1. Who We Are

BookingInGh.com ("we," "us," "our") is a travel marketplace operating from Accra, Ghana. We are the data controller for personal information collected through our website at www.bookingingh.com and related mobile interfaces.

For privacy enquiries, contact us at info@bookingingh.com.

2. Data We Collect

We collect personal data in the following categories:

2.1 Data You Provide Directly

• Account data: Full name, email address, phone number, password (stored as a bcrypt hash — we never store plain-text passwords);
• Booking data: Passenger names, dates of birth, passport/national ID numbers (for flights), contact details;
• Payment data: Payment method type and masked card/wallet details. Full card numbers are handled exclusively by Paystack and are never stored on our servers;
• Communication data: Messages sent via our contact form, live chat, or email support.

2.2 Data Collected Automatically

• Usage data: Pages visited, search queries, booking funnels, session duration;
• Device data: IP address, browser type, operating system, device identifiers;
• Location data: Country-level location inferred from IP address (we do not collect precise GPS location);
• Cookies: See Section 8 below.

2.3 Data from Third Parties

• Google Sign-In: If you authenticate via Google, we receive your name and email address from Google;
• Payment processors: Paystack shares transaction status and masked payment method details with us;
• Airline systems: PassionAir provides booking confirmation data (PNR, ticket numbers) related to your flight.

3. How We Use Your Data

We use your data for the following purposes:

• Booking fulfilment: To create reservations, generate e-tickets, and communicate booking status;
• Payment processing: To initiate and verify payments through Paystack;
• Account management: To maintain your user account, enable logins, and provide booking history;
• Customer support: To respond to enquiries, complaints, and refund requests;
• Security: To detect fraud, prevent unauthorised access, and protect our users;
• Marketing (with consent): To send newsletters, travel deals, and promotional offers — only if you have opted in. You can unsubscribe at any time;
• Platform improvement: To analyse usage patterns and improve our services, search functionality, and user experience;
• Legal compliance: To meet obligations under Ghanaian law and cooperate with lawful requests from authorities.

4. Legal Basis for Processing

We rely on the following legal bases to process your personal data:

• Contract performance: Processing necessary to fulfil a booking or account you have with us;
• Legitimate interests: Fraud prevention, security, platform analytics, and customer support;
• Legal obligation: Compliance with Ghanaian law, tax obligations, or court orders;
• Consent: Marketing communications, which you may withdraw at any time.

5. Data Sharing

We share your personal data only where necessary:

• Airlines (PassionAir): Passenger names, travel documents, and contact details are shared to create and issue airline tickets;
• Hotels & Tour Operators: Your name and contact details are shared with the relevant property or operator to fulfil your booking;
• Paystack: Payment information is passed to Paystack for secure processing;
• Google: If you use Google Sign-In, limited data is exchanged per Google's OAuth protocol;
• Legal authorities: We may disclose data if required by law, court order, or to protect our rights and users.

We do not sell your personal data to advertisers or data brokers. Ever.

6. Data Retention

• Account data: Retained while your account is active and for 3 years after account closure;
• Booking records: Retained for 7 years for tax and legal compliance purposes;
• Marketing data: Deleted upon unsubscription or account closure;
• Support communications: Retained for 2 years.

You may request earlier deletion subject to our legal retention obligations (see Section 9).

7. Security

We take data security seriously and implement industry-standard technical and organisational measures, including:

• HTTPS/TLS encryption on all data in transit;
• Bcrypt password hashing — we never store plain-text passwords;
• PCI-DSS compliant payment processing via Paystack;
• Role-based access controls limiting staff access to personal data;
• Regular security audits and software patching;
• Automated backups stored in encrypted form.

Despite these measures, no system is 100% secure. In the unlikely event of a data breach that affects your rights, we will notify you as required by law.

8. Cookies

We use cookies and similar technologies on our website:

• Essential cookies: Required for login sessions, CSRF protection, and core booking functionality. Cannot be disabled;
• Analytics cookies: Used to understand how visitors use our site (e.g., most popular pages, drop-off points in the booking funnel). These are anonymised;
• Preference cookies: Remember your dark/light mode preference and other UI settings;
• Marketing cookies: Only set if you have consented to marketing communications.

You can manage cookie preferences in your browser settings. Disabling essential cookies will prevent you from logging in or completing bookings.

9. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you;
• Correction: Ask us to correct inaccurate or incomplete data;
• Erasure: Ask us to delete your data ("right to be forgotten"), subject to legal retention obligations;
• Restriction: Request that we limit processing while a dispute is resolved;
• Portability: Receive your data in a machine-readable format;
• Objection: Object to processing based on legitimate interests or for direct marketing;
• Withdraw consent: Withdraw marketing consent at any time via the unsubscribe link in emails or by contacting us.

To exercise any of these rights, email us at info@bookingingh.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

10. Children's Privacy

BookingInGh.com is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly. Adult users booking travel for minors must provide the minor's details solely for travel fulfilment purposes.

11. International Data Transfers

Some of our service providers (e.g., Google, Paystack's infrastructure) may process data outside of Ghana. Where this occurs, we ensure appropriate safeguards are in place, including contractual data protection clauses consistent with applicable law.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be announced via a banner on our website or by email to registered users. The "Last Updated" date at the top of this page always reflects the most recent revision. Continued use of the Platform after a policy update constitutes acceptance of the revised policy.

13. Contact & Data Protection

If you have questions, concerns, or requests regarding your personal data, please contact us: