Privacy Policy
This policy covers the public website safarimarketplace.app and the Safari Marketplace portal at portal.safarimarketplace.app. It says what each of them collects, why, who else receives it, how long it is kept and what you can ask us to do with it.
Who is responsible
Safari Marketplace is owned and provided by WTA Safari Marketplace Kenya Limited, a private limited company incorporated in Kenya under company number PVT-3B1M7DR9, Pramukh Towers, 52 Westlands Road, Westlands, Nairobi 00800, Kenya (“we”, “us”). It is the controller of the personal data described here.
The website and the portal are operated on our behalf by WTA Technology Services s.r.o., company ID 06982891, Kaprova 42/14, Staré Město, 110 00 Prague 1, Czech Republic, registered in the commercial register kept by the Municipal Court in Prague, file C 292539. It processes personal data only on our instructions, under a data processing agreement, and it is also our representative in the European Union under Article 27 GDPR: you and data protection authorities can address it on any question about this policy.
Write to us or to our representative at info@safarimarketplace.app. We have not appointed a data protection officer; that address reaches the people who handle privacy requests.
What this policy covers
It covers two places. The website, safarimarketplace.app, presents the platform and has a contact form; nothing is bought or booked on it, and it has no accounts. The portal, portal.safarimarketplace.app, is where you create a Safari Marketplace account, sign in and open the parts of the platform your account has access to.
Sign-in and accounts are run by our identity service (auth-api) together with Microsoft Entra External ID, the directory that holds the accounts. Both are ours to operate and are covered here.
When an organisation uses the platform's modules to work with data about other people — its clients, travellers or staff — that organisation is the controller of that data and we process it on its behalf, as its processor, under the data processing terms we agree with it. People whose data an organisation keeps on the platform should contact that organisation first; we will help it answer.
What we collect and where it comes from
Creating an account with an e-mail address and password
The sign-up form asks for your first name, last name, e-mail address and a password. To confirm the address, Microsoft Entra External ID sends a one-time passcode to it, which you type into the form.
Your password goes from the portal's form to auth-api and on to Microsoft Entra External ID, which keeps it as your sign-in credential. The portal and auth-api handle it only for the request that needs it: neither stores it, logs it or shows it back.
A second sign-in step
If you set up a second sign-in step, you choose to receive a passcode by e-mail or by text message. For text messages we keep your mobile number in Microsoft Entra External ID as a sign-in method. Microsoft Entra External ID sends the passcodes; we do not keep them.
Signing in with Google
We ask Google only for the scopes openid, email and profile. From what Google returns we use your Google account identifier, your name and your e-mail address, the e-mail address only when Google marks it as verified. We do not request access to Gmail, Google Drive, Google Calendar, your contacts or any other Google data, we do not request your profile picture, and we do not store Google access or refresh tokens.
Signing in with Facebook
We ask Facebook only for the permissions public_profile and email. We use the identifier Facebook assigns you for our app, your first and last name and, if Facebook shares it, your e-mail address. Facebook's access token is used once to read these details and is not stored. We do not read your friends, posts, photos or pages.
Signing in with Apple
Sign in with Apple runs through Microsoft Entra External ID's Apple connection. Apple shares an identifier for your Apple account and, the first time you sign in, the name and e-mail address you choose to share. If you choose to hide your e-mail address, Apple gives us a private relay address that forwards to you.
Signing in with Microsoft
You can sign in with a work or school account that an organisation manages in Microsoft Entra ID; personal Microsoft accounts are not accepted. Platform staff sign in the same way. We ask Microsoft only for the scopes openid, email and profile. We use the identifiers of your account and of your organisation's directory, your name and your e-mail address, the e-mail address only when Microsoft confirms that your organisation owns its domain. Microsoft's tokens are used once to read these details and are not stored. We do not read your mail, files, calendar or any other Microsoft 365 data.
What we keep about your account
Whichever way you sign up, Microsoft Entra External ID holds your directory profile: your name, your e-mail address, the sign-in methods linked to it (the identifier of your Google, Facebook, Apple or Microsoft account) and, if you added one, your mobile number. The names you type into the sign-up form take precedence over the names a provider sends.
auth-api keeps, in its own database:
- an account identifier and the account's status;
- the identifiers of the sign-in identities linked to the account, and when each was linked or removed;
- your memberships of organisations on the platform and the roles they give you;
- the version of the Terms of Service you accepted when you signed up, when you accepted it, and whether you agreed to marketing messages, if you were asked;
- a security record of events on the account, such as its creation, sign-out, a password change, a second sign-in step being turned on or off, and an identity being linked: the type of event, the account, the application and the time. It does not contain your IP address or browser details;
- while a sign-in with Google, Apple, Facebook or Microsoft is in progress, a record of it, for at most ten minutes. It holds the names you typed, never your e-mail address.
The database holds no password, no passcode and no Google, Apple or Facebook token.
The website's contact form
The form asks for your name, your work e-mail address, which kind of business you are, which of the two companies you are writing to, and your message, and optionally for the name of your organisation. It is sent only once you have ticked that you agree to this processing. It is delivered as an e-mail through Microsoft 365 to the mailbox of the company you chose, info@safarimarketplace.app for WTA Safari Marketplace Kenya Limited or info@wta-technology-services.com for WTA Technology Services s.r.o., with your address set as the one to reply to. The website itself stores nothing about a submission. To check that the address can receive mail, the server looks up the mail servers of its domain. To stop abuse, the server counts submissions per IP address in memory, at most five in fifteen minutes; the count disappears when the server restarts.
Bot protection
The website's contact form and the portal's sign-in and sign-up forms are protected by Cloudflare Turnstile, which establishes that a submission comes from a person rather than a script. It runs in Invisible mode: the check takes place in the background without displaying a widget or asking you to click a checkbox. To distinguish human submissions from automated traffic, Cloudflare receives your IP address and information about your browser, and our server asks Cloudflare to confirm the result. For the contact form the server also sends Cloudflare your IP address. Your password and your registration details are never sent to Cloudflare.
Fonts
The website and the portal serve their typefaces themselves. Loading a page sends no request to a font provider.
Operational logs
The website, the portal and auth-api write technical logs to Microsoft Azure Monitor so that we can run them and find faults: errors, which operation was called, its outcome and how long it took. A log line can contain an account identifier. We do not log passwords, passcodes, tokens or cookies, and our applications do not record your IP address in these logs. Microsoft Azure, which hosts them, may record technical request data, including IP addresses, in its own platform logs to deliver the service and protect it from abuse. Our log workspaces keep entries for 30 days.
Neither the website nor the portal uses analytics, advertising or tracking technology.
Why we use it and on what legal basis
- Creating and running your account, and signing you in (account data, sign-in identities, session cookies): necessary to provide the service you ask for under the Terms of Service, Article 6(1)(b) GDPR.
- Keeping accounts and the service secure (bot protection, the security record, a second sign-in step, operational logs): our legitimate interest in preventing abuse, fraud and unauthorised access, Article 6(1)(f) GDPR.
- Recording which terms you accepted: necessary for the contract, and our legitimate interest in being able to show what was agreed, Article 6(1)(b) and (f) GDPR.
- Answering a message sent through the contact form: our legitimate interest in replying to enquiries, or steps you asked for before entering into a contract with us, Article 6(1)(f) or (b) GDPR.
- Meeting legal obligations, where a specific law requires us to keep or disclose data, Article 6(1)(c) GDPR.
Where we rely on our legitimate interests, you can object to the processing at any time (section 10).
Accepting the Terms of Service is not consent to marketing. The sign-up forms do not ask for marketing consent and we do not send marketing messages. If that changes, we will ask for your consent separately first.
Information received from Google
Safari Marketplace's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements.
We use the information Google shares — your Google account identifier, name and verified e-mail address — only to sign you in and to create and maintain your Safari Marketplace account. We do not sell it, we do not use or transfer it for advertising, and we do not use it to develop, improve or train artificial-intelligence or machine-learning models. People at Safari Marketplace do not read it, except with your agreement, where it is needed for security purposes such as investigating abuse, to comply with the law, or where the data has been aggregated and anonymised for internal operations.
Who receives it
WTA Technology Services s.r.o. operates the website and the portal for us, as section 1 describes. It and we use these providers:
- Microsoft (Microsoft Ireland Operations Limited) — hosts the website, the portal, auth-api and its database on Microsoft Azure in the West Europe region; runs Microsoft Entra External ID, the directory that holds the accounts, with its data location set to Europe; and delivers the contact form's e-mails through Microsoft 365. Microsoft processes this data on our behalf under its data protection terms.
- Cloudflare (Cloudflare, Inc.) — bot protection on the forms (Turnstile) and the domain name service for safarimarketplace.app, on our behalf under its data processing addendum.
- Google, Meta and Apple (Google Ireland Limited, Meta Platforms Ireland Limited, Apple Distribution International Limited) — when you choose to sign in with one of them, it authenticates you and learns that you signed in to Safari Marketplace. Each acts as an independent controller of your account with it, under its own privacy policy.
We do not sell personal data, and we do not share it with advertisers. We disclose it to authorities only where the law requires us to.
Transfers outside the EEA
Our systems run in Microsoft Azure's West Europe region, and the account directory keeps its data in Europe. Two kinds of transfer leave the European Economic Area:
- To us in Kenya. WTA Safari Marketplace Kenya Limited directs the service from Kenya and can access the data our operator processes in Europe. The European Commission has not found that Kenya ensures an adequate level of protection, so these transfers are covered by the European Commission's standard contractual clauses between WTA Technology Services s.r.o. and WTA Safari Marketplace Kenya Limited. In Kenya the data is also protected by the Data Protection Act, 2019.
- To providers in the United States. Cloudflare, for bot protection and name resolution, and Microsoft, Google, Meta and Apple, for parts of their services, process data there or through their parent companies. These transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework, under which these companies are certified, and otherwise on standard contractual clauses in the providers' data processing terms.
You can ask for a copy of the safeguards at info@safarimarketplace.app.
How long we keep it
Table: how long we keep each kind of data
Where a law requires us to keep a record for longer, for example accounting records for a paid plan, we keep that record for the period the law sets.
Your rights
Under the GDPR you can ask us for access to your personal data, for its correction or erasure, to restrict its processing, and to receive it in a portable format. You can object to processing based on our legitimate interests. Where processing relies on your consent, you can withdraw it at any time; that does not affect processing that took place before.
Write to info@safarimarketplace.app and tell us which right you want to use. We may ask for information to confirm that the request comes from you. We answer within one month; where a request is complex we can extend that by two further months, and we tell you within the first month if we do.
You can complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz (opens in a new tab)), where our EU representative is established, to the supervisory authority where you live or work, or to the Office of the Data Protection Commissioner in Kenya (odpc.go.ke (opens in a new tab)). You do not have to contact us first.
Deleting your account and data
To have your Safari Marketplace account deleted, together with the data we received from Google, Facebook or Apple when you signed in with them:
- Send an e-mail to info@safarimarketplace.app with the subject “Delete my account”, from the e-mail address of your account. If you signed in with Facebook or Apple and are not sure which address we have, say which provider you used.
- We confirm the request and that it comes from you, then close the account, delete your directory profile — your name, e-mail address, mobile number and linked sign-in identities — and remove the data the provider shared with us.
- We confirm the deletion by e-mail within 30 days of your request.
We keep only what we must: the security record of account events, which refers to the account identifier and not to your name or address, for the period in section 9, and records a law requires us to keep.
You can also stop Safari Marketplace from using your Google, Facebook or Apple account at any time. That prevents further sign-ins with that provider; it does not delete the data we already hold, so send the request above as well if you want that deleted.
- Google: open your Google Account's third-party connections (opens in a new tab), choose Safari Marketplace and remove its access.
- Facebook: go to Settings & privacy > Settings > Apps and websites, or open Apps and websites (opens in a new tab), and remove Safari Marketplace.
- Apple: on your iPhone, iPad or Mac open Settings > your name > Sign in with Apple, or sign in at account.apple.com (opens in a new tab), choose Safari Marketplace and stop using Sign in with Apple.
Automated decisions
Neither the website nor the portal makes decisions about you based solely on automated processing that have legal or similarly significant effects. The one automated check is Cloudflare's bot protection on the forms; if it stops you from submitting a form, write to info@safarimarketplace.app and a person will look at it.
Children
Safari Marketplace is a service for businesses in the safari industry and is not directed at children. You must be at least 18 years old to create an account, and we do not knowingly collect data from anyone younger.
Changes to this policy
We publish every change on this page with a new effective date. If a change affects how we use the data of account holders, we tell them by e-mail at least 30 days before it takes effect, and before we use personal data for any new purpose.
Effective date: 7 October 2026
| Data | Where | How long |
|---|---|---|
| Session | Portal | Until you sign out, at most 12 hours |
| A sign-in with a provider in progress | auth-api | At most 10 minutes |
| Account, linked identities, memberships, accepted terms | auth-api | While the account exists; deleted within 30 days after it is closed |
| Directory profile: name, e-mail address, mobile number, sign-in methods | Microsoft Entra External ID | While the account exists; deleted within 30 days after it is closed |
| Security record of account events | auth-api | 3 years after the event, to investigate abuse and defend legal claims |
| Contact form messages | The chosen company's mailbox | 2 years after the last message in the conversation, unless they lead to a contract |
| Operational logs | Azure Monitor | 30 days |
| Contact form submission count per IP address | Website server memory | Until the server restarts |