Privacy Policy

1. Who we are

Maisha Masha Safaris ("we", "us", "our") is a full-service tour operator based in Kenya. This Privacy Policy explains how we collect, use, store and protect your personal information when you use our website, submit a booking enquiry, or engage our services.

2. Information we collect

When you contact us, request a quote or make a booking, we may collect the following personal data:

• Identity information — your name and, where relevant, the names of other travellers.
• Contact information — email address, phone number and WhatsApp number.
• Travel information — country of origin, arrival and departure dates, number of adults and children, travel interests and any special requirements or notes you share.
• Booking and payment information — records of your enquiries, confirmed bookings and payment references (we do not store full card numbers).
• Technical information — IP address, browser type, device information and pages visited, collected through cookies and similar technologies.

3. How we use your information

• To respond to your enquiries and provide a personalised quote.
• To plan, confirm and deliver your trip — transfers, accommodation, transport and guided experiences.
• To communicate with you before, during and after your journey.
• To process payments and issue receipts.
• To comply with legal, tax and regulatory obligations.
• To improve our website and services (in aggregate, anonymised form where possible).

4. Legal basis for processing

We process your personal data only where we have a lawful basis to do so. This includes: performing a contract with you (planning and delivering your trip), your consent (for marketing), and our legitimate interests or legal obligations (such as record-keeping and fraud prevention).

5. Sharing your information

We do not sell or rent your personal data. We may share your information only with trusted service providers who help deliver your trip — such as accommodation partners, transport providers and licensed guides — and only to the extent necessary to provide the requested service. These partners are required to protect your data and use it only for the agreed purpose.

6. Data retention

We retain personal data only for as long as necessary to fulfil the purposes described above and to meet legal and accounting obligations. When no longer needed, it is securely deleted or anonymised.

7. Data security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration or disclosure, including access controls, encryption in transit and secure hosting.

8. Your rights

Under the Kenya Data Protection Act, 2019, you have rights in relation to your personal data, including:

• The right to access your personal data.
• The right to request correction of inaccurate data.
• The right to request deletion of your data (subject to legal retention requirements).
• The right to object to or restrict processing.
• The right to withdraw consent where processing is based on consent.
• The right to data portability.

9. International transfers

As a Kenya-based operator serving clients worldwide, your data may be accessed from locations outside Kenya. Where this occurs, we ensure appropriate safeguards are in place to protect your information.

10. Contact us

For any questions about this Privacy Policy or to exercise your rights, please contact us using the details on our website. You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.

This policy may be updated from time to time. Any changes will be posted on this page with an updated date.