Privacy Policy

INTRODUCTION

This Privacy Policy explains how Xcursions ("Xcursions", "we", "our", or "us") collects, uses, stores, discloses, and protects your personal information when you access or use the Xcursions website, mobile application, and related services. By using our platform, you acknowledge that you have read and understood this Privacy Policy and consent to the ways in which we process personal information as described herein. If you do not agree with any part of this Policy, you must discontinue use of our platform immediately.

Xcursions provides a digital environment that enables users to book flights, accommodation, tours, travel packages, airport transfers, eSIM services, eVisa services, travel insurance, and other travel-related offerings. Additionally, the platform provides digital financial services through third-party partners, including NGN and USD-stablecoin wallets, virtual cards, and bill payment solutions. This Privacy Policy applies to all users of the platform, whether browsing, booking travel, creating an account, or utilizing financial tools.

DATA CONTROLLER INFORMATION

For the purposes of Nigeria's Data Protection Act (NDPA) 2023, Xcursions acts as the Data Controller of the personal information collected through its platform. Xcursions determines the purposes for which personal information is collected and the means by which such information is processed. Users may contact Xcursions regarding this Policy at: [email protected].

PERSONAL INFORMATION WE COLLECT

Xcursions collects personal information directly from users, automatically through device interactions, and indirectly from third-party service providers. When users create an account or make a booking, we may collect information including full name, email address, phone number, date of birth, and any additional details necessary to identify the user. Where identity verification or financial compliance is required, we may request government-issued identification, photographs or biometric data, residential address information, and other Know-Your-Customer (KYC) details.

We collect information relating to your travel preferences and booking history, such as flight selections, accommodation preferences, travel dates, eVisa applications, insurance purchases, and tour or transport bookings. When you use financial features such as the wallet or virtual card, we may collect information about deposits, spending patterns, transaction history, card usage data, payment methods, and other financial activity associated with your account.

Additionally, Xcursions collects device information such as IP address, browser type, operating system, unique device identifiers, app version, and interaction data derived from your use of the website or mobile application. Communication data, including chat conversations with support agents or AI assistants, customer service recordings, and email correspondence, may also be collected for quality control, training, and dispute resolution purposes. Sensitive information, such as national identification numbers, passport details, or biometric data, is collected only when necessary for verification, visa processing, fraud prevention, or compliance with legal obligations.

HOW WE USE YOUR PERSONAL INFORMATION

Xcursions processes personal information to provide and improve its services, fulfill contractual obligations, comply with regulatory requirements, prevent fraud, and enhance user experience. When you make travel bookings, we use your information to confirm reservations, provide itinerary updates, coordinate with airlines, hotels, and other suppliers, process payments, and deliver customer support.

Information collected through the wallet and virtual card features is used to facilitate deposits, withdrawals, bill payments, and spending activities. We may also use this information to comply with financial regulations, conduct fraud analysis, enforce transaction limits, and ensure adherence to anti-money laundering laws.

We analyze user behavior, booking trends, and platform interactions to improve platform functionality, tailor recommendations, enhance search results, and personalize user experiences. Xcursions uses contact information to deliver important service-related messages, including booking confirmations, updates about travel disruptions, policy changes, and security alerts.

Where users have provided consent, we may also send marketing communications, promotional offers, curated travel packages, and targeted advertisements based on user interests. Users may withdraw consent for marketing at any time without affecting the legality of prior processing.

LEGAL BASIS FOR PROCESSING PERSONAL INFORMATION

Xcursions processes personal information under several lawful bases recognized by the Nigeria Data Protection Act (NDPA) 2023. These include the necessity to perform a contract when fulfilling travel bookings or providing financial services; compliance with legal obligations, such as identity verification, tax reporting, and anti-fraud requirements; legitimate interests, such as maintaining platform security, detecting suspicious activities, improving services, ensuring operational effectiveness, and providing customer support; consent, which applies particularly to marketing communications, the use of certain cookies, and processing activities not strictly required for service delivery; and protection of vital interests in situations where health, safety, or emergencies may necessitate the sharing of information with authorities or suppliers.

SHARING AND DISCLOSURE OF PERSONAL INFORMATION

To fulfill our services, Xcursions may share your personal information with third-party suppliers and partners. When you book a flight, your information may be transmitted to airlines for ticketing, check-in, and travel processing. Hotel bookings require us to share guest details with accommodation providers to prepare reservations. Tours, transport operators, eSIM providers, eVisa agencies, insurance companies, and other travel partners also receive the information required to deliver their services.

Payment processors, virtual card issuers, banking partners, custodial stablecoin providers, and other financial intermediaries may receive financial information necessary to process transactions, comply with regulatory obligations, and prevent fraud.

Xcursions may also share personal information with technology providers responsible for cloud hosting, analytics, fraud detection, advertising, customer support tools, and communication systems. These partners are obligated to maintain the confidentiality of your information and process it strictly according to our instructions.

We may disclose personal information when required by law, regulatory authorities, or court orders, including for investigations related to fraud, financial crimes, national security, immigration compliance, or other legal matters. In the event of a corporate transaction such as a merger, acquisition, or restructuring involving Xcursions, your personal information may be transferred to the acquiring entity, provided that such entity continues to protect your information in accordance with this Policy.

INTERNATIONAL DATA TRANSFERS

Because Xcursions partners with global travel providers, payment processors, and cloud service operators, your personal information may be transferred to and processed in countries outside Nigeria. While the data protection laws of such countries may differ from Nigerian laws, Xcursions ensures that appropriate safeguards, including contractual protections and secure encryption, are implemented to protect your personal information during international transfers in accordance with NDPA 2023 requirements.

COOKIES, TRACKING TECHNOLOGIES, AND ANALYTICS

Xcursions uses cookies and similar tracking technologies to enhance platform performance, optimize user experience, remember user preferences, authenticate sessions, and analyze platform usage. Cookies may also facilitate personalized recommendations and promotional messages. Users may manage or disable cookies through their browser or device settings; however, doing so may affect certain features or the overall functionality of the platform. Tracking technologies may also be used by third-party analytics services engaged by Xcursions to help us understand usage patterns and make improvements to the platform.

USER RIGHTS UNDER THE NDPA 2023

Under Nigerian law, users have several rights relating to their personal information. You have the right to request access to the information we hold about you, to correct inaccuracies within your data, or to request the deletion of your personal information where legally permissible. You may also request the restriction of processing or object to certain types of processing, particularly where processing is based on legitimate interests or involves direct marketing. Users may request the transfer of their personal information to another service provider where technically feasible. Individuals who previously granted consent for specific processing activities, such as marketing, retain the right to withdraw such consent at any time.

To exercise these rights, users should contact Xcursions via email at [email protected]. We may request verification documents before processing certain requests to protect user privacy and prevent unauthorized access.

DATA RETENTION PRACTICES

Xcursions retains personal information only for as long as necessary to fulfill the purposes described in this Policy. Booking and account information is retained for the duration of the user's active account, and may be stored for several years thereafter to comply with financial regulations, tax obligations, dispute resolution requirements, fraud monitoring, and legal compliance. Financial transaction records, wallet activity logs, and KYC documents may be retained for at least five years or longer where required by Nigerian law. When personal information is no longer required, Xcursions will securely delete, anonymize, or otherwise dispose of the information in accordance with lawful procedures.

SECURITY OF PERSONAL INFORMATION

Xcursions employs a range of administrative, technical, and physical safeguards to protect personal information from unauthorized access, loss, misuse, alteration, or disclosure. These measures include encryption, secure storage protocols, tokenization of financial data, access controls, fraud detection systems, and regular security audits. While Xcursions takes reasonable steps to protect user information, no platform or electronic transmission can be guaranteed as completely secure. Users are encouraged to maintain strong passwords, secure their devices, and promptly notify Xcursions of any suspected unauthorized activity.

CHILDREN'S PRIVACY

Xcursions does not knowingly collect personal information from children under the age of eighteen. Individuals under eighteen are not permitted to create accounts or use our services. If we become aware that personal information belonging to a minor has been collected without appropriate authorization, we will take reasonable steps to delete the information promptly.

AI PROCESSING AND AUTOMATED DECISION-MAKING

Xcursions incorporates artificial intelligence technologies to enhance user experience, improve service recommendations, and assist with customer inquiries. AI-generated responses are based on available data and algorithmic processing, and may not always be accurate, complete, or up to date. AI tools may process user queries, travel preferences, and communication patterns to deliver contextual information. Automated decision-making systems do not produce legal or similarly significant effects without human oversight. Users may request manual review of any decisions or recommendations generated by automated systems.

CHANGES TO THIS PRIVACY POLICY

Xcursions may update this Privacy Policy periodically to reflect changes in our practices, regulatory requirements, or platform enhancements. Updated versions will be published on the platform with a revised "Last Updated" date. Continued use of the platform following any updates constitutes acceptance of the revised Policy.

CONTACT INFORMATION

Users with questions, concerns, or requests relating to this Privacy Policy or their personal information may contact us at [email protected]. We will respond to inquiries within a reasonable timeframe and in accordance with applicable data protection laws.