This policy explains what personal data Tulia Vacations Ltd collects, why we collect it, how we use it and what rights you have over it. It is written to align with the Kenyan Data Protection Act, 2019.
Who we are
Tulia Vacations Ltd is a travel management and tour operations company registered in Kenya. For the purposes of the Data Protection Act, 2019, we are the data controller for the personal data described here.
[Confirm whether Tulia Vacations Ltd is registered with the Office of the Data Protection Commissioner, and add the registration number if so.]
What we collect
We collect only what we need in order to plan, book and support your travel:
- Identity and contact details: name, email address, telephone number, country of residence
- Travel details: destinations, dates, party composition, accommodation preferences and budget guidance you give us
- Booking data: passport details, dates of birth and nationality where an airline, hotel or immigration authority requires them
- Sensitive details you choose to share, such as dietary requirements, mobility needs or medical information relevant to your safety on a trip
- Payment records, though card details are handled by our payment provider and are not stored by us
- Technical data: IP address, browser type and pages visited, collected through analytics
Why we use it
We process your data to respond to enquiries, prepare itineraries, make bookings with airlines, hotels and ground operators, support you during travel, meet legal and tax obligations, and where you have opted in, send occasional travel offers.
Our lawful bases are the performance of a contract with you, compliance with legal obligations, your consent for marketing and for any sensitive data, and our legitimate interest in operating and improving the business.
Who we share it with
Travel cannot be arranged without sharing some data. We disclose only what is necessary, and only to airlines, hotels, lodges, ground handlers, insurers, visa processing services, payment processors and, where required by law, government authorities.
We do not sell your personal data, and we do not share it with third parties for their own marketing.
International transfers
Booking travel outside Kenya necessarily transfers data to suppliers in the destination country. Where we transfer personal data outside Kenya, we do so on the basis that it is necessary to perform our contract with you, as permitted under the Data Protection Act, 2019.
How long we keep it
Enquiries that do not become bookings are kept for [24 months] and then deleted. Booking records are kept for [7 years] to meet tax and accounting requirements. Marketing consent is kept until you withdraw it.
Your rights
Under the Data Protection Act, 2019 you may request access to your data, ask us to correct or delete it, object to or restrict how we process it, withdraw consent at any time, and request a copy in a portable format.
To exercise any of these, email us. We will respond within the statutory period. If you are not satisfied, you may complain to the Office of the Data Protection Commissioner.
Cookies
The site uses cookies that are necessary for it to function, and analytics cookies that help us understand how it is used. [Confirm the exact analytics and marketing tools in use, and add a consent banner before launch if any non essential cookies are set.]
Security
We apply reasonable technical and organisational measures to protect your data, including restricted access and encrypted transmission. No system is perfectly secure, and we will notify you and the Data Protection Commissioner of a breach where the law requires it.
Contact
Questions about this document should go to bookings@tuliavacations.co.ke or +254 796 463 884.
Tulia Vacations Ltd, [registered office address], Kenya. Company registration number [to be supplied].