Legal

Privacy Policy

Last updated: 4 June 2026 · Effective immediately

Skyzone Cargo & Travel Agency ("Skyzone", "we", "our") respects your privacy and is committed to protecting your personal data. This policy explains what information we collect, why we collect it, how we store and protect it, and your rights under the Kenya Data Protection Act 2019.

1. Information We Collect
2. Why We Collect It
3. How We Store and Protect It
4. Third-Party Services
5. International Data Transfers
6. Kenya Data Protection Act 2019
7. Your Rights
8. Children's Privacy
9. Cookies
10. Changes to This Policy
11. Contact Us

Section 1

Information We Collect

We collect the following categories of personal data when you use our services:

Identity Data

Full name
Date of birth (where required for visas)
Passport / national ID number (visa services only)

Contact Data

Email address
Phone number (including WhatsApp)
Physical / delivery address

Booking Data

Service type selected
Travel dates and destinations
Number of travelers
Cargo details (weight, dimensions, declared contents)

Payment Data

M-Pesa transaction reference number
Bank transfer reference
Payment amount and date

Account Data

Email address (username)
Encrypted password (bcrypt hash — never plaintext)
Account role (Customer, Agent)

Technical Data

IP address (anonymised)
Browser type and device info
Pages visited (via Vercel Analytics — anonymous)

Section 2

Why We Collect It

Processing bookings:We need your identity, contact, and booking data to create and manage your reservations and issue invoices.

Customer communications:We use your email and phone to send booking confirmations, tracking updates, and payment reminders.

Quote generation:Our agents use your contact and cargo details to prepare tailored freight quotes.

Payment processing:We record payment references to confirm receipt and reconcile accounts.

Legal and regulatory compliance:We retain records as required by Kenyan tax law, KRA regulations, and customs requirements.

Platform security:Technical data helps us detect and prevent fraud and unauthorised access.

Service improvement:Anonymous analytics (Vercel) help us understand how our website is used — no personal data is involved.

Section 3

How We Store and Protect It

Your data is stored in a managed PostgreSQL database hosted on Neon (Frankfurt, Germany — eu-central-1). We take the following security measures:

✓
All passwords are hashed with bcrypt — we never store plaintext passwords
✓
Database connections use TLS/SSL encryption in transit
✓
Data at rest is encrypted by Neon's managed infrastructure
✓
Access to production systems is restricted to authorised personnel only
✓
Our platform runs on Vercel with automatic security patching
✓
All API endpoints are protected by session-based authentication (NextAuth.js)
✓
Role-based access control (RBAC) prevents customers from accessing agent or admin data

Data retention: We retain personal data for as long as your account is active and for up to 7 years thereafter to comply with Kenyan tax and business record-keeping requirements. You may request earlier deletion — see Section 7.

Section 4

Third-Party Services

We share limited data with the following trusted third parties to operate our services:

Service	Purpose	Data Shared
FedEx	Cargo tracking & rate quotes	Shipment details (origin, destination, weight)
Aramex	Cargo tracking & rate quotes	Shipment details (origin, destination, weight)
Resend	Transactional email delivery	Name, email address
M-Pesa / Safaricom	Mobile money payment processing	Phone number, payment amount
Vercel	Website hosting and anonymous analytics	Anonymous usage data (no PII)
Neon (PostgreSQL)	Database hosting	All data stored in our database

We do not sell or share your personal data with any third party for marketing or advertising purposes.

Section 5

International Data Transfers

Our database is hosted in the European Union (Frankfurt, Germany) on Neon's infrastructure. When you submit data through our website, it is transferred from Kenya to the EU for storage.

EU (Neon / Vercel)

Neon complies with GDPR requirements for data protection. Vercel processes anonymous analytics data under their data processing agreement.

Carrier Networks (FedEx / Aramex)

Shipment data may be processed in multiple countries as part of international cargo operations. Both carriers have established data protection frameworks.

Section 6

Kenya Data Protection Act 2019

As a Kenyan business, we comply with the Kenya Data Protection Act 2019 (DPA 2019) and the Data Protection (General) Regulations 2021. Our legal bases for processing your personal data are:

Contract performance:Processing necessary to deliver the services you have booked or requested.

Legal obligation:Retaining records as required by Kenyan tax law, Kenya Revenue Authority regulations, and customs requirements.

Legitimate interests:Fraud prevention, platform security, and service improvement — where these do not override your fundamental rights.

Consent:Analytics cookies and marketing communications — you may withdraw consent at any time without affecting services already received.

Section 7

Your Rights

Under the Kenya Data Protection Act 2019, you have the following rights regarding your personal data:

Right of Access

Request a copy of the personal data we hold about you.

Right to Correction

Request correction of inaccurate or incomplete data.

Right to Erasure

Request deletion of your data, subject to legal retention requirements.

Right to Portability

Receive your data in a structured, machine-readable format.

Right to Object

Object to processing based on legitimate interests or direct marketing.

Right to Withdraw Consent

Withdraw consent for analytics or marketing at any time.

To exercise any of these rights, email Skyzonecargo3@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC Kenya) at odpc.go.ke.

Section 8

Children's Privacy

Our services are intended for users aged 18 and above. We do not knowingly collect personal data from children under 18. If you believe a minor has provided us with personal data without parental consent, please contact us immediately at Skyzonecargo3@gmail.com and we will delete such data promptly.

Section 9

Cookies

We use cookies to maintain your login session, remember preferences, and collect anonymous analytics data via Vercel. You can manage your cookie preferences via your browser settings or through the consent banner that appears on your first visit. See our full Cookie Policy for complete details on what cookies we use and why.

Section 10

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify registered users by email of any material changes. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of our services after changes are posted constitutes your acceptance of the updated policy.

Section 11

Contact Us

Data Protection Queries

For any privacy-related requests, corrections, or complaints, contact our data protection team:

Skyzonecargo3@gmail.com(privacy requests)

Skyzonecargo3@gmail.com(general enquiries)

Major Muriithi St, Hodo Souk Building

First Floor F1, Opposite Kulan Cafe

Eastleigh, Nairobi, Kenya

Last updated: 4 June 2026