Privacy Policy
Last updated: June 2026. We take your privacy seriously. This policy explains what data we collect, why, and how you can control it.
1. Who we are
Classic Trip is a travel marketplace operated from Nairobi, Kenya. We are the data controller for personal data collected through classictrip.com and related applications. For privacy questions, contact us at privacy@classictrip.com.
2. Data we collect
Name, email address, phone number, password (hashed), role, and account creation date when you register.
Travel details, selected seats or room types, travel dates, passenger names, contact details, and booking reference numbers.
Transaction references, payment method type, and amounts. We do not store full card numbers. Payment processing is handled by our integrated payment providers (M-Pesa, MTN, Airtel, card processors).
Pages visited, search queries, device type, browser, IP address, and session information. This is used to improve the platform and detect fraud.
Messages and attachments you send through the support form, including contact details you provide.
Business name, registration documents, tax details, staff accounts, payout bank details, and referral statistics.
3. Why we collect it
- To process bookings — your booking, payment, and ticket delivery depend on accurate passenger data
- To send tickets and notifications — booking confirmations, reminders, and status updates via email, WhatsApp, and SMS
- To process payouts and commissions — Partners and promoters need payment details for settlement
- To prevent fraud — IP addresses and device data help us detect and block fraudulent activity
- To improve the platform — aggregated usage data helps us optimise search, pricing, and service availability
- To comply with the law — financial regulations require us to retain transaction records
4. How we share your data
We do not sell your personal data. We share data only in these circumstances:
- With Partners — the travel operator or stay host you book with receives your name, contact, and booking details to provide the service
- With payment providers — M-Pesa, MTN, Airtel, and card processors receive transaction data to process payment
- With communication services — email, WhatsApp Business API, and SMS gateways to deliver tickets and notifications
- With legal authorities — where required by law or a valid court order
5. Cookies & tracking
We use session cookies to keep you logged in and remember your booking progress. We use localStorage to remember your theme preference. We do not use advertising trackers or third-party analytics cookies. Disabling cookies will prevent login and checkout from working.
6. Data retention
Booking and payment records are retained for 7 years to comply with financial regulations. Account data is retained for as long as your account is active. You may request account deletion at any time — historical booking records may be retained in anonymised form to satisfy legal obligations.
7. Your rights
You have the right to:
- Access a copy of the personal data we hold about you
- Correct inaccurate personal data
- Request deletion of your account and associated personal data
- Object to processing of your data for marketing purposes
- Request portability of your data in a machine-readable format
To exercise any of these rights, contact us at privacy@classictrip.com or through our support page. We will respond within 30 days.
8. Security
We use industry-standard security measures including HTTPS encryption, hashed passwords (bcrypt), CSRF protection, rate limiting, and Content Security Policy headers. We conduct regular security audits. However, no platform is 100% secure — please use a strong, unique password for your account.
9. Children's privacy
Classic Trip is not intended for users under 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please contact us and we will remove the data promptly.
10. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.