Privacy Policy

1. Who we are

Join Africa is a business-to-business ground travel marketplace and fleet management platform operated by Join Africa Travel Technologies Limited (“Join Africa”, “we”, “us”, “our”), with its office at The Promenade, General Mathenge, Westlands, Nairobi, P.O. Box 63170, Kenya. We connect travel buyers — travel agents, destination management companies (DMCs), tour operators, lodges, hotels and property owners — with vetted transport suppliers across Africa, and we provide Fleet OS, a fleet management system for those suppliers.

Join Africa is the data controller for the personal data described in this policy under the Data Protection Act, 2019 (Kenya) (the “Act”). For any question or request about your data, email info@joinafrica.com.

By using the website you acknowledge that you have read this policy. Read it together with our Terms of Service.

2. Who and what this policy covers

This policy applies to personal data we collect through www.joinafrica.com and its sub-domains (the “Site”) — including the contact, quote, demo and partner-application forms on it — and through our follow-up communication with you by email, phone or WhatsApp. It covers you if you are:

• a Buyer — a business enquiring about, requesting a quote for, or booking ground travel for its clients or guests;
• a Supplier — a transport operator, vehicle owner, driver-guide or tour operator enquiring about listing inventory with Join Africa or using Fleet OS; or
• a visitor browsing the Site.

Once you hold a Platform account, data processed inside the Join Africa booking portal or Fleet OS is governed by this policy together with the Buyer or Supplier Agreement you sign at onboarding. Where a Supplier uploads data about its own drivers or staff into Fleet OS, the Supplier is the controller of that data and Join Africa processes it only on the Supplier’s instructions.

3. Information we collect

We collect the minimum we need to understand your enquiry and respond to it.

Sensitive data. We do not ask for, and you must not send us, special categories of personal data as defined in the Act — health, biometric, genetic, racial or ethnic, religious, political or sexual-orientation data. Accessibility needs for a trip should be described in general terms only.

Other people’s data. If you give us personal data about someone else — a colleague who will own the relationship, a traveller, or a driver on your fleet — you confirm that you are entitled to share it and have told them about this policy.

4. How we use your information, and our lawful basis

We use your information mainly to contact you about your enquiry and to run the marketplace. Each purpose is matched to its lawful basis under section 30 of the Act.

We do not sell your personal data, and we do not make automated decisions about you that have legal or similarly significant effects.

Contact preferences. You can tell us on any form how you prefer to be reached (email, phone or WhatsApp) and we will use that channel first. Change your preference or ask us to stop contacting you at any time by replying to any message or emailing info@joinafrica.com.

5. Who we share your information with

We share personal data only where it is needed to respond to you, deliver a booking or run the business — never for anyone else’s marketing.

• Between Buyers and Suppliers. To fulfil a confirmed booking we share the Buyer’s (or travelling guest’s) name, pickup details and a contact number with the Supplier assigned to the trip, and the assigned vehicle and driver details with the Buyer. We do not disclose a Buyer’s identity to Suppliers at enquiry or quote stage, nor a Supplier’s identity to Buyers until a booking is assigned.
• Service providers acting on our instructions. Google Cloud (hosting), PostHog and Firebase Analytics (usage analytics), our email, CRM and WhatsApp messaging tools, and Bokun (channel manager for inventory distribution). Each is bound by contract to process data only as we instruct.
• Payment providers. Paystack (Pty) Ltd and Stripe collect Buyer payments, and Verto processes Supplier payouts. Each acts as an independent controller of the payment data it handles under its own privacy policy. Join Africa never receives or stores full card numbers or bank credentials — only the confirmation data needed to record the transaction.
• Professional advisers — lawyers, accountants and auditors, under confidentiality.
• Authorities — where the law requires it: the Kenya Revenue Authority, the Office of the Data Protection Commissioner (ODPC), courts, or law enforcement acting under a lawful order.
• A successor business. If Join Africa is acquired, merges or sells a material part of its assets, your data may transfer to the successor under the same protections, and we will tell you by email or a notice on the Site.

6. International transfers

Join Africa is based in Kenya and serves Buyers and Suppliers across Africa and abroad. Some providers above store data outside Kenya, including in the European Union, the United Kingdom and the United States. Where we transfer personal data out of Kenya we rely on section 48 of the Act: a destination with adequate safeguards, contractual clauses with the recipient in the form approved by the ODPC, your explicit consent, or necessity to perform a contract with you — for example confirming a booking with an international agent. Ask info@joinafrica.com which safeguard applies to a particular transfer.

7. How long we keep your information

We delete or anonymise data when its period ends unless the law requires us to keep it longer or a dispute is open.

8. How we protect your information

We use HTTPS across the Site, encrypt data in transit and at rest on Google Cloud, restrict internal access to staff who need it for their role, and log access to booking and payment records. Card details go directly to Paystack or Stripe and never touch our servers. No system is completely secure. If a breach is likely to put your rights at risk we will notify the ODPC within 72 hours and tell you without undue delay, as section 43 of the Act requires.

9. Cookies and analytics

The Site uses strictly necessary cookies so that pages and forms work, and — only if you accept them in the cookie banner — PostHog and Firebase Analytics to understand how the Site is used. We do not use advertising cookies. You can change or withdraw your choice at any time through the cookie settings link in the footer or by clearing cookies in your browser; the Site will still work.

10. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be told how we use your data (this policy);
• access a copy of the personal data we hold about you;
• correct data that is inaccurate or incomplete;
• delete your data where we no longer have a lawful reason to keep it;
• object to processing based on legitimate interests, including direct marketing — we stop marketing to you immediately on request;
• restrict processing while a question about accuracy or lawfulness is resolved;
• withdraw consent at any time, without affecting processing done before you withdrew it; and
• port data you gave us to another provider in a machine-readable format where processing rests on consent or contract.

If you are in the European Economic Area or the United Kingdom you have the equivalent rights under the GDPR and UK GDPR, and you may complain to your local supervisory authority as well as to the ODPC.

To exercise a right, email info@joinafrica.com. We will verify your identity, respond within the time the Act requires and in any case within 30 days, and will not charge you unless a request is clearly unfounded or excessive. If you are unhappy with our response you may complain to the Office of the Data Protection Commissioner, Kenya at complaints@odpc.go.ke or www.odpc.go.ke.

11. Children

The Site and our services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. Guest details a Buyer shares for a booking (for example a child-seat request) are used only to deliver that booking. If you believe we hold a child’s data, email info@joinafrica.com and we will delete it.

12. Links to other sites

The Site may link to Supplier websites, partner booking platforms and social media. Their privacy practices are their own — read their policies before sharing data with them.

13. Changes to this policy

We will post any change on this page and update the “Last updated” date. If a change materially affects how we use data you have already given us, we will email you or show a notice on the Site before it takes effect. Continuing to use the Site after that date means you accept the revised policy.

14. Contact us