Privacy Notice

Effective Date: 13 August 2026

1. Introduction

Tumalink Digital Solutions Limited ("Tumafly", "we", "our" or "us") is committed to protecting your privacy and processing your personal data in accordance with the Data Protection Act, 2019, the Data Protection (General) Regulations, 2021, and other applicable laws of Kenya.

This Privacy Notice explains how we collect, use, disclose, store and protect your personal data when you access or use our website, mobile application or any other platform operated by Tumafly (collectively, the "Sites"), or when you make a Booking through our platform.

2. Data Controller

Tumalink Digital Solutions Limited is the data controller in respect of the personal data collected through the Sites.

Tumalink is registered with the Office of the Data Protection Commissioner as a Data Controller and Data Processor.

For privacy-related enquiries, please contact:

Data Protection Officer (or Privacy Officer)

Email: privacy@tumafly.com

General enquiries: hello@tumafly.com or WhatsApp Number +254 113 165503

3. Personal Data We Collect

We may collect and process the following categories of personal data:

• identification information (name, date of birth, gender and nationality);

• passport, national identification or visa information where required;

• contact information;

• Booking and travel itinerary information;

• payment confirmation details (excluding full payment card details);

• authentication credentials

• currency preference

• customer service correspondence;

• technical information including IP address, browser type, operating system and device identifiers;

• cookies and website usage information; and

• any other information voluntarily provided by you.

Where you provide information relating to another traveller, you confirm that you are authorised to do so.

Where a booking includes a child or infant, we will process the child's personal data only to the extent necessary to provide our services and, where required by applicable law, on the basis of consent from a parent or legal guardian. We do not knowingly collect personal data directly from children. If we become aware that we have collected a child's personal data without the required consent or lawful basis, we will take appropriate steps to delete or otherwise lawfully process such information.

4. Purposes of Processing

Tumafly processes personal data for the following purposes:

• facilitating Bookings and ticket issuance;

• processing Payments and Refunds;

• communicating travel information;

• responding to customer enquiries;

• verifying identity where necessary;

• preventing fraud and enhancing security;

• complying with legal and regulatory obligations;

• maintaining business records;

• improving the functionality of the Sites;

• enforcing our Terms and Conditions; and

• sending marketing communications where permitted by law or where consent has been obtained.

5. Lawful Basis for Processing

We process personal data where:

• processing is necessary for the performance of a contract;

• processing is necessary to comply with a legal obligation;

• processing is necessary for our legitimate interests provided such interests do not override your rights and freedoms; or

• you have provided your consent where consent is required under applicable law.

6. Processing of Sensitive Personal Data

We recognize that certain categories of personal data require a higher level of protection. Where we process sensitive personal data, we will do so only where permitted or required by applicable law and will implement appropriate technical, organizational and security measures to safeguard such data. We will process sensitive personal data only for specified, explicit and lawful purposes and in accordance with the additional requirements and safeguards prescribed under the Kenya Data Protection Act, 2019 and any applicable regulations.

7. Disclosure of Personal Data

Tumafly may disclose personal data to carefully selected third-party service providers that support the delivery of our services, including but not limited to:

• Airlines and global distribution systems;

• inventory and booking technology providers, including Duffel (United Kingdom);

• payment service providers, including Paystack Payments Kenya Limited (Kenya);

• cloud hosting and database providers, including Supabase (United States);

• security and anti-fraud providers, including Cloudflare (United States);

• email and customer communication providers, including Resend (United States);

• analytics and technology providers, including Google (United States); and

• messaging and communications providers, including Africa's Talking (Kenya)

• regulatory authorities;

• immigration, customs and security agencies;

• law enforcement agencies; and

• professional advisers

These service providers process personal data only on Tumafly's documented instructions, are required to implement appropriate technical and organizational security measures, and are contractually bound to maintain the confidentiality and security of personal data.

8. Cross-Border Transfers

As an online travel booking platform, Tumafly may transfer or permit access to personal data outside Kenya where this is necessary to facilitate Bookings, process Payments, communicate with Clients, protect the security of the Sites, or otherwise provide our services.

Our third-party service providers are currently located in, among other jurisdictions:

• the United Kingdom (Duffel);

• the United States of America (Supabase, Cloudflare, Resend and Google); and

• Kenya (Paystack Payments Kenya Limited and Africa’s Talking).

Where personal data is transferred outside Kenya, Tumafly shall ensure that such transfer is carried out in accordance with the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021. Where required, Tumafly shall implement appropriate safeguards, including contractual data protection obligations with recipients, transfers to jurisdictions recognised as providing an adequate level of protection where applicable, or any other lawful transfer mechanism permitted under Kenyan law.

9. Data Security

Tumafly implements appropriate technical and organisational security measures designed to safeguard personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures include encryption of personal data in transit and, where appropriate, at rest, access controls based on the need-to-know principle, and regular reviews of our security practices.

We do not store your full payment card details. All payment card transactions are processed securely by our PCI DSS Level 1 compliant payment service provider.

10. Data Retention

Personal data shall be retained only for as long as is reasonably necessary for:

• providing our services;

• complying with legal obligations;

• resolving disputes;

• establishing or defending legal claims; or

• meeting statutory record-keeping requirements.

Thereafter, the data shall be securely deleted, anonymised or archived in accordance with applicable law.

11. Your Rights

Subject to the Data Protection Act, 2019, you have the right to:

• be informed of the use of your personal data;

• access your personal data;

• object to the processing of your personal data;

• request correction of inaccurate or incomplete personal data;

• request deletion of personal data where lawful;

• withdraw consent where processing is based on consent; and

• lodge a complaint with the Office of the Data Protection Commissioner.

We will respond to your valid data subject rights requests within thirty (30) days of receipt. Where permitted by applicable law, we may extend this period up to a further sixty (60) days for complex requests and will notify you of the extension and the reasons for it.

Requests relating to your personal data may be submitted to privacy@tumafly.com

12. Data Breach Notification

We are committed to protecting your personal data and maintaining appropriate technical and organizational measures to safeguard it against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data.

Where we become aware of a personal data breach involving your personal data, we will assess the nature and impact of the breach and take appropriate steps to contain, investigate and remediate it.

Where required under the Kenya Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021, we will notify the Office of the Data Protection Commissioner (ODPC) of the personal data breach without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach.

Where the personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay. Such notification will include, where appropriate:

• a description of the nature of the personal data breach;

• the categories of personal data affected;

• the likely consequences of the breach;

• the measures we have taken or propose to take to address and mitigate the effects of the breach; and

• recommendations on any steps you can take to protect yourself from potential harm.

Notwithstanding the foregoing, we may not notify affected data subjects of a personal data breach where notification is not required by applicable law, including where appropriate security measures, such as encryption, have rendered the personal data unintelligible to unauthorized persons or where the breach is no longer likely to result in a high risk to the rights and freedoms of affected data subjects.

13. Marketing Communications

Where permitted by law, Tumafly may send promotional communications regarding its products and services.

You may opt out of receiving marketing communications at any time by:

• clicking the unsubscribe link in any marketing email;

• contacting hello@tumafly.com or WhatsApp Number +254 113 165503; and

Opting out shall not affect operational or transactional communications relating to your Bookings.

14. Cookies and Similar Technologies

We use cookies and similar technologies to operate, secure and improve our website and services, to remember your preferences, analyze website traffic and usage, and enhance your browsing experience. Some cookies are essential for the operation of our website, while others help us understand how our website is used or deliver personalized content and advertisements where applicable.

You can manage or disable cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality and performance of our website and limit your ability to access certain features or services.

Where required by applicable law, we will obtain your consent before placing non-essential cookies on your device. For more information about the cookies we use, the purposes for which they are used, and how you can manage your cookie preferences, please refer to our Cookie Policy.

15. Cloudflare Turnstile

To protect the Sites and our users from spam, automated abuse, fraudulent activity, and other malicious traffic, Tumafly uses Cloudflare Turnstile in invisible mode on certain features of the Sites, including the flight search and Booking processes. Turnstile analyses technical and behavioural information to distinguish human users from automated systems without requiring users to complete traditional CAPTCHA challenges.

In connection with the provision of this service, certain technical information (such as IP address, browser characteristics, device information, and interaction data) may be processed by Cloudflare, Inc. for security, fraud prevention, and service integrity purposes. Such processing is undertaken in accordance with Cloudflare's privacy practices.

For further information on how Cloudflare processes personal data through Turnstile, please refer to the Cloudflare Turnstile Privacy Policy available at: https://www.cloudflare.com/en-gb/turnstile-privacy-policy/.

By using the Sites, you acknowledge that such processing is necessary to protect the security, integrity, and availability of Tumafly's services and is undertaken in accordance with this Privacy Notice and applicable data protection laws.

16. Third-Party Websites

The Sites may contain links to third-party websites.

Tumafly is not responsible for the privacy practices or content of such websites.

17. Changes to this Privacy Notice

Tumafly may amend this Privacy Notice from time to time.

Any updated version shall be published on the Sites together with the revised effective date.

18. Contact Information

Questions regarding this Privacy Notice or the processing of personal data may be directed to:

Tumalink Digital Solutions Limited

Email: privacy@tumafly.com

General enquiries: hello@tumafly.com or WhatsApp Number +254 113 165503

If you are dissatisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner in accordance with the Data Protection Act, 2019.