketing & communications data (e.g., your preferences and consents, responses to campaigns).

• Technical & usage data from our website (e.g., IP address, device/browser type, pages viewed) and online identifiers (e.g., cookies, pixels, advertising IDs) used for analytics and retargeting.

We collect data directly from you (forms, calls, emails, events) and automatically via our website and advertising tools.

2) How and why we use your data (lawful bases)

We process personal data only for lawful, specific, and explicit purposes, and we limit processing to what is necessary.

• To respond to enquiries and provide quotations / enter into or perform a contract with you (performance of a contract or steps prior to entering one).

• To manage our relationship (e.g., customer support, records, billing) (contract; legal obligation; legitimate interests).

• To send you direct marketing about our helicopters and services, including by phone, email, SMS, and through retargeting ads on third-party platforms (your consent and/or our legitimate interests, with a clear and free opt-out at any time). Kenya’s Regulations set specific conditions for direct marketing and require an easy, no-cost opt-out in each message. odpc.go.ke

• To run analytics and improve our site/services (legitimate interests).

• To comply with legal obligations (e.g., tax, accounting) and to establish or defend legal claims (legal obligation; legitimate interests).

Where we rely on consent, we will keep records and you may withdraw consent at any time without detriment.

We do not sell your personal data to advertising agencies or other third parties.

3) Direct marketing & retargeting

We may use your email/phone to send updates or offers and may use cookies/pixels to show you HCEA ads on other websites or platforms (e.g., Meta/Google). Under Kenya’s Regulations, direct marketing is permitted if we collected your data, told you marketing is a purpose, obtained consent (as applicable), and always provide a simple, free opt-out (e.g., “unsubscribe” link, reply “STOP”, or verbal opt-out on calls). We must also clearly identify ourselves in each message.

How to opt out:

• Emails/SMS: use the unsubscribe/STOP instructions in the message.

• Calls: tell us you wish to opt out during the call.

• Retargeting: adjust your browser/ad settings and use our Cookie Settings (see section 6).

Profiling children for direct marketing is prohibited; we do not knowingly market to children. odpc.go.ke

4) Your rights

Under the Data Protection Laws, you have rights to: be informed; access your data; rectify inaccuracies; erase data (in certain cases); restrict or object to processing (including objection to direct marketing); data portability; and to withdraw consent at any time. You may also object to decisions based solely on automated processing that significantly affect you.

To exercise these rights, contact toby@hcea.co.ke or call +254 722 220100. We may request information to verify your identity and will respond within the statutory timelines.

You also have the right to lodge a complaint with Kenya’s Office of the Data Protection Commissioner (ODPC). See ODPC’s complaint portal for details.

5) Sharing your data

We may share personal data with:

• Service providers/Processors under contract (e.g., website hosting, CRM, analytics, email/SMS delivery, advertising platforms) who must follow our instructions and protect your data.

• Professional advisers (e.g., auditors, lawyers) and authorities where required by law.

• Prospective buyers/partners in the context of a business transaction, with appropriate safeguards.

We do not sell or rent personal data.

6) Cookies, analytics & advertising technologies

We use cookies and similar technologies to operate our site, measure performance, and run retargeting. You can:

• Manage cookies in your browser;

• Use our Cookie Settings tool (link to be placed on your site footer);

• Opt out of platform advertising in your account settings on those platforms.

Where consent is required for non-essential cookies or direct marketing, we will obtain it before setting those technologies or sending marketing.

7) International (cross-border) transfers

Some providers and advertising/analytics platforms may process data outside Kenya. We will only transfer personal data outside Kenya where appropriate safeguards are in place (e.g., contractual protections, binding corporate rules, or ODPC adequacy/approval as applicable) or where you have given explicit consent, consistent with the Act and the Regulations.

8) Data retention

We keep personal data only as long as necessary for the purposes collected (e.g., handling your enquiry, negotiating/performing a sale, complying with legal/accounting duties), after which we erase, anonymise, or pseudonymise it according to our retention schedule and periodic reviews required by the Regulations.

9) Security

We use administrative, technical, and physical safeguards appropriate to the risks (e.g., access controls, encryption in transit where applicable, staff confidentiality, processor due diligence). While no system is perfectly secure, we continuously improve our controls.

10) Children’s data

We do not knowingly collect personal data relating to children (under 18). If we discover such data has been collected without the required parent/guardian consent, we will delete it.

11) Automated decision-making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you. If this changes, we will notify you and explain your rights.

12) Third-party websites

Our site may link to third-party websites or platforms. Their privacy practices are governed by their own policies.

13) Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be highlighted on our website with a new effective date.

14) Contact us

Questions or requests about this Policy or your personal data:
Email: toby@hcea.co.ke | Tel: +254 722 220100
Postal: P.O. Box 2226, 20100, Nakuru
Location: Mbaruk Airfield (HKBD), Soysambu Estate, Nakuru