Data Protection Policy

1. Overview

This Data Protection Policy supplements our Privacy Policy and Cookies Policy. It sets out our internal governance standards and obligations under applicable law.

2. Legal Framework

Luzora's data protection practices are governed by:

• Kenya Data Protection Act, 2019 (DPA 2019) - the primary legislation governing the collection, use, and protection of personal data in Kenya. Administered by the Office of the Data Protection Commissioner (ODPC).
• EU General Data Protection Regulation (GDPR) - applicable to the extent that Luzora processes personal data of individuals in the European Economic Area (EEA).
• UK GDPR - applicable to the extent that Luzora processes personal data of individuals in the United Kingdom.
• Payment Card Industry Data Security Standard (PCI-DSS) - governing the secure handling of payment card data.
• Kenya Revenue Authority (KRA) regulations - governing the retention of financial and transaction records.
• Kenya Employment Act, 2007 - governing the processing of employee personal data.

3. Data Controller

Luzora Travel acts as the data controller for all personal data collected and processed through the luzoratravel.com platform, the customer-facing web application, the partner dashboard, and internal HR and administrative systems.

Where Luzora processes data on behalf of property partners (for example, managing guest records within the partner dashboard), Luzora also acts as a data processor on the property partner's behalf. In these cases, a Data Processing Agreement (DPA) governs the arrangement.

4. Data Protection Principles

All personal data processed by Luzora must comply with the following principles:

5. Categories of Data We Process

6. Lawful Basis for Processing

Under the Kenya DPA 2019 and GDPR, every processing activity must have a lawful basis. Luzora relies on the following bases:

• Contract: Processing necessary to perform or prepare for a contract with you (bookings, account management, HR contracts).
• Legal Obligation: Processing required to comply with a legal obligation (KRA tax records, anti-money laundering requirements, employment law).
• Legitimate Interests: Processing for our legitimate business interests where those interests are not overridden by your rights (platform security, fraud prevention, analytics).
• Consent: Processing based on your specific, informed, and freely given consent (marketing emails, optional analytics cookies). Consent may be withdrawn at any time.
• Vital Interests: Processing necessary to protect life in emergency situations (e.g. sharing location data with emergency services during a travel incident).

7. Data Subject Rights

Individuals whose data we process ("data subjects") have the following rights under the Kenya DPA 2019:

To exercise any right, email support@luzoratravel.com with your full name and the nature of your request. We will verify your identity before processing any request.

8. Data Processing Agreements

Where Luzora engages third parties to process personal data on our behalf, we enter into Data Processing Agreements (DPAs) that require those parties to:

• Process data only on Luzora's documented instructions
• Implement appropriate technical and organisational security measures
• Not sub-process data without Luzora's prior consent
• Delete or return all personal data upon termination of the agreement
• Assist Luzora in fulfilling data subject rights requests and breach notifications

Current data processors include: Render (hosting), Vercel (frontend hosting), Cloudinary (media storage), Resend (email), Stripe, PesaPal, and Safaricom M-Pesa (payments).

9. Cross-Border Data Transfers

Luzora's infrastructure involves international data transfers. Specifically:

• United States: Render (hosting), Vercel (frontend), Stripe (payments), Cloudinary (media)
• European Union: Some Stripe operations are EU-based

For transfers from the EEA or UK to countries without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. For transfers outside Kenya, we apply equivalent safeguards in accordance with the Kenya DPA 2019 requirements.

10. Data Breach Response

In the event of a personal data breach, Luzora will:

• Contain and assess the breach within 24 hours of discovery
• Notify the Office of the Data Protection Commissioner (ODPC) within 72 hours where the breach poses a risk to individuals' rights and freedoms
• Notify affected data subjects without undue delay if the breach is likely to result in a high risk to their rights
• Document all breaches internally, including those not requiring notification
• Take remediation steps to prevent recurrence

If you believe your personal data has been compromised, please notify us immediately at support@luzoratravel.com.

11. Data Protection Impact Assessment (DPIA)

Luzora conducts Data Protection Impact Assessments (DPIAs) before implementing new processing activities that are likely to result in a high risk to individuals. DPIAs are mandatory for:

• Large-scale processing of special categories of data
• Systematic monitoring of publicly accessible areas
• New technologies involving biometric or health data
• Processing that could result in significant financial or social consequences for individuals

12. Special Categories of Data

We treat the following as special categories requiring heightened protection:

• Health and dietary information (collected to facilitate accessibility needs or special meal requests)
• Passport and travel document data (required by some properties and immigration authorities)
• Biometric data (not currently collected; will require explicit consent if introduced)

Special category data is processed only with your explicit consent or where strictly necessary to fulfil a service you have requested.

13. Employee & HR Data

Luzora processes a wide range of HR and employment data through its integrated HRMS platform, including for Luzora staff and, where applicable, property partner employees. This includes:

• Employment records: job title, department, payroll number, contract type
• Payroll data: salary, PAYE tax calculations (Kenya Revenue Authority), NHIF, NSSF deductions
• Leave and attendance records
• Performance reviews and appraisals
• Training and certification records
• Recruitment records (job applications, interview notes)
• National ID and KRA PIN (for tax compliance)
• Bank account details (for payroll payments)
• Emergency contact information

Employee data is processed on the legal bases of contractual necessity (employment contract), legal obligation (tax and employment law), and legitimate interests (workforce management). Employee data is retained for the duration of employment plus 7 years as required by Kenyan employment and tax law.

Employees and property partner staff may exercise all data subject rights listed in Section 7 above.

14. Contact & Complaints

For any data protection queries, subject access requests, or complaints, please contact our team:

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) Kenya at odpc.go.ke.