1. Who we are and how to contact us

Shah Tours and Travels Ltd is a tour operator based at 8 (Plot 6) Sekou Toure Road, Shanty Town, Moshi, P.O. Box 1821, Tanzania. For the personal data covered by this notice, Shah Tours generally acts as the data controller because we determine why and how that data is processed.

Privacy and data-subject requests may be sent to our Data Protection Officer at info@shah-tours.com or delivered to our physical or postal address above. To protect personal data, we may ask for reasonable information to verify the identity and authority of a requester.

2. Legal framework and our principles

We process personal data in accordance with the Personal Data Protection Act, Chapter 44 (Act No. 11 of 2022) and the Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C), together with other applicable Tanzanian laws.

In accordance with section 5 of the Act and regulations 23 to 31, we seek to ensure that personal data is:
• processed lawfully, fairly and transparently;
• collected for explicit, specified and legitimate purposes and not used incompatibly with those purposes;
• adequate, relevant and limited to what is necessary;
• accurate and corrected or updated where necessary;
• retained in identifiable form only for as long as necessary or legally required;
• processed with respect for data-subject rights;
• protected by appropriate technical and organisational safeguards; and
• transferred outside Tanzania only in accordance with applicable legal requirements.

3. Personal data we may collect

The information we collect depends on the enquiry, booking, journey, employment or business relationship. It may include:
• Identity and contact data: name, title, date of birth, nationality, address, email, telephone number and emergency contact details.
• Travel and identification data: passport or identification details and copies, visa and permit information, arrival and departure details, accommodation, itinerary and rooming information.
• Booking and financial data: quotations, bookings, invoices, payment status, transaction references and limited payment information. Payment providers may process card or banking data under their own security and privacy terms.
• Health and accessibility data: medical conditions, allergies, dietary needs, medication, fitness, disability, evacuation information and insurance details where relevant to safety or service delivery.
• Children's data: age, identity, passport and travel information, health or dietary information and parent or guardian details where a minor participates in a journey.
• Communication and preference data: enquiries, correspondence, feedback, complaints, interests, language, rooming, meal and activity preferences and marketing choices.
• Photographs, video and testimonials where captured or supplied lawfully and used with an appropriate legal basis or permission.
• Website and technical data: IP address, browser and device information, approximate location, website usage, cookie identifiers and security logs.
• Employee, applicant, crew, supplier and partner data needed for recruitment, contracts, payroll, compliance, safety and relationship management.

4. How we collect personal data

• Directly from you through our website, email, telephone, WhatsApp, forms, booking records, payments, surveys and in-person contact.
• From a person arranging travel for you, a family member, group leader, travel agent, international or Tanzanian tour operator, employer or other authorised representative.
• From suppliers and authorities involved in a booking, such as accommodation providers, transport providers, activity operators, protected-area authorities, immigration or other competent authorities.
• Automatically through website cookies, analytics, security tools and server logs.
• From public or lawful business sources where relevant to a genuine enquiry, supplier relationship, recruitment or legal obligation.

If you provide another person's data, you should be authorised to do so and should make this notice available to that person. Section 23 of the Act requires appropriate information about the purpose of collection and intended recipients.

5. Why we use personal data

• Respond to enquiries; design, quote, book and operate tours, treks, accommodation, transfers and related travel services.
• Perform or prepare a contract with a guest, agent, supplier, employee or other business partner.
• Manage permits, park entry, border and immigration requirements, manifests, rooming lists and supplier reservations.
• Protect health, safety and vital interests; assess participation information; respond to incidents; arrange medical support, evacuation or insurance assistance.
• Process payments, invoices, refunds, accounting, audit, tax and fraud-prevention requirements.
• Communicate service information, changes, emergency messages and post-tour feedback requests.
• Improve our services, train staff, manage quality, resolve complaints and establish, exercise or defend legal claims.
• Maintain website functionality, cybersecurity, access control, backups, logs and business continuity.
• Recruit and manage employees and crews and administer lawful employment obligations.
• Send marketing where permitted and honour opt-out or withdrawal requests.
• Meet legal, regulatory, licensing, reporting and law-enforcement obligations.

Our processing is based, as applicable, on necessity for a requested service or contract, consent (including written consent where required for sensitive personal data), compliance with law, protection of life or health, and other grounds permitted under sections 22, 25 and 30 of the Act. Where consent is the basis, it may be withdrawn, but withdrawal does not invalidate earlier lawful processing and may affect our ability to provide a service that requires the data.

6. Sensitive personal data and children

Travel and trekking operations may require health, disability, dietary, family or children's information. These categories may be sensitive personal data under the Act. Under section 30, we seek prior written consent where required, restrict access to personnel and suppliers who reasonably need the information and apply additional safeguards. Where the data subject cannot lawfully provide consent, we seek consent or authority from the appropriate parent, guardian or representative as required by law.

We do not use children's data for behavioural advertising. We process it only where reasonably necessary for a family enquiry, booking, safety, permit, legal obligation or other lawful purpose.

7. When we share personal data

We disclose personal data only where lawful, necessary and proportionate. Recipients may include:
• accommodation providers, guides, drivers, mountain crews, transport and aviation providers, activity operators and other suppliers needed to deliver the itinerary;
• travel agents, partner tour operators, group organisers or authorised representatives involved in the booking;
• protected-area, wildlife, immigration, border, health, rescue, police, court, tax and other competent authorities where required or permitted;
• medical, evacuation, insurance and emergency-assistance providers;
• banks, payment providers, accountants, auditors, legal advisers and insurers;
• website hosting, email, cloud storage, communications, analytics, security and other technology providers acting under appropriate arrangements; and
• a purchaser, adviser or successor in connection with a lawful restructuring or transfer of the business, subject to appropriate confidentiality and data-protection safeguards.

Sections 25 and 26 of the Act restrict use and disclosure beyond the intended purpose. We do not sell personal data. We require processors acting on our instructions to protect data through appropriate contractual and security obligations, consistent with section 27(4) of the Act.

8. International transfers

International travel and commonly used communications, cloud, reservation and payment services may involve access to or storage of personal data outside Tanzania. We make such transfers only where permitted under sections 31 and 32 of the Act and regulations 20 to 22, including obtaining a PDPC permit where required and applying appropriate safeguards. Depending on the circumstances, a lawful transfer may also be necessary to perform a contract requested by the data subject, protect vital interests, comply with law or be supported by valid consent.

9. Security and personal-data breaches

In line with section 27 of the Act and regulation 27, we apply proportionate technical and organisational measures designed to protect personal data against negligent loss, unauthorised destruction, alteration, disclosure, access or processing. Measures may include access controls, confidentiality duties, secure transmission and storage, backups, logs, device and network safeguards, staff training, supplier controls and incident-response procedures.
No system is completely secure. We investigate suspected personal-data breaches, take reasonable containment and remediation steps, preserve appropriate records and notify the PDPC without undue delay where required by section 27(5). We communicate with affected persons where required by law or directed by the competent authority.

10. Retention and disposal

We retain personal data only for as long as reasonably necessary for the stated purpose and any applicable legal, accounting, tax, employment, insurance, safety, complaint or claims period. Retention periods vary by record type and begin from the relevant event, such as the end of a journey, employment or supplier relationship. When data is no longer required, we securely delete or destroy it or anonymise it so that individuals cannot reasonably be identified.

Our retention and disposal practices are governed by section 28 of the Act and regulation 30. We maintain internal retention rules and consider the intended purpose, legal obligations, the need to respond to disputes or claims, the sensitivity of the data and the duration of backups and logs.

11. Your rights

Subject to the Act, applicable exceptions and reasonable identity verification, a data subject may:
• ask whether we process their personal data and request access to the data, purposes and recipient categories (section 33);
• request correction of incomplete, inaccurate, misleading or irrelevant data (sections 24 and 29; regulation 16);
• request suspension, restriction or prevention of processing likely to cause substantial damage (section 34; regulation 15);
• object to or require us to stop direct marketing (section 35);
• request human reconsideration of certain decisions based solely on automated processing (section 36; regulation 19);
• request blocking, erasure or destruction where the statutory conditions apply (section 38; regulation 17);
• withdraw consent where consent is the basis for processing; and
• submit a complaint to us or to the Personal Data Protection Commission (section 39 and regulation 36).
To exercise a right, contact info@shah-tours.com with enough information to identify the relevant records and request. Some rights are not absolute: we may retain or continue processing data where a legal obligation, contractual necessity, public interest, safety need, investigation, legal claim or another statutory exception applies. We will explain a refusal or limitation where the law requires.

12. Marketing

We send promotional communications only where permitted. You may unsubscribe using the link in a marketing email or contact us at info@shah-tours.com. Service, safety, payment and booking communications are not marketing and may still be sent where necessary. Section 35 of the Act gives data subjects the right to require that direct-marketing processing stop.

13. Cookies, analytics and third-party links

Our website may use essential cookies for functionality and security and, where configured, analytics or marketing cookies to understand use and improve our services. Non-essential cookies should be managed through the website's consent controls where required. Browser settings may also block or delete cookies, although this can affect website functions.

Our website may link to third-party websites or platforms. Their operators are responsible for their own privacy practices, and we encourage users to review the relevant notices. This policy does not replace the privacy terms of a bank, payment provider, messaging service, social-media platform, insurer or other independent controller.

14. Automated decision-making

We do not currently make decisions about guests that produce legal or similarly significant effects solely through automated processing. If this changes, we will provide appropriate information and safeguards consistent with section 36 of the Act and regulation 19.

15. Complaints and the PDPC

Please first contact our Data Protection Officer at info@shah-tours.com so that we can review and address the concern. A person who considers that personal-data-protection principles have been violated may also lodge a complaint with the Personal Data Protection Commission through its official channels at www.pdpc.go.tz. This does not limit any right available under law.

16. Accountability and updates

We maintain data-protection governance appropriate to our operations, including a designated Data Protection Officer, staff responsibilities, security and breach procedures, processor oversight, retention rules and impact assessments for processing likely to affect rights and freedoms. These measures reflect section 27 and section 65 of the Act and regulations 24, 27, 30, 32 and 33.

We may update this policy to reflect legal, operational or technology changes. The current version will be published with its effective or review date. Material changes will be communicated where appropriate.

Legal references

• Personal Data Protection Act, Chapter 44 (Act No. 11 of 2022), particularly sections 5, 14, 22-32, 33-39 and 65.
• Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023, GN No. 449C, particularly regulations 4, 15-33 and 36.
• Personal Data Protection Commission: www.pdpc.go.tz.