Data Protection and Privacy Policy
1. Introduction and Regulatory Compliance
Unitouch Tours & Travels is committed to safeguarding your personal information. Our privacy protocols are strictly governed by the Data Protection Act, 2019 of Kenya, and we operate under the principles established by the Office of the Data Protection Commissioner (ODPC).
2. Data Collection and Purpose Limitation
We adhere to data minimization, collecting only what is strictly necessary for explicit and legitimate purposes, such as processing your bookings and securing reservations. This includes your full name, passport or ID details, contact information, and necessary payment records. We will never process sensitive personal data without your explicit, freely given, and informed consent.
3. Data Subject Rights
Under Kenyan law, you retain full autonomy over your data. You possess the right to access, rectify, or demand the erasure of your personal information ("right to be forgotten"). You may also withdraw your consent at any time or object to specific processing activities, such as direct marketing.
4. Data Security, Retention, and Breach Notification
We implement robust technical and organizational measures to protect your data against unauthorized access, accidental loss, or unlawful disclosure. We retain data only for as long as a legitimate business or legal purpose exists. In the unlikely event of a data breach, we are legally mandated to notify the Data Commissioner within 72 hours of becoming aware of the incident.