Legal

Privacy Policy

Last updated: 12 October 2026 · Effective immediately

Skyzone Cargo & Travel Agency ("Skyzone", "we", "our") respects your privacy and is committed to protecting your personal data. This policy explains what information we collect, why we collect it, how we store and protect it, and your rights under the Kenya Data Protection Act 2019.

1. Information We Collect
2. Why We Collect It
3. How We Store and Protect It
4. Third-Party Services
5. International Data Transfers
6. Kenya Data Protection Act 2019
7. Your Rights
8. Children's Privacy
9. Cookies
10. Changes to This Policy
11. Contact Us
12. Partner verification

Section 1

Information We Collect

We collect the following categories of personal data when you use our services:

Identity Data

Full name
Date of birth (where required for visas)
Passport / national ID (visa services and partner verification)

Contact Data

Email address
Phone number (including WhatsApp)
Physical / delivery address

Booking Data

Service type selected
Travel dates and destinations
Number of travelers
Cargo details (weight, dimensions, declared contents)

Payment Data

M-Pesa transaction reference number
Bank transfer reference
Payment amount and date

Account Data

Email address (username)
Encrypted password (bcrypt hash — never plaintext)
Account role (Customer, Agent)

Technical Data

IP address (anonymised)
Browser type and device info
Pages visited (via Vercel Analytics — anonymous)

Section 2

Why We Collect It

Processing bookings:We need your identity, contact, and booking data to create and manage your reservations and issue invoices.

Customer communications:We use your email and phone to send booking confirmations, tracking updates, and payment reminders.

Quote generation:Our agents use your contact and cargo details to prepare tailored freight quotes.

Payment processing:We record payment references to confirm receipt and reconcile accounts.

Legal and regulatory compliance:We retain records as required by Kenyan tax law, KRA regulations, and customs requirements.

Platform security:Technical data helps us detect and prevent fraud and unauthorised access.

Service improvement:Anonymous analytics (Vercel) help us understand how our website is used — no personal data is involved.

Section 3

How We Store and Protect It

Your data is stored in a managed PostgreSQL database hosted on Neon (Frankfurt, Germany — eu-central-1). We take the following security measures:

✓
All passwords are hashed with bcrypt — we never store plaintext passwords
✓
Database connections use TLS/SSL encryption in transit
✓
Data at rest is encrypted by Neon's managed infrastructure
✓
Access to production systems is restricted to authorised personnel only
✓
Our platform runs on Vercel with automatic security patching
✓
All API endpoints are protected by session-based authentication (NextAuth.js)
✓
Role-based access control (RBAC) prevents customers from accessing agent or admin data

Data retention: We retain personal data for as long as your account is active and for up to 7 years thereafter to comply with Kenyan tax and business record-keeping requirements. You may request earlier deletion — see Section 7.

Section 4

Third-Party Services

We share limited data with the following trusted third parties to operate our services:

Service	Purpose	Data Shared
FedEx	Shipping labels, customs clearance, tracking & rate quotes	Sender and recipient names, addresses and contact details; shipment contents, value, weight and dimensions
Resend	Transactional email delivery	Name, email address
M-Pesa / Safaricom	Mobile money payment processing	Phone number, payment amount
Vercel	Website hosting and anonymous analytics	Anonymous usage data (no PII)
Neon (PostgreSQL)	Database hosting	All data stored in our database

We do not sell or share your personal data with any third party for marketing or advertising purposes.

Section 5

International Data Transfers

Our database is hosted in the European Union (Frankfurt, Germany) on Neon's infrastructure. When you submit data through our website, it is transferred from Kenya to the EU for storage.

EU (Neon / Vercel)

Neon complies with GDPR requirements for data protection. Vercel processes anonymous analytics data under their data processing agreement.

Carrier Network (FedEx)

Shipment data, including the recipient's name, address and contact details, is passed to the carrier and to customs, and may be processed in multiple countries as part of international cargo operations. FedEx has an established data protection framework. When you give us a recipient's details, you confirm that you are allowed to share them for this purpose.

Section 6

Kenya Data Protection Act 2019

As a Kenyan business, we comply with the Kenya Data Protection Act 2019 (DPA 2019) and the Data Protection (General) Regulations 2021. Our legal bases for processing your personal data are:

Contract performance:Processing necessary to deliver the services you have booked or requested.

Legal obligation:Retaining records as required by Kenyan tax law, Kenya Revenue Authority regulations, and customs requirements.

Legitimate interests:Fraud prevention, platform security, and service improvement — where these do not override your fundamental rights.

Consent:Analytics cookies and marketing communications — you may withdraw consent at any time without affecting services already received.

Section 7

Your Rights

Under the Kenya Data Protection Act 2019, you have the following rights regarding your personal data:

Right of Access

Request a copy of the personal data we hold about you.

Right to Correction

Request correction of inaccurate or incomplete data.

Right to Erasure

Request deletion of your data, subject to legal retention requirements.

Right to Portability

Receive your data in a structured, machine-readable format.

Right to Object

Object to processing based on legitimate interests or direct marketing.

Right to Withdraw Consent

Withdraw consent for analytics or marketing at any time.

To exercise any of these rights, email Skyzonecargo3@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC Kenya) at odpc.go.ke.

Section 8

Children's Privacy

Our services are intended for users aged 18 and above. We do not knowingly collect personal data from children under 18. If you believe a minor has provided us with personal data without parental consent, please contact us immediately at Skyzonecargo3@gmail.com and we will delete such data promptly.

Section 9

Cookies

We use cookies to maintain your login session, remember preferences, and collect anonymous analytics data via Vercel. You can manage your cookie preferences via your browser settings or through the consent banner that appears on your first visit. See our full Cookie Policy for complete details on what cookies we use and why.

Section 10

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify registered users by email of any material changes. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of our services after changes are posted constitutes your acceptance of the updated policy.

Section 11

Contact Us

Data Protection Queries

For any privacy-related requests, corrections, or complaints, contact our data protection team:

Skyzonecargo3@gmail.com(privacy requests)

Skyzonecargo3@gmail.com(general enquiries)

Major Muriithi St, Hodo Souk Building

First Floor F1, Opposite Kulan Cafe

Eastleigh, Nairobi, Kenya

Section 12

Partner verification

To verify our partners we collect the agency’s name and address, the contact person’s full name, phone number, username and email, and both sides of the contact person’s ID. Skyzone is the sender of record on partners’ FedEx shipments and must know who books them. Only Skyzone’s Admin captures and sees these details and ID images. We keep these records while the partnership is active and afterwards only as long as we must keep business records. You may ask us to correct inaccurate information by contacting us using the contact details above.

Last updated: 12 October 2026