Privacy Policy

This Privacy Policy describes how Mara Tours & Travel Ltd ("we", "us", "our") collects, uses, discloses and safeguards your personal data when you visit our website, book a trip, or otherwise interact with us. We process personal data in compliance with the Kenya Data Protection Act, 2019 and its implementing regulations.

Section 01Data Controller

Mara Tours & Travel Ltd is the data controller for the personal data collected through our website and booking channels. Contact: info@maratoursandtravelltd.com, +254 759 711 145, Nairobi, Kenya.

Section 02What We Collect

• Identity data: name, gender, nationality, date of birth
• Contact data: email, phone, WhatsApp, physical address
• Travel data: passport / national ID number, travel dates, dietary and accessibility needs, emergency contact
• Payment data: M-PESA transaction references, card summaries via our payment processors (we do not store full card details)
• Technical data: IP address, browser type, device and cookie identifiers

Section 03Lawful Basis & Purpose

We process personal data under one or more lawful bases in section 30 of the Act:

• Performance of a contract — to plan, book, and deliver your travel
• Compliance with a legal obligation — tax, tourism and accounting laws
• Legitimate interest — to improve our services, prevent fraud, and communicate
• Consent — for marketing emails, testimonials and cookies you may withdraw at any time

Section 04Sharing Your Data

We share the minimum data needed with trusted third parties: partner hotels, lodges, transport providers, tour guides, KRA-approved payment processors, IT and analytics providers, and law enforcement where legally required. We do not sell your data.

Section 05International Transfers

Some processors (e.g. email, analytics, cloud hosting) are located outside Kenya. Transfers are made only where the recipient is subject to comparable data protection standards or where you have consented, in accordance with section 48 of the Act.

Section 06Retention

We retain booking records for at least seven (7) years to comply with the Tax Procedures Act, and other categories only as long as necessary for the purposes described.

Section 07Your Rights

Under Part V of the Act you have the right to: be informed; access; correction; deletion; object; restrict processing; data portability; and to lodge a complaint with the Office of the Data Protection Commissioner (odpc.go.ke). To exercise any right, email info@maratoursandtravelltd.com.

Section 08Security

We apply appropriate technical and organisational measures including encryption in transit, role-based access, and regular backups.

Section 09Changes

We may update this policy. Material changes will be posted on this page with a new "last updated" date.