WhatsAppChat on WhatsApp
Legal

Privacy Policy

Last updated: 22 October 2026

TripBambika is committed to protecting your personal information. This Privacy Policy explains what data we collect, why we collect it, how we use and protect it, and your rights as a data subject under the Kenya Data Protection Act 2019 (KDPA) and the Data Protection (General) Regulations 2021. Please read it carefully.

1. Data Controller

The data controller responsible for your personal information is:

2. Data We Collect

We collect the following categories of personal data:

2a. Account Registration Data

When you create an account on our website we collect your full name, email address and a hashed password. We do not store your password in plain text.

2b. Booking & Transaction Data

When you make a booking we collect details including: experience or accommodation name, travel date, number of guests, guest ages/categories, and any special requests you provide. If payment is processed online, payment confirmation and reference numbers are recorded. We do not store full card numbers — these are handled by our third-party payment processor.

2c. Communication Data

If you contact us by email or WhatsApp, we retain records of those communications to manage your enquiry and booking. This includes any information you voluntarily share in those messages.

2d. Technical & Usage Data

When you use our website, we automatically collect certain technical information including your IP address, browser type, device type, pages visited and timestamps. This data is used for website security and to improve our service. We do not link this data to your personal identity without cause.

2e. Data You Provide Directly

This includes any additional information you choose to share with us — for example, medical conditions or dietary requirements relevant to your experience.

3. Legal Basis for Processing

Under the Kenya Data Protection Act 2019 (Section 30), we process your personal data on the following lawful bases:

  • Performance of a contract: Processing your booking and delivering the experience you have purchased.
  • Legal obligation: Complying with applicable Kenyan tax, consumer protection and tourism laws.
  • Legitimate interests: Improving our services, preventing fraud and ensuring website security, where these do not override your rights.
  • Consent: Sending you marketing communications (e.g. newsletter, promotions). You may withdraw this consent at any time.

4. How We Use Your Data

We use your personal data to:

  • Create and manage your account on tripbambika.com.
  • Process and confirm your tour or accommodation bookings.
  • Send booking confirmation and transactional emails.
  • Communicate with you regarding your booking, changes or cancellations.
  • Send you branded emails relating to your booking, including reminders and post-trip follow-ups.
  • Comply with our legal obligations under Kenyan law (e.g. Kenya Revenue Authority tax records).
  • Detect and prevent fraudulent activity or abuse of our platform.
  • Improve and optimise our website and services.
  • Send marketing communications — only if you have opted in.

We will never use your data for purposes incompatible with the original reason it was collected, without your prior consent.

5. Data Sharing & Third Parties

We do not sell, rent or trade your personal data. We may share your data with the following trusted third parties, only to the extent necessary to deliver our services:

  • Email service provider: To send booking confirmation and transactional emails on our behalf.
  • Payment processors: Such as M-Pesa (Safaricom) or card payment gateways, to process payments securely. These processors have their own privacy policies and are independently responsible for their data practices.
  • Cloud hosting / infrastructure providers: Our website and database are hosted on secure cloud infrastructure. Servers may be located outside Kenya; see Section 11 on international transfers.
  • Legal or regulatory authorities: Where required by law, court order or regulatory request in Kenya.

We require all third-party processors to maintain appropriate security measures and process your data only in accordance with our instructions.

6. Data Retention

We retain your personal data for the following periods:

Data CategoryRetention Period
Account & profile dataFor the duration of your account, plus 12 months after deletion
Booking & transaction records7 years (Kenya Revenue Authority requirement)
Communication records3 years from last contact
Technical / usage logs90 days (rolling)
Marketing consent recordsUntil consent is withdrawn, then deleted within 30 days

After the relevant retention period, personal data is securely deleted or anonymised.

7. Your Rights Under the KDPA 2019

As a data subject under the Kenya Data Protection Act 2019, you have the following rights:

  • Right to be informed: To know how your data is collected and used (this Policy fulfils that obligation).
  • Right of access: To request a copy of the personal data we hold about you.
  • Right to rectification: To request correction of inaccurate or incomplete personal data.
  • Right to erasure: To request deletion of your personal data where we no longer have a legal basis to hold it.
  • Right to object: To object to processing based on legitimate interests or for direct marketing purposes.
  • Right to data portability: To receive your data in a structured, commonly used format and transfer it to another service.
  • Right to withdraw consent: To withdraw consent for marketing communications at any time, without affecting the lawfulness of prior processing.

8. How to Exercise Your Rights

To exercise any of the rights listed above, contact our Data Protection point of contact:

We will respond to your request within 21 days as required by the KDPA 2019. In complex cases, this period may be extended by a further 21 days, and we will notify you of the extension and the reason.

We may need to verify your identity before fulfilling a request to protect against unauthorised access to your data.

9. Cookies & Tracking

Our website uses essential cookies required for core functionality (e.g. keeping you logged in during a session). We do not currently use third-party advertising or tracking cookies. If this changes, we will update this Policy and request your consent before placing non-essential cookies on your device.

You can control or delete cookies through your browser settings. Disabling essential cookies may affect the functionality of certain features such as account login and booking.

10. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures including:

  • Encrypted data transmission (HTTPS / TLS) on all pages.
  • Passwords stored using industry-standard hashing (bcrypt).
  • Access to personal data restricted to authorised personnel only.
  • Regular security reviews of our systems and third-party providers.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner (ODPC) within 72 hours and affected users without undue delay, as required by the KDPA 2019 and Regulation 26 of the Data Protection (General) Regulations 2021.

11. International Data Transfers

Our website infrastructure may involve servers located outside Kenya (for example, cloud hosting providers in the European Union or United States). Where personal data is transferred outside Kenya, we ensure that appropriate safeguards are in place in accordance with Part IV of the KDPA 2019 and the Data Protection (General) Regulations 2021, including standard contractual clauses or adequacy decisions where applicable.

12. Children's Privacy

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children under 16 without verified parental or guardian consent, in compliance with the Children Act 2022 (Kenya).

If you believe we have inadvertently collected data from a child under 16 without appropriate consent, please contact us immediately at book@tripbambika.com and we will delete the data promptly.

13. Complaints — Office of the Data Protection Commissioner

If you believe your data protection rights have been violated and you are not satisfied with our response, you have the right to lodge a complaint with the:

We encourage you to contact us first so we can resolve your concern directly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The revised date shown at the top of this page indicates when it was last updated. For significant changes, we will notify registered users by email. Continued use of our website after any update constitutes acceptance of the revised Policy.

15. Contact

For any privacy-related questions, requests or concerns, please contact us: