Maisha Masha Safaris Maisha Masha Safaris ← Back to Home

Data Protection Policy

Last updated: 2026

1. Purpose

This Data Protection Policy describes how Maisha Masha Safaris collects, processes, stores and safeguards personal data in compliance with the Data Protection Act, 2019 of Kenya and its accompanying regulations.

2. Data protection principles

We are guided by the core principles of the Act. Personal data is:

  • Processed lawfully, fairly and in a transparent manner.
  • Collected for explicit, specified and legitimate purposes, and not further processed in a manner incompatible with those purposes.
  • Adequate, relevant and limited to what is necessary.
  • Accurate and, where necessary, kept up to date.
  • Kept in a form which permits identification for no longer than necessary.
  • Processed in a manner that ensures appropriate security.

3. Collection and lawful basis

We collect personal data directly from you when you make an enquiry or booking. Processing is carried out on a lawful basis: the performance of a contract, consent, compliance with a legal obligation, or a legitimate interest that does not override your rights.

4. Your rights as a data subject

Under Part IV of the Data Protection Act, 2019, you have the right to:

  • Be informed of the use of your personal data.
  • Access your personal data in our custody.
  • Object to processing of all or part of your data.
  • Correct false or misleading data.
  • Request deletion of false or misleading data.
  • Withdraw consent where processing is based on consent.
  • Data portability — to receive your data in a structured, commonly used format.

5. Security safeguards

  • Access to personal data is restricted to authorised personnel and trusted partners only.
  • Data is transmitted and stored using encryption and secure hosting.
  • We apply access controls, authentication and logging to protect against unauthorised access.

6. Breach notification

In the event of a personal data breach, we will assess the risk and, where required under the Data Protection Act, 2019, notify the Office of the Data Protection Commissioner and affected data subjects without undue delay.

7. Cross-border transfers

Where personal data is transferred or accessed outside Kenya in the course of serving our international clients, we ensure appropriate safeguards are in place consistent with the requirements of the Act.

8. Contact and complaints

Questions about this policy, or requests to exercise your rights, may be directed to us using the contact details on our website. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.