Privacy Policy

1Information We Collect

We collect information that you provide directly to us and information that is generated automatically when you use our services. This includes:

• Booking & reservation data: name, email address, phone number, check-in and check-out dates, room preferences, meal-plan selection, and any special requests you share with us.
• Payment information: billing details processed securely through our payment partners. We do not store full card numbers on our systems.
• Communications: enquiries submitted via our contact forms, email correspondence, and telephone recordings where legally permitted.
• Website usage data: pages visited, time spent, referring URLs, device type, and browser type — collected automatically via cookies and analytics tools.
• In-person data: identification documents you present at check-in, as required by Kenyan law and standard hotel practice.

2How We Use Your Information

We use the information we collect for the following purposes:

• To confirm, manage, and fulfil your reservation and any related services during your stay.
• To communicate with you before, during, and after your visit — including booking confirmations, invoices, and post-stay follow-ups.
• To process payments and prevent fraudulent transactions.
• To comply with legal and regulatory obligations applicable in Kenya, including those under the Kenya Data Protection Act, 2019.
• To improve our website, services, and guest experience based on feedback and usage patterns.
• To send you relevant offers and news about Paneah Hotel & Suites, where you have given consent or where we have a legitimate interest. You may opt out at any time.

We will not use your personal data for purposes beyond those listed above without first obtaining your consent.

3Sharing of Information

We do not sell or rent your personal information to third parties. We may share your data only in the following circumstances:

• Service providers: trusted third parties who assist us in operating our website or delivering hotel services (e.g. payment processors, email service providers), bound by strict confidentiality obligations.
• Legal requirements: where disclosure is required by Kenyan law, court order, or a request from a competent public authority.
• Business transfer: in the event of a merger, acquisition, or sale of hotel assets, your data may be transferred as part of that transaction. You will be notified in advance.

Any third party with whom we share data is contractually required to protect it in accordance with applicable data protection laws.

4Cookies & Tracking Technologies

Our website uses cookies — small text files stored on your device — to enhance your browsing experience. We use the following categories of cookies:

• Strictly necessary cookies: required for the website to function correctly (e.g. session management, booking form state). These cannot be disabled.
• Analytics cookies: help us understand how visitors use our site so we can improve it. Data is aggregated and anonymised where possible.
• Preference cookies: remember choices you have made (e.g. language) to personalise your experience.

You can control or disable cookies through your browser settings. Note that disabling certain cookies may affect how the website functions. Our website does not currently use third-party advertising cookies.

5Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes described in this policy, or as required by law.

• Reservation and payment records are kept for a minimum of seven (7) years to comply with Kenyan tax and accounting regulations.
• Guest identification records collected at check-in are retained for the period required by applicable regulations and then securely deleted.
• Marketing preferences and consent records are kept until you withdraw consent.

When data is no longer needed, we securely delete or anonymise it.

6Security

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or disclosure. These measures include:

• Encrypted transmission of data over HTTPS.
• Restricted access to personal data on a need-to-know basis among our staff.
• Secure payment processing handled by PCI-DSS compliant providers.
• Regular review of our data handling practices.

No method of transmission over the internet is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

7Your Rights

Under the Kenya Data Protection Act, 2019, and applicable international standards, you have the following rights regarding your personal data:

• Right to access: you may request a copy of the personal data we hold about you.
• Right to correction: you may ask us to correct inaccurate or incomplete data.
• Right to deletion: you may request that we delete your personal data, subject to any overriding legal obligations.
• Right to object: you may object to the processing of your data for direct marketing purposes at any time.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us using the details in Section 11 below. We will respond within 30 days.

8Third-Party Links

Our website may contain links to third-party websites (for example, map providers or social media platforms). This Privacy Policy applies solely to our own website and services. We are not responsible for the privacy practices of any third-party sites and encourage you to review their privacy policies before sharing any personal information with them.

9Children's Privacy

Our services are not directed to children under the age of 18. We do not knowingly collect personal information from minors. If you believe a child has provided us with personal data without parental consent, please contact us and we will delete it promptly.

10Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Effective Date" at the top of this page and, where appropriate, notify you by email. We encourage you to review this page periodically.

Your continued use of our website or services after any changes constitutes your acceptance of the updated policy.

11Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact our team: