Privacy policy

Conifer Travels (“Conifer”, “we”, “us”) sells flights, hotel stays, tours, intercity bus seats, car hire and visa application support, and operates a stored balance we call the Conifer wallet.

For the purposes of the Nigeria Data Protection Act 2023 (NDPA) we are the data controller for the personal data described here. Where we send your data to an airline, hotel, rental supplier or payment provider so that they can fulfil your booking, that company is a controller in its own right and handles your data under its own policy, not ours.

We collect only what a booking platform needs to function.

Passport and identity documents are sensitive personal data under the NDPA. We ask for them only where a supplier or a government requires them - an international ticket, or a visa application - and never as a condition of browsing.

Each use rests on a specific lawful basis:

• To perform our contract with you - creating your account, searching and holding fares, issuing tickets and vouchers, moving money in and out of your wallet, and supporting you afterwards.
• To meet legal obligations - tax and accounting records, anti-money-laundering and sanctions checks carried out by our payment provider, and information airlines and border agencies are required to receive.
• For our legitimate interests - keeping the platform secure, preventing fraud, investigating incidents through the audit log, and improving the service. We balance these against your interests and use the least data that achieves the purpose.
• With your consent - marketing emails, and any optional feature that asks before it collects. You can withdraw consent at any time without affecting anything already done.

We do not sell your personal data, and we do not use it to make automated decisions that produce legal effects for you.

A travel booking cannot be fulfilled by us alone. Below is every category of third party our platform sends personal data to, and what each one receives. We share the minimum each needs.

Suppliers act as independent controllers: once a booking is passed to an airline or hotel, that company decides how it handles your data. Our infrastructure, email, SMS and mapping providers act as processors under contract, may use your data only on our instructions, and may not use it for their own purposes.

Travel is cross-border by nature. If you fly to London or book a hotel in Dubai, your details go to a company in that country. Several of our providers are also based outside Nigeria, including in the European Union, the United Kingdom and the United States.

Where we transfer personal data out of Nigeria we rely on the mechanisms permitted by the NDPA: an adequacy decision where one exists, contractual safeguards with the recipient otherwise, or - for the specific case of fulfilling a booking you asked us to make - the fact that the transfer is necessary to perform our contract with you.

We keep personal data only as long as the purpose requires, then delete it or reduce it to anonymous statistics.

• Passwords are stored only as Argon2id hashes. Nobody at Conifer can read your password, and we cannot send it back to you - only help you set a new one.
• Sessions use short-lived access tokens with rotating refresh tokens. If a refresh token is ever replayed, we treat it as theft and end the entire session immediately.
• Traffic is encrypted in transit with TLS. Access to production data is limited by role, and every action that changes data is written to an append-only audit log.
• We never store full card numbers. Card details are entered on our payment provider’s hosted page, not on ours.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and tell you directly where the risk to you is high.

We do not use advertising cookies and we do not run third-party tracking pixels.

To keep you signed in, we store your session tokens in your browser’s local storage rather than in cookies. We also remember small preferences the same way - the currency you asked to see prices in, and whether you chose the light or dark theme. Clearing your browser storage signs you out and resets those choices.

Our mapping provider may set its own storage when a map loads, to cache tiles. That is governed by their privacy policy.

Under the NDPA you may ask us to:

• Give you a copy of the personal data we hold about you, in a portable format.
• Correct anything inaccurate. Most of it you can edit yourself under Profile.
• Delete your data, where we are not required to keep it for tax, accounting or legal-claim reasons.
• Restrict or object to a particular use, including any processing based on our legitimate interests.
• Withdraw consent to marketing at any time, using the unsubscribe link or by contacting us.

We respond within 30 days. There is no charge unless a request is manifestly unfounded or repetitive. If you are unhappy with our response you can complain to the Nigeria Data Protection Commission.

Conifer accounts are for adults. We do not knowingly create accounts for anyone under 18. Children can of course be travellers on a booking - we hold a child’s name, date of birth and, where required, passport details, supplied by the adult making the booking, who is responsible for having the authority to give them.

When this policy changes we update the date at the top of this page. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect, and where the law requires it we will ask for your consent again.

For anything in this policy, to exercise a right, or to reach our data protection contact, email info@conifertravels.com.

You also have the right to lodge a complaint with the Nigeria Data Protection Commission.