Privacy policy

1. Who is responsible for your data

Blue Jay Travels ("Blue Jay Travels", "we"), trading online at b2c.crmshardagroup.com with its partner Sharda Travel, is the data controller for the personal data collected on this site. Questions and requests about your data go to dakar@bluejay-travels.com or to our 24×7 desk on +221 77 727 85 96.

2. What we collect

We collect only what a booking needs:

• Travellers: title, first and last names, date of birth, nationality, passport number and expiry date (required by the airlines for international flights), and the frequent-flyer or special-assistance details you choose to give.
• Contact: email address, mobile number, country and city, your language, and the account password (stored as a one-way hash).
• Payments: the amount, the method, the provider's transaction reference and, for cards, the brand and the last four digits only. The full card number and the security code go straight to the payment provider and never reach our servers.
• Requests: the details you type into a request form (destination, dates, message) and, for a visa request, the documents you later send to the desk.
• Technical: the IP address and time of sign-ins and of security-relevant actions (kept in an audit trail), the pages requested, and the cookies described in the cookie notice.

3. Why we use it and on what basis

• To make and manage your bookings with the airlines, hotels and other suppliers, to issue the tickets, vouchers, invoices and receipts, and to tell you about your booking: the performance of the contract between us.
• To keep the accounting records of a travel agency, answer the tax authorities and resolve payment disputes: our legal obligations.
• To protect the site and your account against fraud and abuse (sign-in throttling, audit trail): our legitimate interest in running a safe service.
• To send you offers by email: only with your consent, given by ticking the box in your account, and withdrawn with one click at any time.

4. Who receives it

• The suppliers of the services you book, who need it to deliver them: airlines and the global distribution system that holds the reservation, hotels and their booking platforms, insurers, visa centres and consulates, transfer and tour operators. Each applies its own privacy policy.
• Our payment providers (card, Orange Money, Wave, MTN MoMo), who process the payment and return a reference.
• Our email provider, which delivers the booking emails, and our hosting provider, which stores the site.
• The staff of our offices in Dakar, Abidjan, Conakry, Libreville and Jaipur who handle your booking, bound by confidentiality.
• The authorities when the law requires it (customs, immigration, tax, courts). We never sell personal data and never share it for advertising.

5. Transfers outside your country

A reservation is by nature international: the airline, the hotel or the reservation system may be in another country, including outside Africa and the European Union. We send only what the service needs and require our providers to protect the data by contract. For customers in the European Union, transfers rely on the European Commission's standard contractual clauses or on the necessity of the transfer for your own contract.

6. How long we keep it

• Bookings, invoices, receipts, credit notes and payment records: ten years from the end of the financial year, as the accounting and tax rules of the OHADA area and of Côte d'Ivoire and Senegal require.
• Your account (profile, saved travellers): as long as it is open, then three years after the last sign-in or until you close it. Closing the account removes your profile and saved travellers; the bookings stay in the accounting records, anonymised on the customer side.
• Requests to the sales desk: three years after the last exchange.
• Sign-in and security logs: twelve months. Booking-engine logs: ninety days. Emails in the outbox: six months.

7. Your rights

You may ask to see the data we hold about you, correct it, have it deleted when it is no longer needed, object to its use or ask for a copy in a readable format. Your account page offers "Download my data" and "Close my account" for the most common requests; for anything else write to dakar@bluejay-travels.com with the email you book with, and we answer within one month. You may also complain to the data-protection authority of your country: the ARTCI in Côte d'Ivoire (law 2013-450), the CDP in Senegal (law 2008-12), the data-protection authority of your member state in the European Union (GDPR).

8. Security

The site runs over an encrypted connection, passwords are stored hashed, card data never touches our servers, sign-ins are throttled and every sensitive action is logged. Our staff reach your data through individual accounts. No system is perfectly safe: if a breach ever affects your data we will tell you and the authority without undue delay.

9. Cookies

The site sets a session cookie to keep you signed in and a cookie that remembers your language; nothing for advertising or cross-site tracking. The cookie notice lists them.

10. Children

Children's details (name, date of birth, passport) are entered by the adult who books for them and used only for that booking. The site does not open accounts for people under 18.

11. Changes

We update this policy when the site or the law changes; the date at the top tells you when. A change that affects your rights is announced on the site before it applies.