Privacy Policy
In plain English: UtaliiOS is a B2B platform for safari tour operators. We collect data to operate the platform and deliver it to your organisation. We do not sell your data, run advertising, or use tracking cookies. Guest payments are collected via direct bank wire transfer — we track payment records but never process or hold funds. You own your data. You can ask us to delete it at any time (subject to legal retention requirements).
01Who We Are
Metriq Tanzania Limited ("Metriq", "we", "us", "our") is a technology company registered under the laws of the United Republic of Tanzania. We own and operate UtaliiOS (accessible at utalii.tours), a Software-as-a-Service platform for safari tour operators.
For the purposes of applicable data protection laws, Metriq Tanzania Limited is the Data Controller of personal data collected through this website and platform. For personal data processed on behalf of tour operators (their guests' information), Metriq acts as a Data Processor under the instructions of the operator.
Contact: info@utalii.tours | utalii.tours
02Scope & Applicability
This Privacy Policy applies to:
- Visitors to utalii.tours and any subdomains
- Tour operator companies ("Tenants") and their staff members who register for and use UtaliiOS
- Safari travellers ("Guests") whose personal data is entered into the platform by tour operators
- Guests who independently access the UtaliiOS Guest Portal — a secure, personalised booking page delivered via a unique link sent by their operator
- Individuals who contact us via email, forms, or WhatsApp
This policy is written to comply with the Tanzania Personal Data Protection Act, 2022 (PDPA), the EU General Data Protection Regulation (GDPR), the UK GDPR, and the substantive data protection standards of major international frameworks including those of the United States, Canada, Australia, Kenya, and South Africa — to the extent those frameworks apply based on where data subjects are located.
03Data We Collect
3.1 Platform Users (Tour Operator Staff)
- Full name and email address (used for account creation and login)
- Hashed password (we never store plain-text passwords)
- Job role and permissions level within your organisation
- Login timestamps, IP addresses, and session identifiers
- Actions taken on the platform, stored in a tamper-evident audit log
3.2 Guest Data (Entered by Operators)
Tour operators enter the following information about their clients into the platform. Metriq processes this data as a Data Processor under the operator's instruction:
- Full name, email address, nationality, and phone number
- Passport / travel document number and expiry date
- Booking details: travel dates, package, accommodation, pax count
- Dietary requirements, medical notes, and special requests (where provided)
- Payment records: amounts, dates, currency, status, and transaction reference
- A unique guest portal access token (generated by the system, sent to the guest by the operator)
3.3 Guest Portal Activity (Direct Access)
The Guest Portal is a secure, personalised webpage where each safari traveller can independently view their booking, itinerary, and payment records. Access is authenticated by a unique, time-limited token link — guests do not create a username or password on our platform. When a guest uses the portal, UtaliiOS collects:
- Portal access timestamps and originating IP address (security and audit logging only)
- Pages viewed within the portal (not tracked for profiling or advertising)
- Bank wire transfer notifications submitted by the guest: sender name, transfer date, optional transaction reference, and optional notes
- Guest satisfaction ratings and written feedback submitted through the portal review feature (where the operator has enabled it)
- Acknowledgement events — for example, when a guest views or downloads their itinerary
The guest portal link is generated and distributed exclusively by the tour operator. Metriq does not independently contact guests; all communications (portal invitations, itinerary shares, payment requests) originate from the operator's account and are sent under the operator's identity.
3.4 Website Visitors
- Contact form submissions: name, email, company, phone, message
- Server access logs: IP address, browser type, pages visited, timestamps (auto-purged after 30 days)
3.5 Payment Data
UtaliiOS does not process card payments and has no integration with any card payment processor. All guest payments are collected via direct bank wire transfer to the tour operator's own bank account. The platform's role is limited to:
- Displaying the operator's bank account details to guests inside the secure guest portal
- Receiving guest-submitted transfer notifications (sender name, transfer date, optional transaction reference, and optional notes)
- Enabling operators to confirm receipt and record payment against a booking
- Maintaining a payment history record (amounts, dates, status, currency) for each booking
We do not collect, store, or process any card numbers, card expiry dates, or CVV codes. We do not hold, pool, or intermediate any guest funds. Operators' bank account details stored on the platform (for display in guest portals) are encrypted at rest and accessible only to authorised users of that operator's account.
3.6 Technical & Security Data
- Session cookies (strictly necessary — see Section 9)
- Failed login attempts and security events (for fraud and abuse prevention)
- Application error logs (automatically purged after 30 days; no personal data is logged beyond what is necessary for debugging)
04Lawful Basis for Processing
Under GDPR Article 6, we rely on the following lawful bases:
| Processing Activity | Lawful Basis |
|---|---|
| Operator account management & platform access | Contract performance (Art. 6(1)(b)) — necessary to deliver the service you contracted for |
| Guest data processed on behalf of operators | Legitimate interests (Art. 6(1)(f)) — operators' legitimate interest in managing their bookings and delivering travel services |
| Contact form submissions | Legitimate interests (Art. 6(1)(f)) — responding to business enquiries |
| Security logging, fraud prevention, audit trail | Legal obligation (Art. 6(1)(c)) and Legitimate interests (Art. 6(1)(f)) |
| Financial record retention | Legal obligation (Art. 6(1)(c)) — tax and financial compliance laws |
| Session cookies | Strictly necessary — exempt from consent requirement under ePrivacy Regulation and UK PECR |
05How We Use Your Data
- To create and manage your operator account and grant access to authorised team members
- To operate the UtaliiOS platform and deliver all contracted features
- To send transactional emails: booking confirmations, payment receipts, portal access links, password resets
- To enable guest portal functionality for your safari travellers
- To maintain platform security: prevent unauthorised access, detect abuse, and investigate incidents
- To generate aggregated, anonymised performance statistics to improve the platform (no individual is identifiable)
- To comply with legal and regulatory obligations in Tanzania and any other applicable jurisdiction
We do not use your data or your guests' data for advertising, profiling, or marketing to third parties. We do not sell, rent, or trade personal data.
06Data Sharing & Third-Party Processors
We share personal data only to the extent required to operate the platform, and only with the following parties under appropriate data processing agreements:
| Party | Purpose | Basis |
|---|---|---|
| Email delivery provider | Sending transactional emails on behalf of operators | Contract; DPA in place |
| Cloud infrastructure provider | Hosting platform data on secure, access-controlled servers | Contract; DPA in place |
| Law enforcement / authorities | Only when required by a valid legal order or court process | Legal obligation (Art. 6(1)(c)) |
All third-party processors are contractually required to maintain appropriate technical and organisational security measures and may only use personal data for the specified purpose.
07International Data Transfers
UtaliiOS is operated by a Tanzanian company and serves clients globally. Some personal data may be processed or stored by our infrastructure and service providers in jurisdictions outside Tanzania, including within the European Economic Area and other countries with data protection frameworks considered adequate by the Tanzanian Personal Data Protection Commission (PDPC).
Where personal data originating from EU or EEA residents is transferred outside the EEA, we rely on one or more of the following safeguards as required under GDPR Chapter V:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions issued by the European Commission or UK Information Commissioner's Office (ICO)
- Supplementary technical measures (encryption in transit and at rest, access controls)
If you wish to obtain a copy of the specific safeguards in place for any transfer, please contact us at info@utalii.tours.
08Data Retention
| Data Category | Retention Period |
|---|---|
| Operator account & staff records | Duration of the subscription, plus 7 years for financial compliance |
| Booking & guest records | Duration of the active account, plus 7 years (financial & legal obligation) |
| Contact form submissions | 2 years from submission, unless an active business relationship follows |
| Audit logs & security events | 2 years from creation |
| Server & application error logs | 30 days (automatic purge) |
| Closed / deleted accounts (core data) | Purged within 90 days of account closure, except where retention is legally required |
09Cookies & Tracking Technologies
What is a cookie?
A cookie is a small text file stored in your browser by a website. Cookies can remember preferences, maintain login sessions, and gather information about how a site is used.
What cookies does UtaliiOS use?
UtaliiOS uses strictly necessary (essential) cookies only. We do not use advertising cookies, behavioural tracking cookies, or third-party analytics cookies.
| Cookie Name | Purpose | Type | Duration |
|---|---|---|---|
| PHPSESSID | Maintains your authenticated login session across page loads | Essential | Session (deleted when browser closes) |
| portal_token | Guest portal access token for travellers accessing their booking portal | Essential | Session |
| cookie_notice_ok | Records that you have acknowledged the cookie notice (stored in localStorage, not a cookie) | Essential | Persistent (until manually cleared) |
Do I need to consent to cookies?
Under the UK Privacy and Electronic Communications Regulations (PECR), the EU ePrivacy Directive, and their equivalents, strictly necessary cookies do not require prior consent. Since UtaliiOS uses only essential cookies, we do not present a cookie opt-in banner — we do provide this transparent notice instead.
How to control or delete cookies
You can delete cookies or block them through your browser settings at any time. Note that blocking session cookies will prevent you from logging in to the UtaliiOS platform. For instructions, see your browser's help documentation:
10Your Rights — EU & UK
If you are located in the European Union, European Economic Area, or the United Kingdom, you have the following rights under the GDPR (and UK GDPR) with respect to your personal data:
- Right of Access (Art. 15): You may request a copy of the personal data we hold about you, along with information about how it is used.
- Right to Rectification (Art. 16): You may request correction of inaccurate or incomplete data.
- Right to Erasure (Art. 17): You may request deletion of your personal data where it is no longer necessary, where consent is withdrawn, or where processing is unlawful. This right is subject to legal retention obligations (e.g. financial records).
- Right to Restriction (Art. 18): You may request that processing be restricted while a dispute is resolved.
- Right to Data Portability (Art. 20): Where we process data on the basis of contract or consent, you may request a machine-readable copy of your data.
- Right to Object (Art. 21): You may object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.
- Right Not to Be Subject to Automated Decision-Making (Art. 22): UtaliiOS does not make automated decisions with legal or similarly significant effects.
To exercise any of these rights, email info@utalii.tours with the subject line "Data Subject Request." We will respond within 30 days. We may ask for proof of identity before actioning a request.
11Your Rights — Tanzania, Africa & Global
Tanzania (PDPA 2022)
Under the Personal Data Protection Act, 2022 (PDPA) of Tanzania, data subjects have the following rights: to be informed about collection and use; to access, correct, object to, and request erasure of their personal data; and to lodge a complaint with the Personal Data Protection Commission (PDPC). Metriq Tanzania Limited is incorporated under Tanzanian law and our processing is designed to comply with the PDPA 2022 and the Electronic and Postal Communications Act (EPOCA).
Kenya (Data Protection Act 2019)
Kenya's Data Protection Act, 2019 grants data subjects broadly equivalent rights to those under GDPR, administered by the Office of the Data Protection Commissioner (ODPC). Given the volume of Kenyan tourists using UtaliiOS-powered operators, we treat Kenyan data subjects' rights with the same weight as GDPR rights. Complaints: odpc.go.ke.
South Africa (POPIA 2013)
South Africa's Protection of Personal Information Act 2013 (POPIA) establishes eight conditions for lawful processing and grants data subjects rights of access, correction, deletion, and objection. The regulator is the Information Regulator of South Africa. We apply POPIA standards for South African data subjects.
United States
There is no single federal data protection law in the United States. The most significant framework applicable to us is the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), which grants California residents rights to know, delete, correct, opt-out of sale, and limit use of sensitive personal information. The Federal Trade Commission Act (Section 5) prohibits unfair or deceptive data practices at the federal level. We do not sell personal data, which is the most common trigger for CCPA obligations. US residents with privacy questions should contact us at info@utalii.tours.
Canada (PIPEDA)
Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) — and Quebec's Law 25 (the most stringent provincial equivalent) — govern how private-sector organisations collect, use, and disclose personal information. Canadian data subjects may contact us to access or correct their data, and may escalate complaints to the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.
Australia (Privacy Act 1988)
Australia's Privacy Act 1988 and the Australian Privacy Principles (APPs) set out how organisations must handle personal information. Australian data subjects may request access, correction, or lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
Brazil (LGPD)
Brazil's Lei Geral de Proteção de Dados (LGPD, Law 13.709/2018) establishes rights substantially equivalent to GDPR — including access, correction, deletion, portability, and the right to revoke consent. The regulator is the Autoridade Nacional de Proteção de Dados (ANPD). We apply LGPD standards for Brazilian data subjects.
Other Jurisdictions
UtaliiOS serves guests and operators from many additional countries. Regardless of your location, you may always contact us at info@utalii.tours to exercise rights equivalent to those described above. We will respond within 30 days and apply the standard that affords the greatest protection to you as the data subject. Where your jurisdiction has a specific supervisory authority, we will direct you to them if we cannot resolve your request.
| Region / Country | Framework | Supervisory Authority |
|---|---|---|
| European Union / EEA | EU GDPR (Regulation 2016/679) | National DPA in your country — edpb.europa.eu |
| United Kingdom | UK GDPR & Data Protection Act 2018 | Information Commissioner's Office — ico.org.uk |
| Tanzania | Personal Data Protection Act 2022 | PDPC — pdpc.go.tz |
| Kenya | Data Protection Act 2019 | ODPC — odpc.go.ke |
| South Africa | POPIA 2013 | Information Regulator — inforegulator.org.za |
| United States (CA) | CCPA / CPRA; FTC Act §5 | CPPA — cppa.ca.gov | FTC — ftc.gov |
| Canada | PIPEDA; Quebec Law 25 | OPC — priv.gc.ca |
| Australia | Privacy Act 1988 / APPs | OAIC — oaic.gov.au |
| Brazil | LGPD (Law 13.709/2018) | ANPD — gov.br/anpd |
| India | Digital Personal Data Protection Act 2023 | Data Protection Board of India |
| UAE | Federal Decree-Law No. 45 of 2021 | UAE Data Office — tdra.gov.ae |
12Security
We implement the following technical and organisational security measures:
- All data in transit is encrypted using HTTPS/TLS 1.2 or higher
- Passwords are hashed using bcrypt and never stored in plain text
- Session authentication with automatic expiry and token invalidation on logout
- Role-based access control (RBAC) — each user sees only what their role permits
- Full audit logging of all sensitive actions (who did what and when)
- Failed login rate-limiting and account lockout after repeated failures
- Database access restricted to application layer; no direct public access
- Automated backup with off-site retention
Despite our best efforts, no system is completely secure. If you believe a security incident has occurred, please report it immediately to info@utalii.tours.
13Children's Privacy
UtaliiOS is a business-to-business platform intended for use by organisations and adults. We do not knowingly collect personal data from children under the age of 18. If you believe a child's data has been submitted without appropriate authority, please contact us and we will take prompt action to delete it.
14Changes to This Policy
We may update this Privacy Policy as the platform evolves, in response to legal developments, or following feedback from regulators. We will notify active operator accounts of material changes by email at least 14 days before they take effect. The current version is always available at utalii.tours/legal/privacy. The "Last updated" date at the top of this page reflects the most recent revision.
15Complaints
We take privacy complaints seriously. Please contact us first at info@utalii.tours — we will respond within 30 days and aim to resolve your concern directly. If you are not satisfied with our response, you have the right to escalate to your relevant supervisory authority:
- Tanzania: Personal Data Protection Commission (PDPC) — pdpc.go.tz
- Kenya: Office of the Data Protection Commissioner — odpc.go.ke
- South Africa: Information Regulator — inforegulator.org.za
- EU / EEA residents: Your national data protection authority — edpb.europa.eu
- UK residents: Information Commissioner's Office (ICO) — ico.org.uk
- US residents (California): California Privacy Protection Agency — cppa.ca.gov; Federal Trade Commission — ftc.gov
- Canadian residents: Office of the Privacy Commissioner — priv.gc.ca
- Australian residents: Office of the Australian Information Commissioner — oaic.gov.au
- Brazilian residents: Autoridade Nacional de Proteção de Dados (ANPD) — gov.br/anpd
- All other jurisdictions: Contact us and we will identify the appropriate authority for your country.
16Contact Us
| Organisation | Metriq Tanzania Limited |
| Role | Data Controller (platform operations) / Data Processor (guest data on behalf of operators) |
| info@utalii.tours | |
| Platform | utalii.tours |
| Response time | Within 30 days for data subject requests; within 1 business day for general enquiries |