Privacy Policy
Effective 3 October 2026 · Last updated 3 October 2026
TwendeTrips (twendetrips.com) is an online marketplace based in Nairobi, Kenya, where independent trip leaders list group trips and travellers book and pay for them. In this policy, “TwendeTrips”, “we”, “us” and “our” mean Twyenova Limited, the company that runs twendetrips.com (a company registered in Kenya (company number PVT-ZE1AMOP6)). For the purposes of Kenya's Data Protection Act, 2019, we are the data controller of the personal data described here.
This policy explains what personal information we collect, how we use it, who we share it with, how long we keep it, and the rights you have. It applies to travellers, trip leaders and anyone who visits the site.
1. Information we collect
1.1 What you give us
Your account. Your full name, email address and phone number (with country code). You sign in with a password, which we never see because our sign-in provider stores only a one-way scrambled version of it, or with Google, in which case we receive your name and email from Google. A profile photo is optional for travellers and required for trip leaders.
When you book a trip. The trip, how many spots, the price category you choose (citizen, resident or non-resident), add-ons, whether you skip included transport, whether you pay a deposit and when the balance is due, an emergency contact (their name and phone number), your acceptance of any waiver and when you accepted it, and the referral link you arrived through, if any.
Payments. Payments are taken by Paystack, or by M-PESA (Safaricom) when you pay with an M-PESA request on your phone. For an M-PESA request we send your phone number and the amount to Safaricom so it can send the request to your phone, and we receive the result (paid or not, the M-PESA receipt number). We receive the result of each payment (success or failure, amount, a reference and the type of payment method) so we can confirm your booking and process refunds, and an M-PESA payment is refunded to the same phone. We never receive or store your full card number, card security code or M-Pesa PIN.
Things you write and choose. Messages in the chat with your trip leader (available once you have booked), your travel profile (home town, languages, interests, travel style and places you have been, all optional, shown only to travellers booked on the same trip as you and on your own Find a Buddy posts), a private gender that is used only for the women-only choice and is never shown to anyone, messages in the group chat of a trip you have booked, photos you add as memories of a trip you went on, the leaders you follow, reviews, Find a Buddy posts (destination, dates and a note), the messages you send to a buddy post's author, trip requests, waitlist sign-ups, and the trips you save or watch.
When you contact support. Your name and email, what you tell us, any booking or trip you attach, and our replies. Members of our support team can see your bookings and disputes so they can help, and they write private notes about a request that you cannot see. A request is reached by a private link we email you. We keep it for 24 months after it is resolved.
If you contact us. Your name, email address and the content of your message.
1.2 What trip leaders also give us
- Trip listings: descriptions, photos, itineraries, meeting points, prices, add-ons, rules and cancellation policy.
- Payout details: your payout method and the M-Pesa number, Till number, or bank name and account number we should pay you at.
- Identity verification: whether you use a national ID, a driving licence or a passport, your full name, phone number and ID number, photos of the ID (front and back for a national ID), a selfie, and a TRA licence number if you choose to provide one. Section 3 explains how this is used.
- Company verification, if you sign up as a company: the registered company name and any brand name, the registration number, the KRA PIN, the Tourism Regulatory Authority licence number and expiry date, a contact person's name and phone number, and copies of the registration certificate, the KRA PIN certificate and the licence. Only our team can see them. They are not shown to the public, and we keep them for as long as the company has an account with us and as the law requires.
- Referral settings, if you offer a discount to travellers you refer.
1.3 What we collect automatically
- Standard technical information any website receives: your IP address, browser and device type, and the pages you request. Our hosting provider keeps this in server logs.
- Analytics, only if you accept analytics cookies (see Section 9): which pages are visited and how the site is used, through Google Analytics.
- Anonymous trip counts: each trip keeps a daily total of how many times its page was viewed and saved. These totals are not linked to you and let leaders see how their trip is doing. A leader's own visits are not counted. If a leader shares a trip with a labelled link, such as one marked for WhatsApp status, that label is counted with the visit and kept on a booking made after it. It says where the link was shared, not who you are.
- Location: if you tap “near me”, your browser shares your position with the page to sort trips by distance. That position stays in your browser and is not sent to or stored by us.
- Place names: when a leader types a destination, the place name is sent to the OpenStreetMap geocoding service to find its map coordinates.
1.4 From other services
Google (if you use Google sign-in), Paystack and Safaricom M-PESA (payment, refund and payout results), and OpenAI (the result of the automated reading of an ID photo, described in Section 3).
2. How we use your information
We only use personal data where the Data Protection Act, 2019 allows it. The right-hand column shows which reason applies to each use.
| What we do | Information used | Why we may |
|---|---|---|
| Create and secure your account, sign you in | Account details | To perform our contract with you |
| Process bookings, hold payments in escrow, issue refunds, pay leaders | Booking, payment and payout details | To perform our contract with you |
| Remember a card you chose to save, so it shows under Payments and payouts | A token from Paystack, the card brand, last 4 digits and expiry (never the full number) | Your consent: only when you tick Remember my card, and you can remove it at any time |
| Let leaders run the trip: attendee list, reminders, emergency contact | Booking details, emergency contact | To perform our contract with you; to protect someone's life or safety in an emergency |
| Verify trip leaders so travellers know a real person is accountable | Verification data | Our legitimate interest in safety and preventing fraud; your consent for the face comparison |
| Send emails and notifications about your bookings, reminders, balance due, review requests and alerts for trips you saved | Contact details, booking and saved-trip data | To perform our contract with you; our legitimate interest in running the service |
| Keep the platform safe, investigate abuse, resolve disputes | Messages, logs, reports, booking records | Our legitimate interest in safety and fraud prevention |
| Understand how the site is used and improve it | Analytics data; anonymous trip counts | Your consent (analytics cookies); our legitimate interest (anonymous counts) |
| Keep records and respond to lawful requests | Transaction and account records | To comply with the law |
We do not sell your personal data. We do not send marketing emails today. If that ever changes, we will only do it with your consent and you will be able to opt out.
3. Identity verification, face comparison and automated decisions
Every trip leader must be verified before they can list a trip. This is the part of TwendeTrips that handles the most sensitive information, so here is exactly what happens.
- You upload photos of your ID and a selfie. They go into private storage that is not publicly accessible. No other user ever sees them.
- An automated tool reads the name and ID number from your ID photo and checks them against what you typed. It also compares your selfie with the photo on your ID to judge whether it is the same person. We use OpenAI's service to do this and send it only the images needed for the check.
- The automated checks only prepare a recommendation. A person on our team reads every identity verification and makes the decision before anyone is approved. If anything does not match, the reviewer looks closer or asks you for more. Only authorised TwendeTrips staff can open the ID photos and selfie, and only for this review.
- Face comparison is an automated opinion, not a precise biometric measurement, and it can be wrong. If a decision about your verification looks wrong to you, email us and a person will review it.
- A face image is sensitive personal data. We ask for your explicit consent before you submit, and we use the images only to check that you are the person on the ID. We do not build a database of faces or use them for anything else. You can withdraw consent at any time, but then we can no longer verify you and you will not be able to list trips.
Verification confirms who a leader is. It does not mean we have inspected a trip, a vehicle, a guide's qualifications or the leader's licences or insurance.
4. What other people can see
Travellers see about leaders: name, profile photo, verification badge and tier, their trips, ratings and reviews. Payout details and identity documents are never shown.
Leaders see about travellers who book their trip: name, phone number, emergency contact name and phone number, number of spots, price category, whether they skipped transport, deposit or balance status, and check-in. A leader also sees the name and phone number of people who join the waitlist for their trip. Leaders receive this so they can run the trip safely and contact you. They may use it only for that trip (see our Terms).
Everyone can see: your name on a review you write, and Find a Buddy posts and open trip requests (destination, dates and your note). Your email address is not shown on a buddy post. When you message a post's author, we relay your message by email and your email address goes to them so they can reply.
Vehicle hire: when you ask a vehicle owner for a quote, the owner (and only that owner) sees your name, phone number, optional email, route, dates, number of people and note. A listed vehicle business is public: its name, logo, description, base town, areas served and vehicles. The owner's own phone number and licence notes are never shown publicly. Only that owner and our admins can read them. When an owner sends you a quote, you then see their business phone number so you can reach them. Reviews of vehicle owners show your first name, your rating and your comment.
Chat: messages are visible only to the two people in the conversation, and chat with a leader opens once you have booked.
Your email address, password, payment details and identity documents are never shown to other users.
6. Sending data outside Kenya
Some of the services in Section 5 process data outside Kenya, including in Germany, South Africa and the United States. When we use them we send only what is needed, and we rely on the commitments those providers make about protecting data. Identity documents are stored in Germany and are sent to OpenAI only for the verification check in Section 3. By using TwendeTrips, and by agreeing to the verification consent where it applies, you accept these transfers.
7. How long we keep your information
| Information | How long we keep it |
|---|---|
| Account details and profile | While your account exists, and for up to 30 days after you ask us to delete it |
| Bookings, payments, refunds and payouts | Up to 7 years, because tax and accounting law requires us to keep financial records |
| Identity documents and selfie | While you remain a leader, and for up to 3 years after your last trip, then deleted |
| Photos from an identity check that was declined | 30 days after the decision, then deleted. The decision itself is kept |
| Emergency contact details | With the booking record, then deleted within 12 months of the trip ending |
| Chat messages | While your account exists, and for up to 30 days after deletion |
| Trip group chat messages | 12 months after the trip ended, then deleted. Messages from a deleted account are removed with it |
| Travel profile and places travelled | While your account exists, and for up to 30 days after you ask us to delete it |
| Trip memory photos | While the trip is listed, until you remove them, or until you delete your account |
| Support requests and our replies | 24 months after the request was resolved, then deleted. Private notes our team wrote are deleted with it |
| Reviews | While the trip is listed. If you delete your account, your name on a review is removed |
| Find a Buddy posts, trip requests, waitlist and saved trips | Until you remove them or delete your account |
| Anonymous trip view and save totals | As long as the trip exists. They are not linked to anyone |
| Server logs | A short period set by our hosting provider, typically days to a few weeks |
When a period ends, or you ask us to delete your data, we delete or anonymise it. Records we must keep by law are kept in minimal form and used only for that purpose.
8. Your rights
Under the Data Protection Act, 2019, you have the right to:
- Be told what personal data we hold about you, and get a copy, including in a common electronic format you can take elsewhere.
- Correct information that is wrong or out of date. You can change most of your details yourself in your profile.
- Ask us to delete your data, or to restrict how we use it.
- Object to us using your data for a purpose you disagree with. We will stop unless we have a legal reason to continue.
- Withdraw consent you gave us, for example for analytics cookies (Section 9) or face comparison (Section 3).
- Not be subject to a decision made only by automated means that significantly affects you, and ask for a person to review it.
How to use your rights. Email support@twendetrips.com. To delete your account, send the request from the email address on the account. We may ask you to confirm who you are before we act, to stop someone else getting your data. We will reply as soon as we can and within 30 days.
Complaints. If you are unhappy with how we handled your data, please tell us first so we can put it right. You also have the right to complain to the Office of the Data Protection Commissioner of Kenya (odpc.go.ke).
10. Keeping your information safe
- Everything travels over encrypted connections (HTTPS).
- Passwords are stored only as one-way scrambles. We cannot read them.
- Identity documents sit in private storage that only authorised staff can open.
- The database is configured so people can only read the records that belong to them, or that they are allowed to see because of their role.
- Payments and payouts are handled by Paystack and Safaricom M-PESA, so card numbers and PINs never reach us.
No online service is perfectly secure. Please use a strong, unique password and tell us straight away at support@twendetrips.com if you think your account has been misused. If a breach affects your personal data, we will tell the Data Protection Commissioner and the people affected as the law requires.
11. Children
TwendeTrips accounts are for people aged 18 and over. We do not knowingly collect personal data directly from anyone under 18, and if we find we have, we will delete it. If you are an adult booking a trip that includes a child in your care, you are responsible for the child, and you should share only what the leader needs to look after them. If you think a child has made an account, email support@twendetrips.com.
12. Other websites
Trips can link to outside sites, such as a leader's route map. This policy does not cover them, so please read their policies.
13. Changes to this policy
We update this policy when we add features that change how we handle data, when the law changes, or when our service providers change. We will change the “Last updated” date above, and for significant changes we will email registered users before they take effect. Earlier versions are available on request.
14. Contact us
Questions, data requests or concerns: support@twendetrips.com. Phone: 0184 131 112. TwendeTrips is operated by Twyenova Limited (company number PVT-ZE1AMOP6). Office: Coral Bells, Thindigua, Kiambu Road. Post: P.O. Box 2793-00100, Nairobi, Kenya.