LalaAfrica
Privacy Policy
LalaAfrica Travel & Hospitality Services Limited
Last updated: March 28, 2026 · Effective immediately
Sections
Introduction
LalaAfrica Travel & Hospitality Services Limited ("LalaAfrica", "we", "us", or "our") operates an Africa-wide hospitality marketplace that connects travellers with hotels, lodges, guesthouses, safari camps, short-term rentals, and other accommodation providers across the continent.
Our services are accessible through multiple channels: our web platform, WhatsApp (via Meta Cloud API), USSD (via Africa's Talking), and a partner portal for accommodation providers.
This Privacy Policy describes what personal information we collect, why we collect it, how we use and protect it, who we share it with, and what rights you have over your data. By using any of our services, you agree to the practices described in this policy.
Information We Collect
Personal Identification Data
- Full name
- Phone number (including WhatsApp number and USSD caller ID)
- Email address
- Country and city of residence
- Government-issued ID (for agent and partner verification only)
Booking & Travel Data
- Property selected and booking dates (check-in / check-out)
- Number of guests and room preferences
- Special requests and guest notes
- Booking confirmation codes and status history
- Cancellation and refund records
Payment-Related Data
- Mobile money account number (used to initiate payment via Selcom — we do not store full account credentials)
- Transaction reference numbers and payment status
- Currency used and total amount charged
Communication Data
- WhatsApp messages exchanged through our automated booking assistant (Meta Cloud API)
- USSD session data and menu navigation inputs (Africa's Talking)
- Support tickets, chat messages, and email correspondence
Device & Usage Data
- IP address and approximate location
- Browser type, version, and operating system
- Pages visited, features used, and time spent on platform
- Referral source (how you found LalaAfrica)
Partner & Agent Data
- Business registration details and license information
- Bank account or mobile money details (for payout purposes)
- Property descriptions, images, and pricing submitted by partners
- Agent performance records and task history
How We Use Your Data
We process your data only for clear, legitimate purposes:
- Process and manage accommodation bookings end-to-end
- Send booking confirmations, reminders, and status updates via WhatsApp, SMS, and email
- Facilitate payment initiation and track payment status
- Provide customer support and resolve disputes
- Enable hotel partners to prepare for your arrival (guest name, dates, requests)
- Prevent fraud, detect abuse, and maintain platform security
- Analyse platform usage to improve features and user experience
- Comply with applicable laws, regulations, and legal processes
- Send service-related communications (not unsolicited marketing)
WhatsApp & Meta Compliance
Meta WhatsApp Business API — Compliance Statement
LalaAfrica uses the WhatsApp Business Platform (Meta Cloud API) to enable booking flows, confirmations, and customer communications via WhatsApp.
How we use WhatsApp
- All WhatsApp interactions are user-initiated or directly related to a service the user requested
- We use WhatsApp to process bookings, send booking confirmation codes, and respond to customer queries
- Our automated booking assistant guides users through property selection, date selection, payment, and confirmation
- Hotel staff may use WhatsApp to confirm guest check-in
What we do NOT do
- We do NOT send unsolicited promotional messages or spam via WhatsApp
- We do NOT share WhatsApp conversation data with advertisers
- We do NOT use WhatsApp data for targeting outside the scope of the service requested
Meta data processing
WhatsApp message routing is governed by Meta's own privacy policy and data processing terms. By messaging LalaAfrica on WhatsApp, you acknowledge that message metadata is processed by Meta in accordance with their policies. We access only the message content and sender phone number necessary to operate our booking service.
Opt-out
You may stop receiving WhatsApp communications from LalaAfrica at any time by sending "STOP" in any conversation with us, or by contacting us at support@lalaafrica.com.
Third-Party Services
LalaAfrica works with the following trusted third-party providers to deliver its services. Each provider processes data under their own privacy policies and applicable data protection regulations.
Meta (WhatsApp Cloud API)
Enables WhatsApp-based booking flows and communications
View their privacy policy →Africa's Talking
Provides USSD and SMS communication channels for booking and notifications
View their privacy policy →Cloud Hosting Providers
Secure infrastructure for storing platform data and running backend services
Analytics Providers
Aggregate, anonymised usage analytics to improve platform performance
Data Sharing
LalaAfrica does not sell your personal data. We share it only where necessary to deliver the service or meet legal obligations:
Accommodation Partners
When you make a booking, we share your name, contact number, check-in/check-out dates, and number of guests with the relevant hotel or accommodation partner to prepare for your arrival. Partners are required to handle this data responsibly and only for the purpose of your booking.
Payment Providers
Your phone number and booking amount are shared with Selcom to initiate and confirm mobile money payments. No additional personal data is shared beyond what is required for the transaction.
Service Providers
We share data with technical service providers (hosting, SMS, WhatsApp, analytics) under strict contractual obligations that prevent them from using your data for any other purpose.
Legal Obligations
We may disclose your information if required by applicable law, court order, governmental authority, or to protect the rights, property, or safety of LalaAfrica, its users, or the public.
Data Security
We take reasonable and appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, or disclosure:
- Data transmitted between your device and our servers is encrypted using TLS/HTTPS
- Access to personal data is restricted to authorised personnel only, on a need-to-know basis
- Payment data is handled by PCI-compliant third-party processors — we do not store card or wallet credentials
- Session tokens and API keys are rotated regularly and never exposed in client-facing code
- Platform infrastructure is monitored for anomalies and unauthorized access attempts
Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy, or as required by law:
- Active account data: retained while your account is active
- Booking records: retained for 7 years for financial, tax, and legal compliance purposes
- WhatsApp and USSD session logs: retained for up to 12 months for support and dispute resolution
- Payment transaction records: retained as required by Tanzanian and applicable financial regulations
- Inactive accounts: data may be deleted after 2 years of inactivity, following a prior notice
- Support tickets: retained for 2 years from resolution
You may request early deletion of your data at any time (see Section 9 — Your Rights). Certain data may be retained longer where legally required or where there is a legitimate ongoing business need.
Your Rights
Depending on your country of residence, you may have the following rights over your personal data:
Cookies & Tracking
Our web platform uses cookies and similar technologies to ensure the platform functions correctly and to understand how users interact with our services.
Essential Cookies
Required for core platform functionality such as session management and login. Cannot be disabled.
Analytics Cookies
Used to measure page views, user flows, and feature usage in aggregate, anonymised form. Help us improve the platform.
Preference Cookies
Remember your settings such as selected currency, language preference, and search filters.
You can manage or disable non-essential cookies through your browser settings. Note that disabling cookies may affect certain platform features.
Children's Privacy
We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us immediately at support@lalaafrica.com. We will promptly delete such information upon verification.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or how we handle data. When we make material changes, we will:
- Update the 'Last updated' date at the top of this page
- Notify active users via email or WhatsApp message where required
- Post a notice on the platform for a reasonable period
Your continued use of LalaAfrica after any changes to this policy constitutes your acceptance of the updated terms. We encourage you to review this policy periodically.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please reach out to us:
Company
LalaAfrica Travel & Hospitality Services Limited
Privacy & Data Requests
support@lalaafrica.comPhone
+255 758 110 055 (Tanzania) · +254 700 000 000 (Kenya)
Offices
Dar es Salaam, Tanzania · Nairobi, Kenya
We aim to respond to all privacy-related enquiries within 30 business days.
© 2026 LalaAfrica Travel & Hospitality Services Limited. All rights reserved.
This policy is publicly accessible at lalaafrica.com/PrivacyPolicy