Privacy Policy

The Platform is operated by:

• [LEGAL COMPANY NAME]
• Trading as: Uncharted Travels
• Registration Number: [NUMBER]
• Registered Address: [ADDRESS]
• Email: [PRIVACY EMAIL]
• Country: Kenya

For purposes of applicable data protection law, [LEGAL COMPANY NAME] may act as a data controller in respect of personal data that we determine the purposes and means of processing.

Where we process personal data on behalf of another organisation, we may act as a data processor or service provider, depending on the circumstances.

The information we collect depends on how you interact with the Platform.

This may include:

• name
• email address
• telephone number
• account credentials
• profile information
• country or region
• travel preferences
• destination and trip preferences
• newsletter subscription information
• creator or ambassador application information
• social-media profile information
• information submitted when contacting us
• information submitted through reviews, comments or other content
• payment or payout information where applicable to creator commissions
• information required to administer creator or affiliate relationships

We will only request information that is reasonably necessary for the relevant purpose.

If you apply to or participate in the Uncharted Travels Creator, Ambassador or Partner programme, we may collect:

• your name
• contact information
• creator profile information
• social-media usernames and public profile information
• audience or platform information
• content preferences
• affiliate/referral information
• tracking and performance information
• payout information
• information necessary to verify or administer your account

Where you connect a social-media account, we may receive information permitted by the relevant platform and the permissions you grant.

We do not request or store your social-media password.

When you use the Platform, we may automatically collect information such as:

• IP address
• browser type and version
• device type
• operating system
• approximate geographic location
• pages viewed
• links clicked
• referring website
• session information
• timestamps
• search and interaction information
• technical logs
• information about how you interact with our Platform

We use this information for security, analytics, performance monitoring, attribution and service improvement.

Because Uncharted Travels operates an affiliate and referral model, we may collect information relating to:

• affiliate links
• creator/referrer identifiers
• referral codes
• clicks
• landing pages
• timestamps
• device/browser information
• conversion or booking attribution information
• supplier-reported booking or commission information where made available to us

This information allows us to measure referrals, calculate commissions and prevent fraud or abuse.

We do not generally receive a user's complete payment-card details when a booking is completed on a third-party supplier's website.

We may receive information from third parties, including:

• travel suppliers
• affiliate networks
• booking platforms
• social-media platforms
• analytics providers
• authentication providers
• payment and payout providers
• email and communication providers
• publicly available sources
• creators or partners who refer users to us

For example, a travel supplier may provide information relating to an affiliate conversion so that we can attribute a booking and calculate the applicable commission.

The third party may separately process your information under its own privacy policy and terms.

We may process personal data for the following purposes:

To:

• create and administer accounts
• provide search and discovery functionality
• display travel products and destinations
• personalise content and recommendations
• provide creator tools
• operate affiliate and referral links
• provide customer support
• communicate with users
• maintain Platform functionality

We process relevant information to:

• identify referrals
• attribute clicks and bookings
• calculate commissions
• administer creator rewards
• detect duplicate, fraudulent or abusive activity
• maintain financial and transaction records

Where permitted by law, we may use contact information to send:

• account-related communications
• service notifications
• newsletters
• travel content
• destination information
• deals and offers
• creator programme communications

Marketing communications will provide an appropriate mechanism to unsubscribe or withdraw consent where applicable.

We may analyse Platform usage to:

• understand user behaviour
• measure marketing effectiveness
• improve search and recommendations
• improve website performance
• develop new features
• identify technical problems
• detect abuse and fraud

We may process technical and account information to:

• authenticate users
• secure accounts
• detect suspicious activity
• prevent fraud
• protect the Platform
• investigate security incidents
• enforce our Terms

We may process information where necessary to:

• comply with applicable laws
• respond to lawful requests
• establish, exercise or defend legal claims
• maintain required records
• meet accounting, tax or regulatory obligations

Depending on the circumstances, we may process personal data on one or more lawful bases recognised by applicable law, including:

• performance of a contract or taking steps at your request before entering into a contract
• compliance with a legal obligation
• your consent
• our legitimate interests, where those interests are not overridden by your rights and freedoms
• other lawful bases available under applicable law

Where we rely on consent, you may withdraw that consent, subject to applicable legal and operational limitations.

Kenyan data protection requirements recognise rights including being informed, access, objection, correction and deletion, with additional rights provided under applicable law.

We may use cookies and similar technologies for purposes including:

• essential Platform functionality
• authentication
• security
• remembering preferences
• analytics
• affiliate attribution
• measuring marketing campaigns
• improving the Platform

Some cookies may be placed by third-party service providers.

Where required, we will obtain consent before using non-essential cookies or similar technologies.

You may also control cookies through your browser settings. Disabling certain cookies may affect Platform functionality or affiliate attribution.

Some links on the Platform are affiliate links.

When you click an affiliate link, we may receive information that allows the relevant supplier or affiliate network to attribute the referral to Uncharted Travels or a particular creator.

We may receive a commission if you subsequently complete an eligible transaction.

The price you pay is not necessarily increased because of our affiliate relationship.

Where required, we will provide appropriate affiliate disclosures.

Uncharted Travels may display travel products and services supplied by third parties.

If you click through to a supplier or booking platform, that third party may collect and process personal information directly.

The supplier may require information such as:

• name
• contact details
• traveller information
• payment information
• passport or identity information
• special requirements
• booking information

Such processing may be governed by the supplier's own privacy policy.

Uncharted Travels should not be understood to be the data controller for information that a third-party supplier independently collects and processes for its own purposes.

Creators may have the option to connect supported social-media accounts.

Where you authorise an integration, we may process information necessary to:

• authenticate the account
• identify the connected profile
• publish or schedule authorised content
• retrieve permitted account information
• monitor publishing status
• disconnect the integration

The information available to us depends on the permissions and APIs provided by the relevant social-media platform.

You can revoke permissions through the relevant social-media platform or through available controls within Uncharted Travels.

We may use artificial intelligence and machine-learning technologies to support Platform operations, including:

• content classification
• summarisation
• editorial drafting
• review analysis
• destination and product categorisation
• recommendation generation
• SEO content preparation
• social-media content generation
• fraud and abuse detection
• data enrichment

Where third-party AI services are used, relevant information may be processed by those providers in accordance with the applicable contractual arrangements and privacy terms.

We will not intentionally use AI systems to generate fabricated supplier prices, availability, booking confirmations or other transactional information.

Supplier systems remain the authoritative source for applicable product availability, pricing and booking information.

Where applicable law provides rights relating to automated decision-making or profiling, those rights will apply.

We may share personal data with third parties where necessary for the purposes described in this Policy.

These may include:

• travel suppliers
• affiliate networks
• booking platforms
• social-media platforms
• payment and payout providers
• hosting providers
• cloud infrastructure providers
• analytics providers
• email and communications providers
• security and fraud-prevention providers
• AI service providers
• professional advisers
• auditors
• legal advisers
• regulators and public authorities where legally required

We do not sell personal data merely for the purpose of selling personal information to third parties.

We require service providers that process personal data on our behalf to apply appropriate confidentiality and security measures.

Some service providers or suppliers may process information outside Kenya or outside the country in which you reside.

Where personal data is transferred internationally, we will seek to ensure that the transfer is conducted in accordance with applicable data protection law and appropriate safeguards are used where required.

Depending on the circumstances, safeguards may include contractual protections, adequacy arrangements, consent or another lawful transfer mechanism.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, unless a longer period is required or permitted by law.

Retention periods may depend on:

• the nature of the information
• the purpose for processing
• whether the account remains active
• legal and regulatory obligations
• accounting and tax requirements
• dispute resolution
• fraud prevention
• enforcement of agreements
• legitimate business requirements

When information is no longer required, we will delete, anonymise or securely dispose of it where appropriate.

We use reasonable technical and organisational measures designed to protect personal data against:

• unauthorised access
• accidental loss
• destruction
• alteration
• disclosure
• misuse

Security measures may include access controls, authentication, encryption where appropriate, logging, monitoring, backups and infrastructure security.

No internet-based system can be guaranteed to be completely secure.

If we become aware of a personal-data breach, we will assess and respond to it in accordance with applicable law.

Where notification to affected individuals or a regulator is legally required, we will make the appropriate notification within the applicable timeframe.

Subject to applicable law and relevant limitations, you may have rights including:

• the right to be informed about processing
• the right to access your personal data
• the right to request correction of inaccurate information
• the right to request deletion or erasure where applicable
• the right to object to certain processing
• the right to restrict processing where applicable
• the right to data portability where applicable
• the right to withdraw consent where processing relies on consent
• the right to lodge a complaint with the relevant data protection authority

Kenya's Office of the Data Protection Commissioner identifies these data-subject protections and provides mechanisms for complaints.

To exercise a privacy right or ask a question about your personal data, contact:

• Email: [PRIVACY EMAIL]

We may need to verify your identity before fulfilling certain requests.

We will respond within the period required by applicable law.

The Platform is not intended to knowingly collect personal data from children except where permitted by applicable law and with the required authorisation.

If we learn that we have collected personal data from a child in circumstances where such collection was not permitted, we will take reasonable steps to address the situation.

The Platform may contain links to third-party websites, including travel operators, booking platforms, social-media platforms and other services.

We are not responsible for the privacy practices, security, content or terms of third-party websites.

You should review the applicable third party's privacy policy before providing personal information.

We may update this Privacy Policy from time to time to reflect changes to:

• the Platform
• our services
• our data practices
• technology
• applicable laws
• regulatory requirements

When we make material changes, we will provide appropriate notice where required.

The “Last Updated” date at the beginning of this Policy indicates when it was most recently revised.

For questions, requests or concerns relating to this Privacy Policy:

• [LEGAL COMPANY NAME]
• Trading as Uncharted Travels
• Email: [PRIVACY EMAIL]
• Address: [REGISTERED ADDRESS]
• Country: Kenya

If you are located in Kenya and believe your personal-data rights have been infringed, you may also have the right to lodge a complaint with the Office of the Data Protection Commissioner.

• Office of the Data Protection Commissioner (ODPC)
• Nairobi, Kenya

The ODPC provides a formal complaints mechanism for data subjects.