In short
Kenia Geographic Ltd, trading as Kenya Geographic (company number PVT-DLUBV58), P.O. Box 7345-00100, Nairobi, is the data controller for the personal data described here.
Data protection contact: privacy@kenyageographic.com, +254 792 25 25 25. We have not appointed a data protection officer; questions about this policy are handled by our management team through that address.
This policy covers everything on kenyageographic.com: SafariQuest™ bookings and events, The TravelDuka™ stores, LearnQuest™ courses, EneaViral™ advertising, our blog, magazine and podcast, our chat assistant and our careers page.
Partners are responsible too. When we pass your booking or order to a hotel, host, tour operator, car-hire firm, event organiser or store, they become responsible for how they use your details to serve you, under their own privacy notices and the law.
| What | Why | Legal basis [COUNSEL: s.30 grounds] |
|---|---|---|
| Technical data: IP address, browser, device, pages visited, collected by our servers | Run the site, keep it secure, prevent fraud and bots | Legitimate interests |
| Cookies and similar technologies: see our [Cookie Policy] | Essential cookies make the site work; analytics and advertising cookies only with your consent | Necessary for the service / Consent |
| Bot-protection checks on sign-in and registration (Cloudflare Turnstile) | Stop automated sign-ups and attacks | Legitimate interests |
| What | Why | Basis |
|---|---|---|
| Name, email, phone, password (stored encrypted), role, preferences | Create and manage your account | Contract |
| If you use “Continue with Google”: your Google name, email address and account identifier | Sign you in without a new password | Contract |
| What | Why | Basis |
|---|---|---|
| Guest names, contact details, dates, number of guests, special requests, booking history | Make and manage your booking; send confirmations and reminders | Contract |
| Payment reference and status from Paystack (we never see or store your full card number) | Take payment, issue refunds, handle chargebacks | Contract; legal obligation (tax records) |
| Reviews you write | Publish honest reviews for other travellers | Consent / legitimate interests |
| Tickets and gate check-in records for events | Admit you and prevent ticket fraud | Contract |
Name, delivery address, phone, order details and order notes, to deliver your order and handle returns (contract). The store you buy from and the delivery company receive what they need to fulfil it.
| What | Why | Basis |
|---|---|---|
| Enrolment, course progress, quiz answers, assignments, grades, comments | Deliver the course, assess you and issue certificates | Contract |
| Certificate details (your name, course, date, certificate number) | Let you and employers check a certificate on its public verification page | Contract / your request |
Course instructors can see the progress, answers and grades of learners on their courses.
| What | Why | Basis |
|---|---|---|
| Business details, owner’s and representative’s names and contact details, KRA PIN, business registration, licences (including TRA licence number and expiry) | Verify your business, show trust badges, remind you before a licence expires | Contract; legal obligation |
| Identity documents and supporting documents you upload | Verify who you are before you can publish or be paid | Contract; legal obligation |
| Bank or mobile money details | Pay you | Contract |
| Signed agreement records: the agreement text, a fingerprint of it, the date, the one-time code check, the capacity you sign in and any power of attorney you upload | Prove what was agreed and by whom | Contract; legitimate interests |
| Listings, photos, prices, booking and sales performance | Run your listings, pay you, give you insights | Contract |
| What | Why | Basis |
|---|---|---|
| Your messages, and your email address if you choose to give it | Answer your questions, hand you to a person, send you a copy of the conversation | Legitimate interests / your request |
| Your messages are sent to an artificial intelligence model through OpenRouter to generate answers | Produce the assistant’s replies | Legitimate interests |
| A record of what happened in the conversation (started, handed to a person, resolved, ratings), without the message text | Improve the service | Legitimate interests |
| If you place an order or booking within 90 days of chatting, a link between the conversation and that order (number, value, status) | Understand whether the chat helps customers | Legitimate interests |
Giving an email in the chat is not agreement to marketing. You’ll be asked separately, and you can say no. The chat does not keep your IP address or browser details. Your browser keeps a small record of your visits and chats so the chat doesn’t show you the same message too often; it isn’t sent to us.
Your name and email, when and how you signed up, and the exact wording you agreed to, kept as a record of your consent. Used to send the Kenya Geographic Magazine, partner digests and offers you asked for (consent). Every email has an unsubscribe link.
What you send us, to reply and, for comments and articles, to publish them. Comments may show your profile picture if you use Gravatar (a service run by Automattic, which receives a coded version of your email address).
Your application and CV, to consider you for the role (your request / legitimate interests). Applicants are never added to marketing lists. If you are unsuccessful, your personal details and CV are deleted 180 days after the decision.
Our team’s working records, including the hours colleagues are online in the chat inbox, are described in a separate staff notice.
We never sell your personal data.
| Who | What for |
|---|---|
| The partner or store providing your booking, ticket, course or order | To provide it |
| Paystack | Processing payments, refunds and payouts |
| Delivery companies | Delivering TravelDuka orders |
| CyMetricA (our sister company) | Building, hosting and supporting the platform, under our instructions |
| Hosting and email: Contabo (our servers, located in Europe), SiteGround (email, until our migration completes) [remove when done], Amazon Web Services (email delivery) | Running the site and sending emails |
| Google: Analytics, Ads, Sign-In, Fonts, YouTube, Gmail sync for our team’s correspondence | Analytics and ads (with consent), sign-in, displaying content, our correspondence |
| Meta, LinkedIn, X, Pinterest | Measuring our advertising (with consent) |
| Microsoft Clarity | Understanding how visitors use pages, including session recordings (with consent) |
| Mapbox, Transifex, Cloudflare | Maps, page translation, bot protection |
| OpenRouter and the AI model provider it routes to | Generating chat replies |
| Travelpayouts / Aviasales | Flight search (you book flights on their partners’ sites) |
| Professional advisers, auditors, insurers | Advice and compliance |
| Authorities such as the Kenya Revenue Authority, Tourism Regulatory Authority, Office of the Data Protection Commissioner, police or courts | Where the law requires it |
| A buyer of our business | If Kenya Geographic is sold or merged, under the same protections |
Industry insights. We may combine booking and listing data from many partners into anonymised statistics and reports about Kenyan travel. These never identify you.
Some providers above store or process data outside Kenya, mainly in the European Union and the United States. We use providers that commit to protecting it, through their data processing terms, and we only send what they need.
We do not make decisions that have legal or similarly significant effects on you based only on automated processing. The chat assistant answers questions; it does not approve, refuse or price anything. Search results rank listings by relevance, availability, content quality, reviews and partner tier (see our Booking Terms).
| Data | How long |
|---|---|
| Account details | While your account is open, then 12 months, unless needed for the records below |
| Booking, order, payment and tax records | 7 years for tax and accounting |
| Partner and store verification documents | While the account is open and for 12 months afterwards |
| Signed partner agreements | For the life of the agreement and 7 years afterwards |
| Chat conversation records and logs | 25 months, unless you delete them sooner |
| Marketing list | Until you unsubscribe; we keep a record of your consent or withdrawal as proof |
| Unsuccessful job applications | 180 days after the decision |
| Server security logs | 30 days |
| Cookies | As set out in our Cookie Policy |
When a period ends, we delete the data or anonymise it.
Under the Data Protection Act, 2019 (section 26) you can:
To use any of these rights, email privacy@kenyageographic.com or use your account settings. In the chat, you can delete a conversation yourself. We’ll reply within 7 days / the period the law sets and may ask you to confirm your identity first.
If you’re unhappy with how we’ve handled your data, please tell us first. You also have the right to complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
We use encrypted connections (TLS), signed and verified payment notifications, two-factor sign-in for our staff, access limited to those who need it, and sealed records for signed agreements. If a breach puts your data at risk, we will notify the Office of the Data Protection Commissioner and tell you where the law requires it.
Our services are for adults. You must be 18 or over to create an account. If you believe a child has given us personal data, contact us and we will delete it.
We’ll update this policy when our services or the law change, show the new date at the top, and tell account holders by email about significant changes.
Kenia Geographic Ltd (Kenya Geographic) · P.O. Box 7345-00100, Nairobi · [privacy@kenyageographic.com] · +254 792 25 25 25
Last Updated: 13/11/2026
