This Privacy Policy explains how M‑Talii handles personal data when you browse, create an account, build a trip, make a booking, contact support or supply travel services through our marketplace.
1. Who is responsible for your data?
M‑Talii is the data controller for information collected through this platform, except where an identified travel supplier or payment provider processes information for its own purposes. M‑Talii is operated by Tri-Ace Solutions Limited, a private limited company incorporated in Kenya on 29 March 2023 under the Companies Act 2015. Registered office: Pride Towers, Woodvale Groove, Westlands, Nairobi, Kenya. Postal address: P.O. Box 51969–00200, City Square, Nairobi.
Privacy enquiries and rights requests may be sent to [email protected] or through our contact page.
2. Information we collect
Account and contact
Name, email, telephone, country, sign-in details, language and currency.
Travellers and bookings
Destinations, dates, traveller details, children’s ages, itinerary, services and special requests.
Transactions
Amount, currency, status, receipt and provider references. Payment providers handle full card or mobile-money credentials.
Vendors
Business contacts, licences, verification documents, inventory, calendars, prices and payout details.
Communications
Support requests, feedback, booking messages and communication preferences.
Device and usage
IP address, browser, device, approximate location, cookie choices, security events and logs.
If you book for another adult or a child, you confirm you are authorised to provide their details and will make this policy available to them or their guardian.
3. Why we use personal data
| Purpose | Typical data | Basis |
|---|---|---|
| Search, quote, reserve and manage trips | Contact, traveller, itinerary and booking data | Requested steps and booking contract |
| Payments, refunds and receipts | Transaction and booking data | Contract and legal obligations |
| Connect you with selected suppliers | Details needed to fulfil each service | Contract |
| Accounts, support and vendor operations | Account, communications and vendor data | Contract and legitimate operational interests |
| Fraud and security prevention | Account, transaction, device and security data | Legal obligations and legitimate security interests |
| Tax, accounting and lawful requests | Booking, transaction, identity or vendor data | Legal obligations |
| Platform analytics and improvement | Usage, diagnostics and feedback | Consent where required, or legitimate interests for essential analytics |
| Optional marketing | Contact and preferences | Consent, withdrawable at any time |
4. When we share information
- Selected suppliers: hotels, hosts, airlines, vehicle operators, guides, events and boats need relevant details to confirm and deliver services.
- Payment and payout providers: to authorise transactions, prevent fraud, refund travellers and pay vendors.
- Service providers: hosting, communications, support, maps, analytics, verification and security providers operating under suitable terms.
- Authorities and advisers: where lawfully required or necessary to protect travellers, suppliers, M‑Talii or others.
- A successor: during a merger, financing, reorganisation or sale, subject to confidentiality and lawful processing.
Suppliers identified in a booking may act as independent controllers and their own notices can apply.
5. Cross-border transfers
East African trips can involve suppliers and systems in several countries. M‑Talii will use applicable transfer mechanisms and reasonable contractual, organisational and technical safeguards, and seek explicit consent where required.
6. Retention
We keep data only as long as necessary for booking, account, legal, tax, accounting, dispute and fraud-prevention purposes. Account data remains while active and for a limited closure period; booking and transaction records follow legal retention periods; abandoned plans expire after reasonable inactivity; support and security records remain as needed for resolution and claims. At the end, data is deleted, anonymised or isolated.
7. Your rights
Subject to applicable law, you may request information, access, correction, deletion, objection, restriction, portability, consent withdrawal, or human review of a significant solely automated decision.
- Email [email protected] from your account address or use the contact form.
- Describe the request and relevant booking or account. Never send a password or full payment credential.
- We may verify identity and authority. We will explain any lawful limitation.
You may complain to Kenya’s Office of the Data Protection Commissioner, Tanzania’s Personal Data Protection Commission, or the regulator where you live.
8. Children and family bookings
M‑Talii is intended for adults. A parent, guardian or authorised adult may provide a child’s age and travel details for a family trip. We use these only to price, reserve, safeguard and deliver services. Children must not create vendor accounts or independently submit payment details.
9. Security
We use proportionate access controls, encryption in transit, payment-provider controls, logging, backups, vendor verification and staff procedures. No online system is risk-free. Use a unique password and report suspected unauthorised activity promptly.
10. Cookies
Essential cookies operate security, sign-in, language, currency, cart and booking functions. Optional technologies are described in our Cookie Policy.
11. Updates and contact
Material changes will be highlighted and the effective date revised. Contact [email protected].
Manage your privacy
Review cookie choices or contact our privacy team.
