Privacy policy

1. Who we are

This policy explains how Mosarow Travels & Tours, a company registered in Nigeria with RC number 8386373, based in Lagos, Nigeria (“we”, “us”, “our”) collects and uses personal data when you use our website and your account, and when you book or apply for our services. We are the data controller for that data.

We handle personal data in line with the Nigeria Data Protection Act 2023 and the rules of the Nigeria Data Protection Commission.

2. The personal data we collect

We collect only what we need for the services you ask for.

Account details: your name, email address, phone number and password. We store your password in a form we cannot read.
Identity and travel details: for you and each traveller or applicant on your account, their legal names, date of birth, sex, nationality, passport number, passport issue and expiry dates and, where given, National Identification Number (NIN). When we check a Nigerian passport, the issuing record may also return the passport photo and signature.
Documents you upload: such as passport pages, photographs, bank statements, academic records, letters and other documents a service asks for.
Application answers: the information a service asks for, such as travel plans, travel history, employment, education and family details. Some applications ask for sensitive details because an embassy or authority requires them. We ask only for what that application needs.
Booking details: flights, travel packages, travellers, dates, airline references, e-ticket numbers and booking history.
Payment records: invoices, amounts paid and refunded, payment references, and for bank transfers the sender’s name, the date and the proof you upload. We do not see or store your full card details: online payments are handled by our payment provider.
Messages: what you send us by email, phone or WhatsApp, and our replies.
Technical data: your IP address, browser and device type, and the times you use our services, kept in our systems’ logs for security.

3. Where we get it from

From you, when you create an account, book, apply or contact us.
From the person who manages your travel, if someone else adds you to their account, such as a family member.
From our identity verification provider, when we check passport details against the issuing record.
From payment providers, airlines, flight booking systems and other suppliers, when they confirm payments, bookings and tickets.

4. Why we use it, and our lawful basis

We use your personal data only where the Nigeria Data Protection Act 2023 allows it:

To provide the services you ask for (to perform our contract with you, or take steps you ask for before entering into one): creating your account, booking flights and travel packages, preparing and submitting applications, raising invoices, taking payments and sending you updates.
To check identity details (to perform our contract with you, and in our legitimate interest in making sure names match passports exactly, because an airline or embassy can refuse a mismatch).
To keep records the law requires (to meet our legal obligations), such as financial, tax and company records.
To keep our services and your account secure, and to prevent fraud (in our legitimate interests, and yours).
To improve our services (in our legitimate interests), using information about how our services are used.
To send you news and offers only if you have agreed to receive them (consent). You can stop them at any time.

Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.

We share personal data only where it is needed for your booking or application, or where the law requires it. We do not sell personal data.

Airlines and flight booking systems, to book and ticket your flights.
Embassies, consulates, visa application centres and immigration authorities, to submit applications you ask us to make.
Schools, universities, tour suppliers, hotels and other partners, for the services you book with them through us.
ZevPay, our payment provider, to take online payments.
Prembly, our identity verification provider, to check passport details against the issuing record.
ZevSend, our email provider, to send you emails about your account, bookings and payments.
Our hosting and storage providers, who run our website, systems and document storage for us.
Professional advisers, such as lawyers and accountants, where needed.
Law enforcement, regulators and courts, where the law requires us to.

Our providers may only use your data to provide their service to us, and must keep it secure.

6. Sending data outside Nigeria

Some of the organisations above are outside Nigeria. For example, an embassy or an airline may be based abroad, and some of our providers store data in other countries. We transfer personal data outside Nigeria only as the Nigeria Data Protection Act 2023 allows: for example, where it is needed to provide the service you asked for, or where the recipient gives an adequate level of protection.

7. How we protect it

Documents are kept in private storage, not on a public website, and are opened through links that stop working after a short time.
Our staff can see personal data only where their work needs it.
Data is sent to and from our website and systems over encrypted connections.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will tell the Nigeria Data Protection Commission within 72 hours of becoming aware of it and, where the risk is high, we will tell you without delay.

8. How long we keep it

Account details are kept while your account is open.
Documents and identity details are kept while your account is open, so you do not have to upload them again for each application. You can ask us to delete a document you no longer need, unless we still need it for an open booking or application, or must keep it by law.
Bookings, applications, invoices and payment records are kept for at least six years after the booking or application ends, because Nigerian tax and company law requires us to keep financial records.
Server logs are kept for a limited time for security, then deleted.

When we no longer need personal data, we delete it or make it anonymous.

9. Your rights

Under the Nigeria Data Protection Act 2023, you have the right to:

be told how we use your personal data, which is what this policy does;
get a copy of the personal data we hold about you;
have inaccurate or incomplete data corrected;
have your data deleted, where we no longer have a lawful reason to keep it;
ask us to restrict how we use your data, or object to our using it, in certain cases;
receive data you gave us in a commonly used format, or have it sent to another organisation, where this applies;
withdraw consent you have given; and
not be subject to a decision based only on automated processing that significantly affects you.

To use any of these rights, contact us by email at hello@mosarowtravels.com, on WhatsApp at +2349059755278 or through our contact page. We may need to confirm your identity first. We will reply within 30 days.

If you are unhappy with how we have handled your personal data, please tell us first so we can try to put it right. You also have the right to complain to the Nigeria Data Protection Commission.

10. Children

Travellers and applicants under 18 are added to an account and managed by a parent or legal guardian. We collect children’s personal data only from the adult responsible for them and only for the booking or application concerned.

11. Cookies and browser storage

We use cookies that are needed to keep you signed in and to keep your account secure. Our website also stores your recent flight searches and airports in your browser, so a search does not have to be typed again. We do not use advertising cookies.

12. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it last changed. If we make a significant change, we will tell you by email or in your account.

13. Contact us

For any question about this policy or your personal data, contact us by email at hello@mosarowtravels.com, on WhatsApp at +2349059755278 or through our contact page.