Privacy Policy

Introduction

Welcome to Join Africa. This Privacy Policy explains how Join Africa Travel Technologies Limited (“Company,” “we,” “us,” or “our”) collects, uses, shares and protects your personal data when you access and use the Join Africa website and associated services (together, the “Platform”).

We are committed to protecting your privacy and to handling your personal data in an open and transparent manner, in compliance with the Kenyan Data Protection Act, 2019 (“DPA”) and its regulations.

By accessing or using the Platform, you acknowledge that you have read, understood and agreed to the terms of this Privacy Policy. This Policy should be read together with our Terms of Use, which govern your use of the Platform.

Data Controller Information

The data controller responsible for the processing of your personal data is: Join Africa Travel Technologies Limited, The Promenade, General Mathenge, Westlands, Nairobi, P.O. 63170.

For any privacy-related questions, concerns or requests, please contact us at: info@joinafrica.com

Information We Collect

We collect personal data in connection with your use of the Platform. The categories of personal data we process are as follows:

Account Registration Data

When you create an account on the Platform, we collect your first name, last name, email address and login password. This information is necessary to establish and maintain your account.

Profile Information

You may elect to provide supplementary profile information, including a profile picture and country of residence. Provision of this information is voluntary.

Guide Matching and Preference Data

Where you complete a questionnaire or preference form on the Platform for the purpose of being matched with a suitable guide or tour operator, we collect all information you provide in response to such questionnaire. This may include, without limitation, your intended travel destination, travel dates, group size, budget range, areas of interest, prior safari or travel experience and any specific requirements or accessibility needs you choose to disclose. This data is collected on the basis of your consent and is used solely to facilitate the matching process and to improve the relevance of recommendations presented to you on the Platform. You are not obliged to complete the questionnaire; however, your failure to do so may limit the functionality of the matching service available to you.

Review Content

Where you submit a review on the Platform, we collect the written content of that review, any star or quality rating assigned, and any photos or videos uploaded in connection with the review. You are solely responsible for ensuring that any media you upload does not contain personal data relating to identifiable third parties without their consent. Photos and videos submitted as part of a review may be publicly displayed on the Platform.

Gratuity and Tipping Transactions

Where you elect to send a monetary gratuity to a guide through the Platform's tipping feature, we collect the transaction amount and the recipient's identifier. All payment processing is conducted exclusively by Paystack (Pty) Ltd (“Paystack”), an independent third-party payment service provider. By initiating a gratuity payment, you are transacting directly with Paystack and your financial data is processed solely by Paystack in accordance with its own terms of service and privacy policy. Join Africa does not receive, store or have access to your full payment card details or banking credentials at any point. We receive only the transaction confirmation data necessary to record, display and reconcile the transaction on the Platform.

Communications

Where you contact us directly, for example to request support, we collect your name, email address and the content of your correspondence.

Usage Data

We automatically collect data relating to your interaction with the Platform, including features accessed, content viewed, actions taken and the time, frequency and duration of your sessions.

Device and Technical Data

We collect technical information about the device and software you use to access the Platform, including your IP address, browser type, operating system, device identifiers and crash or error data.

Sensitive Personal Data

We do not intentionally solicit or collect Sensitive Personal Data as defined under the DPA, including data revealing race, health status, ethnic origin, political opinions, religious beliefs, biometric data or sexual orientation. You must not upload any such data to the Platform.

Purposes and Legal Bases for Processing

We process your personal data for the following purposes, relying on the legal bases indicated:

• Account Management: To create, operate and maintain your account and to provide you with access to Platform features. (Legal Basis: Performance of Contract)
• Guide and Operator Matching: To process the information you provide via the Platform's matching questionnaire in order to identify and present guides or tour operators whose profiles and services correspond to your stated preferences and requirements. The data collected through the questionnaire is used exclusively for this purpose and to improve the relevance and accuracy of matching outcomes. (Legal Basis: Consent; Legitimate Interest)
• Publication of Review Content: To display your reviews, ratings and any associated photos or videos on the relevant guide or operator profile pages on the Platform. By submitting a review, you expressly consent to its public display. (Legal Basis: Consent; Legitimate Interest)
• Processing Gratuity Transactions: To facilitate and record monetary gratuities sent by you to guides through the Platform's tipping feature, and to display gratuity activity where applicable. (Legal Basis: Performance of Contract)
• Service Communications: To send you transactional and service-related notifications, including account alerts, security notices and support correspondence. (Legal Basis: Performance of Contract; Legitimate Interest)
• Platform Improvement and Analytics: To analyse user behaviour, troubleshoot technical issues, develop new features and improve the overall user experience. (Legal Basis: Legitimate Interest; Consent in respect of non-essential analytics)
• Safety, Security and Enforcement: To detect, investigate and prevent fraudulent, unauthorised or unlawful activity and to enforce our Terms of Use. (Legal Basis: Legitimate Interest; Legal Obligation)
• Legal Compliance: To comply with applicable Kenyan laws, regulations, court orders and other legal obligations. (Legal Basis: Legal Obligation)

Disclosure of Your Personal Data

We do not sell your personal data to third parties. We may disclose your personal data in the following circumstances:

Public Display on the Platform

Reviews, ratings, photos and videos you submit are displayed publicly on the Platform and may be visible to all users and indexed by search engines.

Third-Party Service Providers

We engage trusted third-party processors to support the operation of the Platform. These currently include Google Cloud (hosting infrastructure) and Paystack (Pty) Ltd (payment processing). In respect of payment processing, Paystack operates as an independent data controller in relation to your financial and payment card data. Join Africa does not receive or store your payment card details. Such processors are subject to contractual obligations requiring them to handle personal data only in accordance with applicable data protection law.

Legal Disclosure

We may disclose your personal data where required to do so by law, court order or legal process, or where we have a good faith belief that such disclosure is reasonably necessary to comply with legal obligations, enforce our Terms of Use or protect the rights, property or safety of the Company, our users or third parties.

Corporate Transactions

In the event of a merger, acquisition, reorganisation or sale of all or a material portion of our assets, your personal data may be transferred to the acquiring or successor entity. We will notify you via email or a prominent notice on the Platform of any such change and of any consequential change in the processing of your personal data.

International Data Transfers

Your personal data may be transferred to, stored in and processed in jurisdictions outside Kenya, in particular where our third-party service providers maintain infrastructure globally.

Where we transfer personal data outside Kenya, we ensure that appropriate safeguards are in place in accordance with the DPA, which may include transferring data to countries recognised as adequate by the Office of the Data Protection Commissioner (ODPC), implementing Standard Contractual Clauses approved by the ODPC or obtaining your explicit consent where required by law.

Data Security

We implement appropriate technical and organisational measures designed to protect your personal data against unauthorised access, loss, destruction or alteration. These measures include encryption of data in transit and at rest, access controls and secure server infrastructure hosted on Google Cloud.

Notwithstanding the foregoing, no method of electronic transmission or storage can be guaranteed to be wholly secure. We encourage you to use a strong, unique password for your account and to keep your credentials confidential.

Data Retention

We retain your personal data only for as long as is necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law.

Account data is retained for the duration that your account remains active. Review content, ratings and associated media that form part of a guide or operator's publicly displayed profile may be retained following account deletion where removal would materially affect the integrity of that profile, unless you specifically request their deletion. Gratuity transaction records may be retained for such periods as are required by applicable Kenyan tax and financial regulations.

Upon deletion of your account, we will take reasonable steps to delete or anonymise your personal data within a reasonable timeframe, subject to any applicable legal retention obligations.

Your Data Protection Rights

Under the Data Protection Act, 2019, you are entitled to exercise the following rights in respect of your personal data:

• Right of Access: To request a copy of the personal data we hold about you.
• Right to Rectification: To request correction of inaccurate or incomplete personal data.
• Right to Erasure: To request deletion of your personal data, subject to applicable legal obligations.
• Right to Restriction of Processing: To request that we limit the processing of your personal data in certain circumstances.
• Right to Object: To object to our processing of your personal data where we rely on legitimate interests as the legal basis.
• Right to Data Portability: To receive your personal data in a structured, commonly used format or to have it transferred to another controller, where technically feasible.
• Right to Withdraw Consent: Where processing is based on your consent, to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of the above rights, please contact us at info@joinafrica.com. We will respond to all legitimate requests within the timeframes prescribed by the DPA following verification of your identity.

Children's Privacy

The Platform is not directed at and is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. In the event that we become aware that personal data has been collected from a person under the age of 18 without appropriate parental or guardian consent, we will take immediate steps to delete that data.

Cookies and Tracking Technologies

We may use cookies, software development kits (including PostHog and Firebase Analytics) and similar tracking technologies to operate the Platform, provide functionality and analyse usage patterns. You may be able to manage your preferences in respect of certain tracking technologies through your browser or device settings.

Changes to This Privacy Policy

We reserve the right to update or amend this Privacy Policy at any time. Where changes are material, we will notify you by posting the revised Policy on the Platform or by sending you a notification by email. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically.