Privacy Policy
Effective date: 8 January 2026
This Privacy Policy explains how HAYA Travel Technologies ("HAYA", "we", "us"), a company registered in Rwanda, collects, uses, shares, and protects personal information when you use our websites and the HAYA platform (the "Service").
1. Roles: controller vs. processor
Depending on how you use HAYA, we may act as:
- Controller for personal information we process to operate our own business (e.g., account creation, billing, security, marketing).
- Processor when an Organization uploads or manages traveler/client data in the Service. In that case, the Organization is typically the controller and is responsible for the lawful basis and notices to travelers/clients.
2. Information we collect
- Account and profile data: name, email, phone (optional), organization details, role.
- Customer Content: data you upload or create (itineraries, proposals, documents, media, traveler/client details you choose to store).
- Usage and device data: log data, pages/actions, IP address, browser type, device identifiers, approximate location derived from IP.
- Payment and billing data: billing contact details and transaction metadata. Payment card details are typically processed by our payment providers, not stored by HAYA.
- Support communications: messages you send to support and any attachments.
- Cookies and similar technologies: used for authentication, preferences, analytics, and security.
3. How we use information
- Provide, maintain, and secure the Service (authentication, access control, fraud prevention).
- Operate core features (creating itineraries, proposals, bookings, payments workflows).
- Improve the Service (debugging, analytics, performance monitoring, feature development).
- Customer support and communications (service notices, onboarding guidance).
- Billing, subscriptions, and usage tracking.
- Comply with legal obligations and enforce our terms.
4. Legal bases (where applicable)
Where required by applicable law, we rely on one or more of the following legal bases: performance of a contract, legitimate interests (e.g., security, product improvement), consent (e.g., optional marketing cookies), and legal obligations.
5. How we share information
We may share personal information with:
- Service providers who process data on our behalf (e.g., hosting, authentication, analytics, email delivery, customer support, payment processing).
- Your Organization (admins and authorized users) when you use a shared workspace.
- Legal and safety recipients when required by law or to protect rights, safety, and security.
- Business transfers in connection with a merger, acquisition, or sale of assets.
We do not sell your personal information.
6. International transfers
The Service may be hosted or supported in multiple countries. If we transfer personal information across borders, we will take measures designed to provide appropriate safeguards consistent with applicable law.
7. Data retention
We retain personal information as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary based on the type of data and how it is used.
8. Security
We use administrative, technical, and organizational measures designed to protect personal information. No method of transmission or storage is 100% secure.
9. Your rights
Depending on your location and applicable law, you may have rights to access, correct, delete, or object to processing of your personal information, and to request a copy or portability of certain information.
If you use HAYA through an Organization, please direct requests relating to traveler/client data to that Organization. We will support the Organization in responding where required.
10. Cookies
We use cookies and similar technologies for authentication, security, preferences, and analytics. Some cookies are required for the Service to function.
11. Children
The Service is not directed to children. Do not use the Service if you are not old enough to consent to data processing under applicable law.
12. Changes to this Policy
We may update this Privacy Policy from time to time. If changes are material, we will provide notice through the Service or by other reasonable means.