Privacy notice
On this page · 4 sections
In short
- What we collect: only what you type in the quote form — the cover you need, your name, your mobile number, and optionally your email, town and a short note — plus the date and the version of the consent you gave.
- Why: to pass your request to insurers or brokers licensed in your country so they can contact you with a quote. Tulinde is paid by those providers for the introduction.
- Who receives it: the Tulinde team at Takat AI, notified as soon as your request arrives so it can be handled quickly — by e-mail (sent through Resend), by Telegram, and in Takat AI's own customer records (CRM) — and then only insurers or brokers on the regulator's list of licensed companies in your country.
- Where it is stored: on servers in the European Union (Belgium). Your data therefore leaves your country; we only do this with your explicit consent, and we protect it with encryption in transit and restricted access.
- How long: 12 months after your request, then deleted.
- No consent, no transfer: the consent box is never pre-ticked, and without it nothing is sent.
Browsing without asking for quotes
Reading the guides requires no account and no form. We do not use advertising cookies. Our servers keep standard technical logs (address, time, page) for security for a short period.
The AI assistant
The assistant (the "Ask" page and the question bar under the guides) is available in every country. What you type in the conversation is sent to our AI provider, OpenAI (OpenAI's API), only to write the answer, with OpenAI's response storage turned off (`store: false`); OpenAI's own API data policy applies to what it processes. Tulinde does not keep the conversation: your browser sends it again with each question, and our logs keep only counts (number of messages, sources cited), never the text.
Do not type names, phone numbers, e-mail addresses or ID or policy numbers in the conversation: messages that contain them are refused before anything is sent to OpenAI. Keep health details to what matters for the cover (for example "family with two children").
Quote requests from the assistant exist only where quote requests are open (Kenya, Uganda and Tanzania). There, a separate card in the conversation asks for your first name, mobile number and consent. The card goes to Tulinde's quote request, never to OpenAI, and follows the rules of this notice (team notified by e-mail, Telegram and our CRM, then licensed insurers or brokers). Where quote requests are closed (Ethiopia, South Africa and the countries served on tulinde.africa), the assistant asks for no contact details at all and passes nothing on.
Your rights
In every country you can ask to see the data we hold about you, correct it, withdraw your consent, and have it deleted. Withdrawing consent stops any further sharing; providers who already received your request must be contacted directly. You can also complain to the data-protection authority of your country, listed below.
Kenya
Law: the Data Protection Act, No. 24 of 2019, in force since 25 November 2019. Authority: the Office of the Data Protection Commissioner, which receives complaints at cie.odpc.go.ke.
Section 30 allows processing with consent for a specified purpose; section 32 lets you withdraw consent at any time and puts the burden of proving consent on us. Section 48 governs transfers outside Kenya: Tulinde documents the safeguards of its EU hosting and relies on your consent. Section 49 requires consent for sending sensitive data (which includes health data) abroad — the form does not ask for any, so please do not add health details in the optional note.
Tulinde will register as a data controller with the ODPC before launch, as the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 require.
Uganda
Law: the Data Protection and Privacy Act, 2019. Authority: the Personal Data Protection Office, set up within the National Information Technology Authority – Uganda (NITA-U).
Section 7 requires your prior consent — freely given, specific, informed and unambiguous (section 2) — before we collect or process your data. Section 19 allows data to be stored outside Uganda where the other country offers equivalent protection or where you have consented: Tulinde stores data in the European Union and relies on both.
Tulinde will register with the Personal Data Protection Office before launch.
Tanzania
Law: the Personal Data Protection Act, 2022 (Act No. 11 of 2022), in force since 1 May 2023. Authority: the Personal Data Protection Commission.
Section 32(4) of the Act allows personal data to be sent to a country without an adequacy finding when the person has consented. Tulinde relies on your explicit consent for the transfer to EU servers. Data controllers must register with the Commission (sections 14–20); Tulinde will register before launch.
We do not ask for health details in the form. If you write any in the optional note, they are sensitive data under section 3 of the Act; please leave them out — the provider will ask what they need.
Ethiopia
Law: the Personal Data Protection Proclamation No. 1321/2024, in force since its publication in 2024. Authority: the Ethiopian Communications Authority.
Article 8 requires consent that is given before processing, free, informed, specific and clear, and that can be withdrawn. Article 22 requires personal data collected in Ethiopia to be stored on a server in Ethiopia, and cross-border transfers of sensitive data need the Authority's prior approval.
Because Tulinde is hosted in the European Union, we do not collect quote requests from Ethiopia at this stage. Reading our Ethiopian guides collects no personal data.
South Africa
Law: the Protection of Personal Information Act 4 of 2013 (POPIA), whose main sections have applied since 1 July 2020 (The Presidency). Authority: the Information Regulator.
Section 69 forbids direct marketing by e-mail, SMS or automated calls without your consent (or an existing customer relationship). Section 72 allows personal data to be sent abroad only where the recipient is bound by protection substantially similar to POPIA, or where you consent, among other narrow cases.
Tulinde does not collect quote requests from South Africa at this stage. Reading our South African guides collects no personal data.
Botswana
Law: Botswana's Data Protection Act, 2024 replaced the 2018 Act. Its Part XIV allows personal data to leave Botswana on the basis of an adequacy decision, appropriate safeguards or, among other cases, the data subject's explicit consent after being informed of the risks (Data Protection Bill, 2024, sections 74 to 78).
Tulinde does not collect quote requests from Botswana at this stage. Reading our Botswana guides collects no personal data.
Ghana
Law: Ghana's Data Protection Act, 2012 (Act 843) is enforced by the Data Protection Commission, with which data controllers and processors must register (Data Protection Commission).
Tulinde does not collect quote requests from Ghana at this stage. Reading our Ghanaian guides or downloading a free PDF guide collects no personal data.
Malawi
Law: Malawi's Data Protection Act No. 3 of 2024 governs personal data; its data protection authority is the Malawi Communications Regulatory Authority (section 2), and personal data may leave Malawi only to a recipient that affords an adequate level of protection, or under one of the conditions of section 39(4) (section 38).
Tulinde does not collect quote requests from Malawi at this stage. Reading our Malawian guides, or downloading a free PDF guide, collects no personal data.
Namibia
Law: Namibia has no data protection Act in force yet. On 1 October 2026 the Minister of Information and Communication Technology gave notice in the National Assembly of a bill to establish a Data Protection Supervisory Authority and to govern where personal data is hosted and stored (Order Paper, 1 October 2026).
Tulinde does not collect quote requests from Namibia at this stage. Reading our Namibian guides collects no personal data.
Nigeria
Law: the Nigeria Data Protection Act 2023, applied by the Nigeria Data Protection Commission. Its General Application and Implementation Directive (GAID 2025, article 45) makes Part VIII of the Act the governing rule for transferring personal data out of Nigeria (NDPC, GAID 2025). We found no rule requiring personal data to be stored in Nigeria; quotes are closed for the licensing reason above.
Tulinde does not collect quote requests from Nigeria at this stage, and the free guides download without a form. Reading our Nigerian guides collects no personal data.
Rwanda
Law: Law n° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy. Article 50: personal data is stored in Rwanda; storage outside Rwanda needs a registration certificate issued by the supervisory authority, the National Cyber Security Authority (Official Gazette n° Special of 15/10/2021).
Tulinde does not collect quote requests from Rwanda at this stage. Reading our Rwandan guides and downloading the free PDF guides collects no personal data.
Zambia
Law: the Data Protection Act No. 3 of 2021 governs personal data in Zambia. Section 70 requires a data controller to process and store personal data on a server or data centre located in Zambia, unless the Minister prescribes categories that may be stored abroad; sensitive personal data must always stay in Zambia (Data Protection Act 2021).
Tulinde does not collect quote requests from Zambia. Reading our Zambian guides and downloading the free guides collects no personal data.
Zimbabwe
Law: the [Cyber and Data Protection Act [Chapter 12:07]](https://web.archive.org/web/20260119055147/https://zimlii.org/akn/zw/act/2021/5/eng%402022-03-11) protects personal information in Zimbabwe; POTRAZ is the Data Protection Authority. S.I. 155 of 2024 requires anyone processing personal information for a commercial gain to hold a data controller licence.
Tulinde does not collect quote requests from Zimbabwe at this stage. Reading our Zimbabwean guides and downloading the free PDF guides collects no personal data.