Privacy Policy

Introduction

This Privacy Policy sets out how Join Africa Travel Technologies Limited (“Join Africa,” “we,” “us,” or “our”) collects, uses, stores, discloses and otherwise processes the personal data and business information of tour operators (“you,” “your” or “Operator”) who register for and subscribe to the Join Africa Platform (the “Platform”) at www.joinafrica.com.

Join Africa operates as an aggregator and discovery platform, connecting prospective travellers with licensed guides and tour operators across Africa. In the course of providing this service, we necessarily collect and process information about your business and, where applicable, about the individuals who represent or manage your business on the Platform.

We are committed to processing your data lawfully, fairly and transparently in accordance with the Kenyan Data Protection Act, 2019 (“DPA”) and its regulations. This Policy should be read together with our Tour Operator Terms of Service, which govern the commercial relationship between you and Join Africa.

By registering for an account or subscribing to the Platform, you acknowledge that you have read and agreed to the terms of this Privacy Policy.

Data Controller Information

The data controller responsible for the processing of your personal and business data is: Join Africa Travel Technologies Limited, The Promenade, General Mathenge, Westlands, Nairobi, P.O. 63170.

For any privacy-related questions, concerns or requests, please contact us at: info@joinafrica.com

Information We Collect

In the course of your registration and subscription, and through your ongoing use of the Platform, we collect the following categories of information:

Business Registration and Identity Data

Upon registration, we collect your trading name, legal business name, business registration number, country of incorporation or registration, registered business address and the name and contact details of the individual completing the registration on behalf of the business. Where you are a sole trader, this will include your personal name and contact information.

Operator Profile Data

To construct and publish your operator profile on the Platform, we collect all information you submit in connection with your profile. This may include, without limitation, a business description, service areas and safari destinations offered, tour categories and specialisations, spoken languages, pricing information, photographs, logos, promotional materials and any other content you elect to publish. You are solely responsible for the accuracy and completeness of all profile data submitted.

Account Credentials

We collect the login credentials associated with your account, including the email address and password used to access the Platform. You are responsible for maintaining the security of these credentials.

Subscription and Billing Data

We collect records of your subscription to the Platform, including the subscription tier selected, the applicable subscription fee, billing cycle and subscription status. All payment transactions are processed exclusively by Paystack (Pty) Ltd (“Paystack”), an independent third-party payment service provider. Join Africa does not receive, store or have access to your full payment card details or banking credentials at any point. We receive only the transaction confirmation data necessary to record, activate and manage your subscription.

Communications and Correspondence

We collect records of communications between you and Join Africa, including support requests, notices, complaints and any correspondence relating to your account or subscription.

Platform Usage Data

We automatically collect data relating to your interaction with the Platform, including features accessed, content viewed or edited, actions taken and the time, frequency and duration of your sessions.

Device and Technical Data

We collect technical information about the device and software you use to access the Platform, including your IP address, browser type, operating system and device identifiers.

Enquiry and Lead Data

Where Platform users submit an enquiry or express interest in your operator profile, we collect records of such interactions to the extent necessary to facilitate and display that activity.

Review and Rating Data

We collect and display reviews and ratings submitted by Platform users in respect of your business. While we do not author such content, we retain records of all reviews published on your profile.

Purposes and Legal Bases for Processing

We process your data for the following purposes, on the legal bases indicated:

• Account Registration and Management: To create and maintain your operator account, verify your identity and business details, and provide you with access to Platform features. (Legal Basis: Performance of Contract)
• Publication of Operator Profile: To publish and display your operator profile, including business information, service descriptions, photographs and promotional content, to Platform users and the general public, and to index that profile on third-party search engines. (Legal Basis: Performance of Contract; Legitimate Interest)
• Subscription Administration and Payment Processing: To administer your subscription, manage billing cycles, process subscription fees via Paystack and maintain subscription records. (Legal Basis: Performance of Contract)
• Lead Generation and Enquiry Facilitation: To facilitate and record enquiries and expressions of interest submitted by Platform users in connection with your operator profile, for the purpose of connecting you with prospective clients. (Legal Basis: Performance of Contract; Legitimate Interest)
• Display of Reviews and Ratings: To publish and maintain user-submitted reviews and ratings on your operator profile as part of the Platform's aggregator and discovery function. (Legal Basis: Legitimate Interest)
• Platform Communications: To send you transactional and service-related notices, including subscription confirmations, renewal reminders, billing alerts, policy updates and support correspondence. (Legal Basis: Performance of Contract; Legitimate Interest)
• Platform Improvement and Analytics: To analyse usage patterns, troubleshoot technical issues, develop new features and improve the performance and relevance of the Platform. (Legal Basis: Legitimate Interest)
• Safety, Security and Enforcement: To detect, investigate and prevent fraudulent, unauthorised or unlawful activity and to enforce our Tour Operator Terms of Service. (Legal Basis: Legitimate Interest; Legal Obligation)
• Legal and Regulatory Compliance: To comply with applicable Kenyan laws and regulations, court orders and other legal obligations, including the retention of financial and business records. (Legal Basis: Legal Obligation)

Disclosure of Your Data

We do not sell your personal or business data to third parties. We may disclose your data in the following circumstances:

Public Display on the Platform

Your operator profile, including business name, description, service areas, photographs and reviews, will be publicly visible to all Platform users and to the general public, and may be indexed by search engines. You should not include in your profile any information you do not wish to be publicly disclosed.

Platform Users

Enquiries and expressions of interest submitted by Platform users in connection with your profile will be transmitted to you through the Platform.

Third-Party Service Providers

We engage trusted third-party processors to support the operation of the Platform. These currently include Google Cloud (hosting infrastructure) and Paystack (Pty) Ltd (payment processing). In respect of payment processing, Paystack operates as an independent data controller in relation to your financial and payment card data. All processors are subject to obligations requiring them to handle data only in accordance with applicable data protection law.

Legal Disclosure

We may disclose your data where required to do so by law, court order or legal process, or where we have a good faith belief that such disclosure is reasonably necessary to comply with legal obligations, enforce our Terms of Service or protect the rights, property or safety of the Company, our users or third parties.

Corporate Transactions

In the event of a merger, acquisition, reorganisation or sale of all or a material portion of our assets, your data may be transferred to the acquiring or successor entity. We will notify you of any such change and of any consequential change in the processing of your data.

International Data Transfers

Your data may be transferred to, stored in and processed in jurisdictions outside Kenya, in particular where our third-party service providers maintain infrastructure globally.

Where we transfer personal data outside Kenya, we ensure that appropriate safeguards are in place in accordance with the DPA, which may include transferring data to countries recognised as adequate by the Office of the Data Protection Commissioner (ODPC), implementing Standard Contractual Clauses approved by the ODPC or obtaining your explicit consent where required.

Data Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or alteration, including encryption in transit and at rest, access controls and secure server infrastructure hosted on Google Cloud.

You are responsible for maintaining the security of your account credentials. Please notify us immediately at info@joinafrica.com if you become aware of any actual or suspected unauthorised access to your account.

Data Retention

We retain your data only for as long as is necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law.

Account and profile data is retained for the duration your subscription remains active and for a reasonable period thereafter to facilitate account reactivation or to address any disputes arising from the subscription. Subscription and billing records will be retained for such periods as are required by applicable Kenyan tax and financial regulations. Reviews and ratings published on your profile during your subscription period may be retained following termination of your account where they form part of the Platform's published record, subject to any valid erasure request.

Upon termination of your account, we will take reasonable steps to delete or anonymise your personal data within a reasonable timeframe, subject to applicable legal retention obligations.

Your Data Protection Rights

Under the Data Protection Act, 2019, you are entitled to exercise the following rights in respect of your personal data:

• Right of Access: To request a copy of the personal data we hold about you.
• Right to Rectification: To request correction of inaccurate or incomplete data.
• Right to Erasure: To request deletion of your personal data, subject to applicable legal retention obligations.
• Right to Restriction of Processing: To request that we limit the processing of your data in certain circumstances.
• Right to Object: To object to our processing of your data where we rely on legitimate interests as the legal basis.
• Right to Data Portability: To receive your data in a structured, commonly used format or to have it transferred to another controller where technically feasible.
• Right to Withdraw Consent: Where processing is based on your consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, please contact us at info@joinafrica.com. We will respond within the timeframes prescribed by the DPA following verification of your identity.

Children's Privacy

The Platform is not directed at and is not intended for use by individuals under the age of 18. If you are registering on behalf of a business, you represent and warrant that you are at least 18 years of age and have full legal authority to bind the business to these terms.

Changes to This Privacy Policy

We reserve the right to update or amend this Privacy Policy at any time. Where changes are material, we will notify you by posting the revised Policy on the Platform or by sending you a notification by email. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy.