Platform Privacy Policy

1.1 Purpose of This Policy

This Privacy Policy describes how Kofa Africa Technologies ('Kofa Africa', 'we', 'us', 'our') collects, uses, stores, shares, and protects personal data when you use the Kofa Africa platform at https://kofa.africa and our mobile applications (iOS and Android) (collectively, the 'Platform').

This Policy applies to all users of the Platform, including travelers, tour operators and guides, platform visitors, and job applicants where applicable. It also covers personal data we process in the course of our business operations.

1.2 Our Privacy Commitment

Kofa Africa is committed to the following principles in all personal data processing activities:

• Transparency: We tell you exactly what data we collect, why, and how.
• Purpose Limitation: We only use your data for the specific purposes we describe.
• Data Minimisation: We collect only what is necessary for those purposes.
• Accuracy: We take reasonable steps to keep your data accurate and current.
• Storage Limitation: We retain data only as long as necessary.
• Security: We implement appropriate technical and organisational security measures.
• Accountability: We can demonstrate compliance with applicable data protection laws.

1.3 Interaction with Our Terms of Service

This Privacy Policy forms part of our Terms of Service (available at https://kofa.africa/terms) and should be read alongside them. By using the Platform, you agree to the terms of this Privacy Policy.

If you are under 18 years of age, please do not use the Platform or provide any personal data to us. Our Platform is intended for adults aged 18 and over.

2.1 Data Controller Identity

For the purposes of applicable data protection legislation, the data controller is:

2.2 Data Protection Officer (DPO)

Kofa Africa has appointed a Data Protection Officer (DPO) in compliance with Article 37 of the GDPR, and in line with NDPR Framework requirements. The DPO is responsible for:

• Advising on data protection obligations and monitoring compliance.
• Acting as the primary contact point for users exercising their data rights.
• Liaising with supervisory authorities including the Nigeria Data Protection Commission (NDPC) and, where applicable, EU data protection authorities.
• Conducting and reviewing Data Protection Impact Assessments (DPIAs) for high-risk processing activities.

Contact our DPO at: info@kofa.africa

2.3 EU/UK Representative

Kofa Africa processes the personal data of individuals located in the European Economic Area (EEA) and the United Kingdom. To the extent required by applicable law, Kofa Africa will appoint an EU representative and UK representative to act on its behalf for data protection matters. Details of any such representative will be updated at https://kofa.africa/privacy as and when appointed.

2.4 NDPR Compliance

Kofa Africa is in the process of completing registration with the Nigeria Data Protection Commission (NDPC) as a data controller. Registration will be completed prior to or within 90 days of the Platform's public launch. In the interim, Kofa Africa processes all personal data in full compliance with the substantive requirements of the Nigeria Data Protection Regulation 2019 and the Nigeria Data Protection Act 2023.

3.1 Overview

The table below sets out the categories of personal data we collect, together with specific examples, primary purpose, lawful basis, and retention period. This table constitutes Kofa Africa's public-facing Record of Processing Activities (ROPA) summary in compliance with NDPR Article 2.6 and GDPR Article 30.

A. TRAVELER DATA

B. TOUR OPERATOR DATA

3.2 Special Categories of Data

Kofa Africa does not intentionally collect special categories of personal data (as defined under GDPR Article 9 and NDPR equivalent provisions), which include data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sexual orientation.

However, some Tour Experiences may require Travelers to disclose health-relevant information (for example, medical conditions relevant to adventure activities such as high-altitude trekking or water-based tours). Where an Operator requests such information through the Platform messaging system, that data is processed under the explicit consent of the Traveler and is used solely for the safe delivery of the Tour Experience. Kofa Africa does not process such data at a platform level.

3.3 Data We Do Not Collect

Kofa Africa explicitly does not collect:

• Full payment card numbers, CVV codes, or bank account PINs. These are processed exclusively by our payment processors (Paystack / Flutterwave) under their own PCI-DSS compliance frameworks.
• Bank Verification Numbers (BVN) at a platform level. BVN verification is handled directly by Paystack/Flutterwave as part of their KYC obligations.
• Biometric data of any kind.
• Personal data of individuals under 18 years of age.

4.1 Data You Provide Directly

The majority of personal data we hold is provided directly by you through:

• Account Registration: When you create a Traveler or Operator account using phone OTP, email/password, or Google OAuth.
• Booking Completion: When you select a Tour Experience, enter participant details, and complete a payment.
• Operator Verification: When an Operator submits identity documents, business credentials, and bank details during onboarding.
• Listing Creation: When an Operator creates and publishes Tour Experience listings, including photographs, itineraries, and pricing.
• Reviews: When a Traveler submits a post-trip Verified Review.
• Communications: When you contact us via in-app messaging, email, or support channels.
• Surveys and Feedback: When you participate in optional satisfaction surveys or NPS requests.

4.2 Data We Collect Automatically

When you interact with the Platform, our systems automatically collect:

• Technical Data: IP address, device identifiers, browser type and version, operating system, app version, crash and performance logs.
• Usage Data: Pages and listings viewed, search queries and filter selections, time on page, scroll depth, CTA interactions, referral source.
• Session Data: Login timestamps, session duration, authentication events.
• Location Data: Approximate location derived from IP address for destination personalisation. Precise device location is only collected if you explicitly grant location permissions in the mobile app.

4.3 Data We Receive from Third Parties

We receive personal data from third parties in the following circumstances:

• Google OAuth: When you sign in via Google, we receive your name, email address, and profile photograph from Google, subject to your Google account privacy settings.
• Payment Processors (Paystack / Flutterwave): We receive tokenised payment references, partial card details, and transaction status notifications. We do not receive full card numbers.
• Operator References and Certifications: Where an Operator's professional credentials are verifiable through a third-party body (such as the Nigerian Tourism Development Corporation or state tourism boards), we may receive verification confirmation.
• Analytics Providers: We receive aggregated and anonymised usage analytics from providers such as Google Analytics or equivalent tools.
• Fraud Prevention Services: We may receive fraud risk scores from payment processors and third-party fraud detection services.

4.4 Data from Social Media & Referrals

If you interact with Kofa Africa content on social media platforms including TikTok, Instagram, X (Twitter), or Facebook, those platforms may share engagement data with us under your privacy settings on those platforms. Kofa Africa does not control the data practices of third-party social media platforms. We encourage you to review those platforms' privacy policies.

5.1 GDPR / UK GDPR Lawful Bases

Where GDPR or UK GDPR applies, all personal data processing by Kofa Africa is based on one or more of the following lawful bases under Article 6:

5.2 NDPR Lawful Bases

Where NDPR 2019 applies, processing is based on one or more of the following grounds:

• Consent of the Data Subject (NDPR 2.2(a)): Where Kofa Africa relies on consent as a lawful basis, consent is specific, informed, freely given, and unambiguous. Consent can be withdrawn at any time.
• Performance of a Contract (NDPR 2.2(b)): Processing necessary to perform the service contract with users of the Platform.
• Compliance with a Legal Obligation (NDPR 2.2(c)): Processing required to comply with Nigerian law, including the Companies and Allied Matters Act, Finance Act, FCCPC regulations, and EFCC/NFIU reporting obligations.
• Legitimate Interests of Kofa Africa (NDPR 2.2(e)): Where our interests in operating a safe, efficient, and fraud-free marketplace do not override the rights and interests of the data subject.

5.3 Withdrawing Consent

Where Kofa Africa relies on consent as the lawful basis for processing, you have the right to withdraw that consent at any time without detriment. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. To withdraw consent, use the privacy controls in your account settings or contact info@kofa.africa.

The table below is Kofa Africa's Purpose Register, documenting every material use of personal data on the Platform. This register is maintained and reviewed by our DPO on a quarterly basis.

Kofa Africa will never sell your personal data to third parties. We will never use your personal data for purposes incompatible with those listed above without your explicit consent.

7.1 We Do Not Sell Personal Data

Kofa Africa does not sell, rent, or trade personal data to third parties for their own marketing purposes. This applies globally, including as required by Section 1798.100 of the California Consumer Privacy Act (CCPA).

7.2 Sharing with Tour Operators

When a Traveler completes a Booking, Kofa Africa shares a defined subset of the Traveler's personal data with the relevant Tour Operator to enable delivery of the Tour Experience. The data shared with Operators is limited to:

• Traveler full name
• Mobile phone number (for pre-trip coordination)
• Number of participants and any participant names provided
• Booking Reference Number and trip dates
• Any pre-trip health or accessibility information provided by the Traveler through the Platform messaging system

Tour Operators are contractually prohibited from using Traveler personal data for any purpose other than delivering the booked Tour Experience. Operators may not share Traveler data with third parties, use it for their own marketing purposes, or retain it beyond 12 months following the trip completion date. Breach of this obligation constitutes grounds for account termination under our Operator Onboarding Agreement.

7.3 Service Providers & Data Processors

Kofa Africa engages trusted third-party service providers to process personal data on our behalf as data processors. All processors are bound by Data Processing Agreements (DPAs) requiring compliance with applicable data protection law, implementation of appropriate security measures, and processing data only on Kofa Africa's documented instructions.

7.4 Sharing for Legal Reasons

Kofa Africa may disclose personal data where required to:

• Comply with a court order, subpoena, or other lawful legal process issued by a Nigerian or international court of competent jurisdiction.
• Respond to a lawful request from a regulatory authority including the Nigeria Data Protection Commission (NDPC), EFCC, FCCPC, CBN, or equivalent international body.
• Protect the rights, property, or safety of Kofa Africa, our users, or the public.
• Investigate potential violations of these Terms or applicable law.

Where legally permitted, Kofa Africa will notify affected users of any such disclosure.

7.5 Corporate Transactions

In the event of a merger, acquisition, asset sale, or other corporate transaction involving Kofa Africa, personal data held by Kofa Africa may be transferred to the acquiring or successor entity. Affected users will be notified via email and Platform notice at least 30 days before their personal data is transferred to an entity operating under a materially different privacy policy.

8.1 Data Localisation Position

Kofa Africa processes and stores the personal data of Nigerian-resident users primarily on servers located in Nigerian or African cloud regions to the extent available and technically feasible. Where data is transferred outside of Nigeria, we apply the safeguards described below.

8.2 Transfer Safeguards

8.3 Requesting Transfer Safeguard Documentation

You may request a copy of the specific transfer safeguards applicable to the processing of your personal data by contacting info@kofa.africa. We will respond within 30 days.

9.1 Retention Principles

Kofa Africa retains personal data only for as long as necessary to fulfil the purpose for which it was collected, to comply with legal obligations, and to resolve disputes or enforce agreements. Retention periods are reviewed annually by our DPO.

Once a retention period expires, personal data is either securely deleted, anonymised for statistical purposes, or archived in a restricted-access environment where deletion is not immediately possible for legal or technical reasons. Anonymised data (from which no individual can be identified) is not subject to these retention limits.

9.2 Retention Schedule

DPO Note: Kofa Africa's retention schedule is intentionally more granular and transparent than the industry standard set by comparable platforms. This reflects our commitment to data minimisation as a competitive trust differentiator.

10.1 What Are Cookies

Cookies are small text files placed on your device when you access the Platform via a web browser. We also use similar tracking technologies including pixel tags, web beacons, local storage objects, and mobile device identifiers. This section applies to the web version of the Platform; the mobile apps use equivalent device-level tracking technologies.

10.2 Cookie Categories & Consent

We categorise our cookies as follows. The first two categories are placed without consent. All others require your explicit, granular consent via our Cookie Preference Centre, accessible at https://kofa.africa/cookies or via the consent banner displayed on first visit.

10.3 Managing Your Cookie Preferences

You can review and update your cookie consent at any time through:

• The Cookie Preference Centre at https://kofa.africa/cookies
• Your browser settings (note: blocking all cookies will impair Platform functionality)
• Mobile device settings for app tracking (iOS: Settings > Privacy > Tracking; Android: equivalent device settings)

Withdrawing consent for non-essential cookies does not affect the lawfulness of prior cookie-based processing. It may reduce the personalisation quality of your Platform experience.

10.4 Do Not Track (DNT)

Kofa Africa respects browser Do Not Track (DNT) signals for analytics tracking. Where a DNT signal is detected, we will not place analytics or marketing cookies on your device without explicit consent.

11.1 Universal Rights (All Users)

Regardless of your jurisdiction, Kofa Africa respects the following core privacy rights for all Platform users:

11.2 Additional Rights for GDPR / UK GDPR Subjects (EEA & UK Users)

11.3 Additional Rights for NDPR Subjects (Nigerian Users)

In addition to the universal rights above, Nigerian-resident users have the following rights under the NDPR and Nigeria Data Protection Act 2023:

• Right to object to the processing of personal data for direct marketing purposes (NDPR 3.1(9)).
• Right to request human review of automated decisions that significantly affect you (NDPR / NDPA).
• Right to be notified of a personal data breach that is likely to result in high risk to your rights within 72 hours of Kofa Africa becoming aware of it (NDPR 2.9 / NDPA Section 40).

11.4 Additional Rights for California Residents (CCPA)

California residents have the following additional rights under the CCPA (Cal. Civ. Code §§ 1798.100 et seq.):

• Right to Know: Specific pieces of personal information collected about you in the preceding 12 months.
• Right to Delete: Request deletion of personal information, subject to legal exceptions.
• Right to Opt-Out of Sale: Kofa Africa does not sell personal information. This right is therefore already fully satisfied. A 'Do Not Sell or Share My Personal Information' link is maintained at https://kofa.africa/privacy for compliance purposes.
• Right to Non-Discrimination: Kofa Africa will not discriminate against you for exercising your CCPA rights.
• Right to Correct: Request correction of inaccurate personal information.

11.5 How to Exercise Your Rights

To exercise any of the rights described in this Section, you may:

• Submit a request via your account settings (for data access, export, and deletion of account data).
• Email info@kofa.africa with the subject line 'Privacy Rights Request' and a description of your request.
• Write to our Data Protection Officer at info@kofa.africa.

We will acknowledge your request within 72 hours and respond substantively within 30 days (or within the timeframe specified by applicable law). Where a request is complex or voluminous, we may extend our response period by a further 30 days with notice to you. We may need to verify your identity before processing certain requests.

12.1 Age Restriction

The Platform is directed exclusively to individuals aged 18 and over. Kofa Africa does not knowingly collect personal data from anyone under the age of 18. If you are a parent or guardian and believe that your child under 18 has provided personal data to Kofa Africa, please contact us immediately at info@kofa.africa. We will promptly delete such data upon verification.

12.2 Age Verification Mechanism

Kofa Africa implements the following age verification measures at registration:

• Date of birth field at account registration with automated age calculation.
• Phone OTP and Google OAuth verification, which inherently require existing adult-configured accounts.
• Operator verification requires government-issued ID establishing age of 18+.

Kofa Africa acknowledges that age declarations cannot be technically enforced with certainty for Traveler registrations beyond declaration and reasonable inference. Where we become aware that an account belongs to a minor, we will immediately suspend the account and delete associated personal data.

13.1 Overview

Kofa Africa uses automated processing in certain limited circumstances on the Platform. This section describes each instance and its legal basis, in compliance with GDPR Article 22 and equivalent NDPA provisions.

Kofa Africa does not make solely automated decisions that produce legal or similarly significant effects on individuals without human review and the ability to contest. If you believe an automated decision has affected you inappropriately, contact info@kofa.africa.

14.1 Technical Security

Kofa Africa implements the following technical security measures to protect personal data:

• Encryption in Transit: All data transmitted between users and the Platform is encrypted using Transport Layer Security (TLS 1.2 or higher).
• Encryption at Rest: All personal data stored on Kofa Africa infrastructure is encrypted using AES-256 encryption.
• Payment Data Isolation: Payment card data is never stored on Kofa Africa's infrastructure. All card capture and tokenisation is handled by Paystack and Flutterwave under their respective PCI-DSS Level 1 compliance programmes.
• Authentication Security: Multi-factor authentication (MFA) is mandatory for Admin Console access. Rate limiting of 5 failed OTP attempts before 15-minute lockout applies to all authentication endpoints.
• Access Controls: Personal data is accessible only to Kofa Africa personnel with a legitimate business need. Role-based access controls limit data exposure on the principle of least privilege.
• Penetration Testing: Kofa Africa conducts regular penetration tests and vulnerability assessments of the Platform infrastructure.
• Secure Development Practices: The Kofa Africa engineering team follows secure development lifecycle (SDL) principles including code reviews, dependency scanning, and OWASP top-10 mitigation.

14.2 Organisational Security

• All staff with access to personal data receive mandatory data protection training on appointment and annually thereafter.
• Confidentiality obligations are included in all employment and contractor agreements.
• Third-party service providers are subject to data protection due diligence and contractual DPA obligations before receiving personal data.
• Kofa Africa maintains a data breach response plan with defined response timelines.

14.3 Personal Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, Kofa Africa will:

• Notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, in compliance with NDPA Section 40.
• Notify the relevant EU data protection supervisory authority within 72 hours where the breach affects EEA residents, in compliance with GDPR Article 33.
• Notify affected individual users without undue delay where the breach is likely to result in a high risk to their rights, including via email to their registered address.
• Document all breaches in an internal breach register, regardless of whether notification to supervisory authorities is required.

Kofa Africa does not guarantee absolute security of personal data. No method of electronic transmission or storage is 100% secure. However, we continuously review and improve our security posture to mitigate risks.

15.1 Right to Update

Kofa Africa may update this Privacy Policy from time to time to reflect changes in our data processing practices, new Platform features, applicable law, or guidance from supervisory authorities. Material changes will not be applied retroactively.

15.2 Notification of Material Changes

Where we make material changes to this Privacy Policy, we will notify you by:

• Sending an email notification to your registered email address at least 14 days before the changes take effect.
• Displaying a prominent notice on the Platform homepage and at login for at least 14 days.
• Updating the 'Last Updated' date at the top of this Policy.

For changes required urgently by law, we will implement them immediately and notify you as soon as practicable.

15.3 Continued Use

Your continued use of the Platform after the effective date of an updated Privacy Policy constitutes acceptance of the revised Policy. If you do not agree with any updates, you must cease using the Platform and may request account deletion at info@kofa.africa.

16.1 Primary Contact Points

16.2 Response Timelines

Kofa Africa commits to the following response timelines:

• Acknowledgement of privacy enquiries or rights requests: within 72 hours.
• Substantive response to rights requests: within 30 calendar days (extendable by a further 30 days for complex requests, with notice).
• DPO response to supervisory authority enquiries: within the timeframe required by the applicable regulatory authority.
• Personal data breach notification to supervisory authorities: within 72 hours of becoming aware.

16.3 Supervisory Authority Complaints

You have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction if you believe Kofa Africa has processed your personal data in violation of applicable law. The primary supervisory authorities are:

We would always appreciate the opportunity to resolve any privacy concern directly before a formal supervisory authority complaint is filed. Please contact info@kofa.africa first.