EU / EEA GDPR Privacy Policy
Last Updated: 14 August 2026
Important Notice
This EU/EEA section applies where the General Data Protection Regulation (GDPR) applies to Chikopokopo’s processing activities.
Chikopokopo is based in Zimbabwe and is not represented as an EU-established company by this policy.
However, GDPR Article 3 can apply to a non-EU organisation where its processing relates to offering goods or services to people who are in the EU or monitoring their behaviour in the EU.
Quick EU Privacy Summary
If GDPR applies to your personal information:
- You have rights over your personal information.
- We explain why we collect your information.
- We identify the relevant legal basis where applicable.
- You can request access to your information.
- You can request correction.
- You can request deletion in applicable circumstances.
- You can request restriction of processing.
- You may object to certain processing, including direct marketing.
- You may have data-portability rights.
- You may withdraw consent where processing is based on consent.
- You may complain to an EU/EEA supervisory authority.
- We will address valid rights requests within the GDPR timeframes.
Overview
Chikopokopo recognises that international visitors may travel to Victoria Falls from the European Union and European Economic Area.
Where GDPR applies, Chikopokopo will process personal data in accordance with the applicable GDPR requirements.
The European Commission confirms that GDPR rights include access, rectification, erasure, restriction, portability and objection, subject to the circumstances and limitations set out in the Regulation.
1. Data Controller
For personal data processed through Chikopokopo’s website and booking enquiries, the relevant controller is:
Chikopokopo Helicopters
Masuwe Helipad
Victoria Falls, Zimbabwe
Email: lloydm@chikopokopo.com
Phone: +263 773 551 683
No separate Data Protection Officer is identified in the information supplied to us. Chikopokopo should appoint one if it becomes legally required to do so.
2. Personal Data We Process
Depending on the service requested, this may include:
- name;
- surname;
- telephone number;
- email address;
- booking information;
- passenger information;
- correspondence;
- payment-related information;
- information necessary to administer the flight.
The website’s current booking form specifically requests name, surname, phone number and email address.
3. GDPR Legal Bases
Where GDPR applies, Chikopokopo may rely on:
Contract: where processing is necessary to arrange or perform a booking.
Pre-contractual steps: where information is requested in response to an enquiry or requested booking.
Legal obligation: where information must be retained or disclosed to comply with applicable law.
Vital interests: where necessary to protect a person’s life or physical safety.
Legitimate interests: where processing is necessary for legitimate business purposes and those interests are not overridden by the individual’s rights.
Consent: where consent is the appropriate legal basis, including certain marketing or optional cookies.
4. GDPR Rights
Where applicable, you may exercise the following rights:
Right of access
You may request confirmation of whether we process your personal data and request a copy of that data.
Right to rectification
You may request correction of inaccurate or incomplete personal data.
Right to erasure
You may request deletion of personal data where the GDPR permits this.
Right to restriction
You may request that processing be restricted in circumstances provided for by the GDPR.
Right to data portability
Where the legal requirements are met, you may request your personal data in a structured, commonly used and machine-readable format.
Right to object
You may object to certain processing, including direct marketing.
Right to withdraw consent
Where processing is based on consent, you may withdraw that consent at any time.
These rights and their limitations are recognised under GDPR.
5. Making a GDPR Request
Requests should be sent to:
l[email protected]
Please include enough information to allow us to identify your records and verify your identity where reasonably necessary.
The European Commission states that organisations should generally respond to GDPR rights requests within one month, subject to the GDPR’s provisions concerning extensions and exceptions.
6. International Data Transfers
Because Chikopokopo operates in Zimbabwe, personal information relating to EU/EEA visitors may be transferred or processed outside the EU/EEA.
Where GDPR applies, such transfers must be handled using an applicable transfer mechanism under the GDPR.
This obligation operates alongside Zimbabwe’s own restrictions on transfers of personal information outside Zimbabwe.
7. Supervisory Authority
If you are located in the EU/EEA and believe your GDPR rights have been infringed, you may lodge a complaint with the data-protection supervisory authority in the relevant EU/EEA jurisdiction.
The European Commission confirms that individuals may contact their national Data Protection Authority regarding GDPR complaints.
8. No Automated Decision-Making
Chikopokopo does not intend to make decisions producing legal or similarly significant effects solely through automated processing based on information submitted through the website.