Privacy Policy

The data controller for personal data covered by this Policy is Neonworks Consulting Limited, a company incorporated in Kenya (registration number PVT-A71MK8ZJ), with its registered office at Ruaka, Banana Road, Nairobi, 00400, Kenya.

For privacy questions, contact us at privacy@twendie.com. For data protection matters escalated to our Data Protection Officer, use dpo@twendie.com.

This Policy applies to personal data we process in connection with our websites, applications, and services (collectively, the "Service"). It does not apply to third-party websites, applications, or services that we do not own or control, including sites linked from our Service.

If you are a traveller or prospect interacting with a travel agency that uses Twendie, that agency is primarily responsible for your personal data. Please also read our End-User Notice.

Under data protection laws such as the EU and UK GDPR and the Kenya Data Protection Act, 2019, our role depends on the data in question.

We use personal data to provide, maintain, secure, and improve the Service. In particular, we use data to:

• create and manage accounts, authenticate users, and support you;
• deliver Service features, including AI-assisted itineraries;
• process payments, issue invoices, and collect amounts due;
• send service and security notices, and (with your consent where required) marketing communications;
• detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Acceptable Use Policy;
• monitor and improve performance, reliability, and product quality, including by running aggregated and de-identified analytics;
• comply with legal obligations and enforce our agreements and rights.

The Service includes AI-assisted features (currently powered by Google Gemini) that help draft responses, build itineraries, and generate pricing suggestions. These features process data you or your authorised users submit to produce suggested outputs.

• We instruct our AI sub-processors not to use your content to train their general foundation models.
• AI outputs are drafts intended for human review. They may be inaccurate, incomplete, or out of date. Customers are responsible for reviewing outputs before relying on them or sending them to travellers.
• We do not use AI to make decisions that produce legal or similarly significant effects on individuals without human review.

Where EU or UK GDPR applies, we rely on the following legal bases:

• Contract: to provide the Service you or your organisation has subscribed to.
• Legitimate interests: to secure, improve, and market the Service, and to handle enquiries, where those interests are not overridden by your rights.
• Consent: for non-essential cookies, optional marketing communications, and (where required) certain integrations. You can withdraw consent at any time.
• Legal obligation: to meet accounting, tax, and other statutory requirements.

We share personal data only as described below:

• Sub-processors: vendors that help us operate the Service (hosting, AI, analytics, email, payments, support). Current sub-processors are listed at /sub-processors.
• Customers and their authorised users: content entered on behalf of a Customer is accessible to that Customer and the users it authorises.
• Travel providers and partners: where a Customer directs us to share details with a hotel, airline, or other provider to fulfil a booking request.
• Professional advisers, auditors, and insurers under duties of confidentiality.
• Corporate transactions: in connection with a merger, acquisition, financing, or sale of assets, subject to the protections in this Policy.
• Law enforcement and legal process: where required by law or to establish, exercise, or defend legal claims.

We do not sell personal data. We do not share personal data for cross-context behavioural advertising. If this ever changes, we will update this Policy and provide any opt-out required by law.

Twendie operates from Kenya and uses sub-processors based in various jurisdictions, including the United States and the European Union. When personal data is transferred outside your country, we rely on appropriate safeguards, including:

• the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum where data originates from the EEA or UK;
• adequacy decisions where available;
• contractual and technical safeguards required by the Kenya Data Protection Act, 2019.

You can request a copy of the relevant safeguards by emailing privacy@twendie.com.

We retain personal data as follows:

• Customer account and content: for the term of the subscription and up to 90 days after termination, unless the Customer instructs earlier deletion or a longer period is required by law.
• Billing and tax records: up to 7 years after the relevant transaction, as required by applicable tax and accounting laws.
• Security, audit, and diagnostic logs: typically up to 12 months.
• Marketing contacts: until you withdraw consent or opt out, and for a reasonable period thereafter for suppression-list purposes.
• Support communications: up to 3 years after the interaction.

After the retention period, we delete or irreversibly anonymise personal data.

Subject to local law, you have rights over your personal data, including the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• delete your personal data;
• restrict or object to certain processing;
• receive your data in a portable format and, where feasible, transmit it to another controller;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with a supervisory authority, such as the Office of the Data Protection Commissioner (Kenya), your local EU Data Protection Authority, or the UK Information Commissioner's Office.

We maintain administrative, technical, and physical safeguards designed to protect personal data, including:

• encryption in transit (TLS) and at rest for primary data stores;
• least-privilege access controls and multi-factor authentication for staff;
• logging, monitoring, and automated alerting on production systems;
• secure software development practices, dependency scanning, and periodic third-party testing;
• vendor due diligence and contractually-binding security requirements on sub-processors.

No system is perfectly secure. You are responsible for keeping your credentials confidential and notifying us of any suspected unauthorised access at support@twendie.com.

The Service is not directed to children under 16 and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact privacy@twendie.com and we will take steps to delete it.

We may update this Policy from time to time. The "Last updated" date at the top of this page shows when changes were made. Material changes will be notified via the Service or by email. Continued use of the Service after an update constitutes acceptance of the updated Policy to the extent permitted by law.

For any privacy question or request, write to us at:

• Email (privacy): privacy@twendie.com
• Email (DPO): dpo@twendie.com
• Post: Neonworks Consulting Limited, Ruaka, Banana Road, Nairobi, 00400, Kenya