Privacy Notice

1. Information we collect

Depending on how you use Khaya Explore, we process:

• Account information, including your email address and account identifier.
• Listing information you submit, including descriptions, photographs, venues and contact or booking details.
• Submission status, review feedback and listing updates.
• Featured reservation details, including selected dates and hold expiry.
• Technical information needed to deliver and protect the service, such as connection details, error records and authentication information.

You can browse public experiences without creating an organiser account.

2. Why we use information

We use information to create accounts and let users sign in; receive, review, publish and manage listings; show relevant experiences and their contact details; manage featured reservations and prevent conflicting bookings; provide account support, investigate misuse and maintain security; and meet applicable legal obligations.

We use information on the lawful grounds applicable to each purpose, including providing the requested service, legitimate operational interests where permitted, consent where required, and legal obligations.

We do not treat acceptance of this notice as permission for unrelated marketing.

3. What becomes public

After approval and publication, your listing’s content, photographs, venue details and contact links can be viewed by visitors.

Your account email is not automatically displayed on your listing. It becomes public if you include it in a public description or contact field.

Public information may be copied, shared or indexed by search engines.

Draft and pending listing photographs are restricted to authorised access. Account contact details and review feedback are not intended for public display.

4. Service providers and disclosures

We use Supabase for account authentication, database storage and uploaded photographs. Our hosting and other necessary service providers may process information to operate the service on our behalf.

We may disclose information where legally required or reasonably necessary to protect users, investigate misuse or establish and defend legal rights.

We do not sell your personal information.

5. International processing

Service providers may process information outside Zimbabwe. International processing is subject to applicable legal requirements and safeguards.

6. Emails

Account confirmation and password recovery involve service emails.

Listing review feedback is currently available within the organiser’s account. Automatic listing-review emails are not currently enabled.

If optional marketing emails are introduced, we will explain the choice and provide a way to unsubscribe.

7. Cookies and browser storage

We use authentication cookies or browser storage, as applicable, to maintain sign-in sessions.

If we introduce optional analytics or advertising technologies, we will explain them and obtain consent where required.

8. Retention

We retain information only as long as reasonably necessary for the purposes described in this notice and any applicable legal obligations.

An expired featured hold no longer reserves capacity, but its record may remain for administration and dispute handling. Hiding a listing does not automatically delete its database record.

When information is no longer needed, it should be deleted or anonymised. Backup copies may remain until the provider’s backup cycle expires.

9. Your choices and rights

Subject to applicable law, you can request access to information held about you, correction of inaccurate information, deletion where applicable, and object to relevant processing.

Where processing relies on consent, you may withdraw it. This does not invalidate processing already lawfully carried out.

We may need proportionate information to verify your identity before acting on a request.

You may also raise a privacy complaint with Zimbabwe’s Data Protection Authority, POTRAZ.

10. Security

We use access controls and other reasonable safeguards to protect information. No online service can guarantee complete security.

Keep your password private and report suspected unauthorised access to your account.

11. Children

Organiser accounts are intended for adults aged 18 or over.

Do not submit identifiable photographs or other personal information about children unless you have appropriate authority and permission.

12. Other websites

When you follow an organiser’s booking, social media or contact link, that provider handles information under its own privacy practices.

13. Updates

We will update this notice when our practices change and provide appropriate notice of material changes.