Privacy  Policy  

CTS powered by Ya Halaa

Last updated: 23 July 2026

1. About This Policy

1.1 — This Privacy Policy explains what personal data we collect, why we collect it, how we use, share, store, and protect it, and the rights you have over it. It applies when you use our website at www.yahalaa.africa (the “Website“), contact us by email or messaging, make a booking enquiry, or book any of our tours, transportation, accommodation, or package services (the “Services“).

1.2 — We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL“) and other applicable UAE law. This policy must be read together with our Terms & Conditions and Payment & Refund Policy.

1.3 — If you provide us with personal data of other people — for example, other travellers in your group, including children — you confirm that you are authorised to do so on their behalf and that you have made this policy available to them.

2. What We Collect

2.1 — Enquiry and contact data. Your full name, email address, and phone number, which are required for every booking request, together with the content of your communications with us (email, contact forms, WhatsApp and other messaging).

2.2 — Booking and travel data. Names of all travellers as they appear in passports, dates of birth and ages of children, travel dates, flight details, pick-up and accommodation details, and any special requirements you disclose (including dietary, accessibility, health, or mobility information relevant to participation).

2.3 — Identity documents. Copies of passports for all travellers. These are required to make bookings with accommodation providers, parks, and other suppliers, and for our legal and tax compliance obligations. If you do not provide them, we may be unable to deliver the affected Services (see clause 2.7–2.8 of our Terms & Conditions).

2.4 — Payment data. Invoicing details and records of payments and refunds. Card and online payments are processed by our payment providers (currently PayTabs, Network International, Tabby, and Trust My Travel); we do not collect or store your full card numbers. Bank transfer details you provide for refunds are used only to process the refund.

2.5 — Website and device data. IP address, device and browser type, pages visited, and similar log data, collected through cookies and similar technologies (see clause 8).

2.6 — Photographs and video. Images taken during tours and Services for marketing purposes, subject to the consent and withdrawal rights in clause 10 of our Terms & Conditions.

3. Why We Use Your Data

We use personal data for the following purposes:

3.1 — To provide the Services — responding to enquiries, preparing quotations and custom packages, confirming bookings, arranging services with suppliers, communicating itineraries and pick-up times, and providing support before, during, and after travel. This processing is necessary to enter into and perform our contract with you.

3.2 — To meet legal obligations — including UAE tax, accounting, and record-keeping requirements, responding to lawful requests from UAE authorities, and preventing fraud and misuse of our Services.

3.3 — To communicate with you — including service messages about your booking, and, where you have not objected, occasional marketing about our Services. You can opt out of marketing at any time (clause 7).

3.4 — To operate and improve the Website — maintaining security, diagnosing technical issues, and understanding how the Website is used.

3.5 — We do not use your personal data for automated decision-making that produces legal effects for you, and we do not sell your personal data.

4. Who We Share It With

4.1 — Suppliers. We share booking data — including traveller names, passport copies where required, ages of children, and relevant special requirements — with the third-party suppliers who deliver your Services (accommodation providers, transport operators, guides, parks, and activity operators), strictly to the extent needed to deliver the Services you booked.

4.2 — Payment providers. Payment-related data is processed by our authorised payment providers to take payments and process refunds.

4.3 — Service providers and advisers. We use third-party providers for website hosting, booking platform services, communications, and professional services (accounting, legal), under obligations of confidentiality and only for the purposes described in this policy.

4.4 — Authorities. We disclose personal data to UAE or other competent authorities where required by law, including to the Federal Tax Authority in connection with tax compliance.

4.5 — We do not otherwise disclose your personal data to third parties without your consent.

5. International Transfers

5.1 — Because our Services are delivered in South Africa, booking data (including passport copies where required by suppliers) is transferred to suppliers and service providers outside the UAE, principally in South Africa. Some of our technology and payment providers may also process data in other jurisdictions.

5.2 — Where we transfer personal data outside the UAE, we do so in accordance with the PDPL, limiting transfers to what is necessary to deliver the Services and requiring recipients to protect the data and use it only for the intended purpose.

6. How Long We Keep It

6.1 — We keep personal data only as long as needed for the purposes described in this policy, and in particular:

6.2 — When the applicable period ends, we delete the data or irreversibly anonymise it.

7. Marketing

7.1 — We may send you occasional marketing about our Services by email or messaging. Every marketing message includes a way to opt out, and you can opt out at any time by writing to info@yahalaa.africa. Opting out does not affect service messages about an active booking.

7.2 — We do not share your personal data with third parties for their own marketing.

8. Cookies

8.1 — The Website uses cookies and similar technologies to keep the Website working, remember preferences, and understand how the Website is used. You can block or delete cookies through your browser settings; some Website features may not function fully without them.

9. Security

9.1 — We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or disclosure, including access controls and secure storage, and we require the same of our service providers. No transmission or storage system is completely secure, and we encourage you to contact us immediately at info@yahalaa.africa if you believe your data has been compromised.

9.2 — If a personal data breach occurs that poses a risk to your privacy or security, we will notify the competent authority and, where required, affected individuals in accordance with the PDPL.

10. Your Rights

10.1 — Subject to the conditions and exceptions in the PDPL, you have the right to:

(a) access the personal data we hold about you and receive information about how it is processed; (b) correct inaccurate or incomplete data; (c) request deletion of your data — noting that data we are legally required to keep (such as tax and booking records, including passport copies, within statutory retention periods) cannot be deleted until those periods expire; (d) object to or restrict certain processing, including direct marketing; (e) withdraw consent where processing is based on consent (including for marketing photographs), without affecting processing already carried out; and (f) request transfer of your data in a structured, machine-readable format where the PDPL provides for it.

10.2 — To exercise any right, write to info@yahalaa.africa. We may need to verify your identity before acting on a request, and we will respond within the timeframes required by the PDPL.

10.3 — If you are not satisfied with our response, you have the right to lodge a complaint with the UAE Data Office, the federal data protection authority.

11. Children’s Data

11.1 — We collect data about children (such as names, ages, and passport copies) only as provided by their parent or guardian for the purpose of delivering the booked Services. Identifiable images of children are used in marketing only with the consent of a parent or guardian, as set out in our Terms & Conditions.

12. Third-Party Websites

12.1 — The Website may link to third-party websites, including payment provider and booking platform pages. Their privacy practices are governed by their own policies, which we encourage you to read. This policy does not apply to them.

13. Changes to This Policy

13.1 — We update this policy from time to time. The current version, with its “last updated” date, is always available on the Website. If we make material changes to how we use your personal data, we will notify you by email or by prominent notice on the Website before the change takes effect, and where the PDPL requires consent for a new use, we will ask for it.

14. General

14.1 — This policy is governed by the laws of the United Arab Emirates.

14.2 — This policy is available in English and Arabic. In the event of any inconsistency, the English version prevails.

14.3 — For any questions about this policy or your personal data, contact us at info@yahalaa.africa.

About us. CTS is a brand operated by Ya Halaa Limited, a company registered in Masdar City Free Zone, Abu Dhabi, United Arab Emirates (Licence No. MC14266), with its registered address at Incubator Building, Masdar City, Abu Dhabi, UAE (“CTS”, “we”, “us”, “our”). Ya Halaa Limited is the data controller for the personal data described in this policy.