Privacy Notice
This document is a draft and is being finalized. It may change before our official launch.
This privacy notice explains how SafiriFlow collects, uses and protects your personal data when you use our website and submit a travel inquiry. We aim to align this notice with the EU General Data Protection Regulation (GDPR) and Kenya's Data Protection Act, 2019, and we will keep it updated as our practices and legal review develop.
What we collect
When you submit an inquiry or quote request through our site, we collect the information you provide directly, which typically includes:
- Your name
- Email address
- Phone or WhatsApp number
- Trip details: destinations of interest, travel dates, group size, budget range and any preferences you share
We also automatically collect limited attribution data associated with your inquiry, such as the page you submitted it from and any UTM parameters (campaign source, medium or name) attached to the link you arrived through. This helps us understand which pages and campaigns are useful to visitors, and it may help our travel experts understand the context of your inquiry.
Why we collect it, and our lawful basis
| Purpose | Lawful basis (GDPR) |
|---|---|
| Responding to your inquiry and preparing a quote | Steps taken at your request prior to entering a contract (Art. 6(1)(b)) |
| Communicating with you about your trip | Legitimate interests, and contract performance once you engage us |
| Understanding which pages and campaigns drive inquiries | Legitimate interests |
| Complying with legal obligations, such as record-keeping | Legal obligation (Art. 6(1)(c)) |
Under Kenya's Data Protection Act, we rely on equivalent grounds, including your consent where required and our legitimate interest in operating and improving our service.
How long we keep your data
We retain inquiry data for as long as needed to respond to you, plan and administer any trip you book with us, and meet reasonable record-keeping needs afterward. If you don't proceed with a trip, we retain your inquiry for a limited period in case you return to it, after which we delete or anonymize it. Exact retention periods are still being finalized [to be confirmed].
Your rights
Depending on your location, you may have the right to access, correct, delete or restrict the use of your personal data, to object to certain processing, and to request a copy of your data in a portable format. Kenyan data subjects have equivalent rights under the Data Protection Act. To exercise any of these rights, contact us using the details below.
Cookies and analytics
We may use cookies and similar technologies to understand how visitors use our site and to remember basic preferences. Where analytics tools require consent under applicable law, we will ask for it before enabling non-essential cookies. You can control cookies through your browser settings at any time.
International transfers and processors
Because we operate as a global platform, your data may be processed outside your home country. We use the following categories of service providers (processors) to run our website and respond to inquiries:
- Hosting: Vercel
- Database: Neon
- Email delivery: an email service provider used to send inquiry confirmations and replies
Where these providers process data outside the European Economic Area or Kenya, we rely on appropriate safeguards such as standard contractual clauses, and we will name our specific processors and safeguards in full once our provider agreements are finalized.
Children's data
Our site is not directed at children, and we do not knowingly collect personal data from children through our inquiry form.
Changes to this notice
We may update this notice as our practices, providers or applicable law change. We will post the revised version on this page with an updated date once versioning is finalized.
Contact us
For any privacy questions or to exercise your data rights, contact us at: [to be confirmed]