Privacy Policy

PrimeVista Leisure & Travel Co. Ltd ("PrimeVista", "we", "us", "our") is a registered travel agency incorporated in Malawi, operating the website at www.primevistatravel.com and its associated client portal. We act as the data controller for personal information collected through our website and services.

Registered address: Liwonde, Southern Region, Malawi. Contact: info@primevistatravel.com

We collect information in the following ways:

Information you give us directly:

• Full name, email address, phone number, and nationality when you register or make an enquiry
• Passport or travel document details when completing a booking dossier
• Dietary requirements, accessibility needs, or health conditions you voluntarily disclose for trip planning
• Payment references (we do not store full card numbers — payments are processed by certified third-party providers)
• Messages and correspondence sent to us via contact forms, email, or WhatsApp

Information collected automatically:

• IP address, browser type, device type, and operating system
• Pages visited, time spent, and referring URL (via cookies and server logs)
• Approximate location derived from IP address (country/city level only)

• To process and manage your travel bookings and itineraries
• To communicate with you about your journey — confirmations, updates, and changes
• To create and maintain your secure client portal account
• To comply with visa, immigration, and aviation requirements on your behalf
• To send you relevant travel recommendations and seasonal offers (only where you have opted in)
• To improve our website and services through anonymised analytics
• To investigate and respond to complaints or disputes
• To meet our legal and regulatory obligations

We do not sell your personal data. We share it only where necessary:

• Accommodation & lodge partners — to fulfil reservations in your name
• Airlines & transport providers — for ticketing and check-in purposes
• Immigration & visa authorities — as required by law
• Payment processors — who are PCI-DSS certified and do not retain card data
• Our technology service providers — who process data on our behalf under binding data processing agreements

All third parties are contractually required to maintain the confidentiality and security of your information and to use it only for the purpose we specify.

• Booking & client records — 7 years from the date of travel (for tax and legal purposes)
• Marketing preferences — until you withdraw consent
• Enquiries with no resulting booking — 12 months
• Website logs and analytics — 90 days rolling
• Uploaded travel documents — deleted within 30 days of trip completion unless you request otherwise

You have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — request deletion, subject to legal retention requirements
• Restriction — ask us to pause processing while a dispute is resolved
• Portability — receive your data in a structured, machine-readable format
• Objection — opt out of processing based on legitimate interest, including direct marketing
• Withdraw consent — at any time, without affecting prior processing

To exercise any of these rights, email info@primevistatravel.com with your name and the nature of your request. We will respond within 30 days.

We use cookies to keep your session secure and to understand how visitors use our site. See our full Cookie Policy for a detailed breakdown. You may manage your cookie preferences at any time via the banner shown on your first visit.

As a travel agency, some of your data will be shared with partners in countries outside Malawi — for example, international airlines or hotels. Where this occurs, we ensure that adequate safeguards are in place, such as standard contractual clauses or the partner's own certification under a recognised data protection framework.

Our website and client portal are not directed at children under 18. We do not knowingly collect personal information from minors. Where travel bookings include minors, we collect only the information necessary to fulfil the booking, and only from the responsible adult party to the contract.

We protect your data with industry-standard measures including encrypted HTTPS connections, hashed passwords, CSRF token protection on all forms, rate-limited login, and restricted access controls within our systems. While no system is entirely immune to breach, we maintain a vulnerability disclosure policy and will notify affected users without undue delay in the event of a significant data incident.

We may update this policy from time to time to reflect changes in our practices or applicable law. Material changes will be communicated to registered clients by email at least 14 days before they take effect. The "Last Reviewed" date at the top of this page will always reflect the most recent version.

For any questions, requests, or concerns about this Privacy Policy or your personal data, please contact: