1. Overview
Your privacy matters to us
Luzora Travel is committed to protecting your personal information. This policy explains clearly what data we collect, why we collect it, and how you can exercise your rights. We comply with the Kenya Data Protection Act 2019 and, where applicable, the EU General Data Protection Regulation (GDPR).
By using the Luzora Travel platform - whether as a traveller booking accommodation, a property partner managing listings, or an employee using our HR tools - you acknowledge the practices described in this policy.
2. Who We Are
Luzora Travel ("Luzora", "we", "us", or "our") is a travel technology company incorporated in Kenya and operating the platform accessible at luzoratravel.com. Luzora acts as the data controller for personal information collected through the platform.
Our platform connects three primary groups of users:
- Travellers / Customers - individuals booking accommodation, flights, transport, and experiences.
- Property Partners - hotels, resorts, and property operators who list and manage properties through our partner dashboard.
- Internal Staff & Luzora Employees - Luzora team members and platform administrators whose data is handled under our HR and employment data policies.
3. Data We Collect
3.1 Data You Provide Directly
When you create an account, make a booking, or contact us, we collect:
- Full name, email address, phone number
- Date of birth and nationality (for booking compliance)
- Passport or national ID details (where required for accommodation check-in)
- Payment information (processed via our secure payment partners - we do not store raw card data)
- Travel preferences, special assistance requirements, and dietary restrictions
- Reviews and ratings you submit
3.2 Data Collected Automatically
When you use our platform we automatically collect:
- IP address and approximate location
- Device type, browser, and operating system
- Pages visited, search queries, and features used
- Session duration and navigation patterns
- Referral sources and marketing attribution data
3.3 Data From Third Parties
We may receive data about you from:
- Google Sign-In: Name, email address, and profile photo when you choose to sign in with Google. We do not receive your Google password.
- Property Partners: Guest information shared to facilitate check-in, special requests, or loyalty programme enrolment.
- Payment Providers: Tokenised payment confirmations (e.g. M-Pesa, Stripe, PesaPal).
- Analytics Providers: Aggregated behavioural data to improve the platform.
3.4 Property Partner & HR Data
For property managers, Luzora HR, and Luzora employees, we also process employment and HR-related data including job title, department, salary, leave records, attendance, payroll, performance reviews, and employment contracts. This data is governed by our internal HR data policies and Kenya employment law.
4. How We Use Your Data
We use your data for the following purposes:
| Purpose | Legal Basis |
|---|---|
| Process bookings, reservations, and payments | Performance of a contract |
| Send booking confirmations, receipts, and pre-arrival information | Performance of a contract |
| Provide customer support and resolve disputes | Legitimate interests |
| Manage your account and authentication (including 2FA) | Performance of a contract |
| Personalise your search results and recommendations | Legitimate interests / Consent |
| Send marketing emails and offers (with your consent) | Consent |
| Detect and prevent fraud, abuse, and security incidents | Legitimate interests / Legal obligation |
| Comply with Kenyan tax, anti-money laundering, and travel regulations | Legal obligation |
| Administer the loyalty points programme | Performance of a contract |
| Conduct analytics and improve the platform | Legitimate interests |
| Process HR and payroll (staff and property partners) | Performance of a contract / Legal obligation |
6. Data Security
We apply multiple layers of security:
- All data in transit is encrypted via TLS 1.2+
- Passwords are hashed using bcrypt - we never store plaintext passwords
- JWT tokens are short-lived (24 hours) with refresh token rotation
- Optional two-factor authentication (TOTP) for all accounts
- Role-based access controls limit staff access to only the data they need
- Payment data is tokenised - raw card numbers never touch our servers
- Regular security reviews and dependency audits
If we become aware of a data breach that poses a risk to your rights, we will notify you and the Office of the Data Protection Commissioner (Kenya) within 72 hours.
7. Data Retention
We retain your data for as long as necessary:
- Active account data: Retained while your account is active plus 2 years after your last activity.
- Booking records: 7 years from the date of booking for accounting, tax, and legal compliance.
- Payment transaction records: 7 years (Kenya Revenue Authority requirements).
- Marketing consent records: Until you withdraw consent, then 1 year thereafter as proof of consent.
- HR and payroll data: Duration of employment plus 7 years per Kenya Employment Act requirements.
- Support conversations: 3 years from closure.
- Deleted accounts: Data is anonymised within 30 days of account deletion, except where retention is legally required.
8. Your Rights
Under the Kenya Data Protection Act 2019 and applicable law, you have the right to:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Ask us to correct inaccurate or incomplete data.
- Erasure: Request deletion of your data where there is no overriding legal reason to retain it.
- Restriction: Ask us to pause processing your data in certain circumstances.
- Portability: Receive your data in a structured, machine-readable format.
- Object: Object to processing based on legitimate interests, including direct marketing.
- Withdraw consent: Withdraw any consent you have given at any time without affecting prior processing.
- Complain: Lodge a complaint with the Office of the Data Protection Commissioner (Kenya) at odpc.go.ke.
To exercise any right, email us at support@luzoratravel.com. We will respond within 30 days. We may need to verify your identity before processing your request.
9. International Data Transfers
Your data may be processed in countries outside Kenya, including the United States (Render, Vercel, Stripe), the European Union, and the United Kingdom. Where data is transferred internationally, we ensure appropriate safeguards are in place, including standard contractual clauses or adequacy decisions.
10. Children
The Luzora platform is intended for users aged 18 and over. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, please contact us immediately and we will delete it promptly.
Bookings that include minors (as guests or travellers) require an adult account holder who takes legal responsibility for the booking.
12. Changes to This Policy
We may update this policy from time to time to reflect changes in law, our practices, or the platform. We will notify you of material changes by email or by posting a notice on the platform. Continued use of Luzora after the effective date constitutes acceptance of the updated policy.
13. Contact Us
If you have any questions about this Privacy Policy or how we handle your data, please contact our team:
Email: support@luzoratravel.com
Address: Westlands Business Park, Nairobi, Kenya