How we collect, use, store, and protect your personal data in compliance with Kenya Data Protection Act, 2019. Your privacy is our priority.
This Privacy Policy explains how Trails & Tales Kenya ("we", "our", "us") collects, uses, stores, and protects your personal information when you use our travel booking services, including bus and shuttle bookings, accommodations, tours, and account services.
We operate in full compliance with the Kenya Data Protection Act, 2019 and other relevant data protection laws. Our practices are designed to protect your privacy while providing you with excellent service.
We are committed to protecting your personal data and being transparent about how we collect and use it. This policy applies to all services offered through our website, mobile applications, and offline channels.
We collect different types of data depending on how you interact with our platform:
Your data is used to provide and improve our services. We process your information based on legitimate business interests, contractual necessity, and legal obligations.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Booking Processing | Personal details, travel info, payment data | Contractual Necessity |
| Service Communication | Email, phone number, booking details | Legitimate Interest |
| Customer Support | All relevant booking and personal data | Legitimate Interest |
| Service Improvement | Usage analytics, feedback, device info | Legitimate Interest |
| Marketing Communications | Email, preferences, usage patterns | Consent (opt-in) |
| Legal Compliance | Required identification and transaction data | Legal Obligation |
We may send promotional messages about special offers, new services, or travel tips. You can opt-out of marketing communications at any time by clicking "unsubscribe" in our emails or adjusting your account preferences.
We do not sell, rent, or trade your personal data to third parties for marketing purposes. Your privacy is protected.
We may share your data only with the following entities, strictly on a need-to-know basis:
Bus companies, shuttle operators, hotels, and tour companies require your information to provide the booked services. They are contractually obligated to protect your data and use it only for service delivery.
Secure payment processors such as M-Pesa, bank gateways, or card processors require transaction data to process payments. We use PCI-compliant payment gateways.
When legally required, we may share data with government authorities, law enforcement, or regulatory agencies in accordance with Kenyan law.
Trusted third-party providers for analytics, SMS delivery, email notifications, customer support, and system maintenance. All providers sign strict data protection agreements.
In rare cases where service providers are located outside Kenya, we ensure they provide adequate data protection measures equivalent to Kenyan data protection standards.
Under the Kenya Data Protection Act, 2019, you have the following rights regarding your personal data:
Request a copy of all personal data we hold about you, including how we use it.
Request correction of inaccurate or incomplete personal information.
Request deletion of your personal data when it's no longer necessary or if you withdraw consent.
Object to certain types of processing, including direct marketing.
Request restriction of processing while accuracy or lawful basis is verified.
Receive your data in a structured, commonly used format for transfer to another service.
To make a request regarding any of these rights, contact our Data Protection Officer using the contact information below. We will respond within 30 days and may request verification of your identity for security purposes.
We implement comprehensive technical and organizational security measures to protect your data from unauthorized access, alteration, disclosure, or destruction.
While we implement industry-standard security measures, no system is 100% secure. Users should exercise caution when sharing sensitive information online and use strong, unique passwords for their accounts.
We use cookies and similar tracking technologies to enhance your experience, analyze usage, and personalize content.
You can modify cookie settings through your browser at any time. Most browsers allow you to:
Note that disabling essential cookies may affect the functionality of our platform.
We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law.
When data is no longer needed, we securely delete or anonymize it. Anonymized data may be retained indefinitely for statistical purposes.
Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children without verifiable parental or guardian consent.
If you believe that we have collected personal data from a child without appropriate consent, please contact us immediately. We will promptly investigate and, if confirmed, delete such information from our records.
When adults make bookings for children (such as family travel), they are responsible for providing accurate information and ensuring compliance with this policy.
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements.
Previous versions of this Privacy Policy are archived and available upon request. Contact us if you need access to a previous version.
You can request access to your personal data by contacting our Data Protection Officer. We'll provide a copy of your data within 30 days. You can also view much of your data through your account dashboard.
Yes, you have the right to request deletion of your account and personal data. Contact our support team to initiate this process. Note that we may retain some data for legal or legitimate business purposes as permitted by law.
No, we do not sell or share your personal data with third parties for their marketing purposes. We only share data with service providers necessary for delivering our services, and they are contractually prohibited from using your data for marketing.
We use PCI-DSS compliant payment processors and never store full credit card details on our servers. All payment transactions are encrypted using SSL/TLS technology, and we implement additional security measures like tokenization for added protection.
If you suspect unauthorized access to your account or believe your data may have been compromised, contact us immediately at security@ttkenya.co.ke. We have incident response procedures and will investigate promptly, taking appropriate action if needed.
For questions, requests, or complaints about your privacy:
Trails & Tales Kenya
Data Protection Officer
Kisumu, Kenya
+254 753 797 488
Available Monday to Friday, 8:00 AM - 6:00 PM EAT
General Inquiries: info@ttkenya.co.ke
Data Protection: dpo@ttkenya.co.ke
Security Concerns: security@ttkenya.co.ke
ttkenya.co.ke
Visit our website for more information about our services
If you're not satisfied with how we handle your privacy concerns, you have the right to lodge a complaint with the Office of the Data Protection Commissioner in Kenya.
Save a copy for your records