Privacy Policy

This website is run by Chalo Villas and Farms, M12 Mchinji Road, opposite Chitedze Research Station, Chitedze, Lilongwe, Malawi. We are responsible for the personal information described here. Contact us about privacy at [email protected] or +265 887 13 48 84.

• Stays: your name, email, phone number, dates, villa, number of guests, any notes you add, and how you chose to pay.
• Table and Ride the Farm bookings: your name, contact details, date and time, party size or number of riders, and anything you tell us, such as dietary needs.
• Event tickets: your name, email, phone number, ticket details and payment status.
• Gatherings and enquiries: your contact details, your organisation if you give it, and what you tell us about your plans or question.
• Newsletter: your email address.
• Job applications: your name, contact details, town or city, the role, your CV, cover letter and the details of your referees. Please let your referees know you have shared their details.
• Browser notifications: if you turn them on, a technical subscription address for your browser.
• Payments: payment references and status, and any proof of payment you send us. This website does not ask for your mobile money PIN or banking password. You complete payment in your own app.
• Website use: technical information such as your IP address, used to run and protect the site, and analytics information if you allow it (see Cookies below).

• To respond to you, and to manage and confirm your booking, tickets or event.
• To take payment and keep financial records.
• To prepare for your visit, including any dietary needs you tell us about.
• To send the newsletter or browser notifications you asked for. You can stop these at any time.
• To assess job applications, arrange interviews and contact referees.
• To understand how the site is used and measure our marketing, if you allow analytics cookies.
• To keep the site secure and meet our legal obligations.

We use your information because you asked us to provide something, because you consented, because the law requires it, or for our legitimate interest in running the estate.

We do not sell your personal information. We share it only with the services that help us operate:

• OneKhusa and your mobile money provider or bank, to process payments.
• SMTP2GO, to send booking and enquiry emails.
• MailerLite, to send the newsletter.
• Supabase and Render, which store data and host our website and recruitment systems.
• Meta, only if you accept analytics cookies.
• WhatsApp, if you choose to contact us there. Their own privacy terms apply.

We may also share information where the law requires it. Some of these services operate outside Malawi, so your information may be processed in other countries. We choose established providers and share only what they need to do their job.

We keep a small record in your browser of your cookie choice, and use what the site needs to work. With your permission, we also load the Meta Pixel, which uses cookies to measure visits and actions such as starting a booking, and to measure and improve our advertising. It does not load unless you choose to allow analytics.

You can change your choice at any time using Cookie settings at the bottom of every page.

We keep information only as long as we need it for the purposes above or as the law requires. As a guide:

• Bookings, payments and financial records: 7 years.
• Enquiries and gathering briefs that do not lead to a booking: 2 years.
• Job applications that do not lead to a role: 12 months.
• Newsletter details and browser notification subscriptions: until you unsubscribe or turn them off.

You can ask us to tell you what we hold about you, give you a copy, correct it or delete it. You can also object to how we use it, or withdraw consent you have given. Some records may need to be kept by law. To make a request, contact [email protected].

If you are unhappy with how we have handled your information, you can complain to the Malawi Data Protection Authority, under the Data Protection Act, 2024. The Malawi Communications Regulatory Authority (MACRA) serves as the Authority. Visit dpa.mw or email [email protected].

We use encrypted connections and limit access to personal information. No system is completely secure, so please contact us straight away if you think your booking link or details have been misused.

Bookings and job applications should be made by adults aged 18 or over. Parents and guardians provide any details about children in their party.

We will post any changes on this page and update the date above. See also our Terms and Conditions.