Privacy Policy

1. What we collect, and why

We collect only data we actually use. These categories reflect what our systems store today:

• Identity and contact details — your name, email address and phone number. Collected when you register an account, make a reservation, place a food order, or send us a message. Used to hold your booking, confirm it, and reach you about it.
• Government identification — identity document type and number (national ID, passport or driving licence), collected at check-in. Kenyan accommodation providers are required to record guest identification, and we use it to confirm that the person checking in is the person who booked.
• Payment information — the amount, method, status and reference of each payment. Card and mobile-money credentials are entered with our payment processor and are not stored on our systems; we keep only the transaction record needed for your receipt and our accounts.
• Stay and order records — reservation dates, room type, occupancy, folio charges, restaurant and room-service orders, and loyalty activity. Used to deliver and bill the service you booked.
• Location data — when you request a delivery, we store the delivery address and the GPS coordinates you supply or approve. Used to establish whether the address falls inside our delivery zone and to get the order to you. We do not track your location in the background.
• Recruitment data — if you apply for a job through our careers site: your CV, date of birth, gender (optional), national ID number, education and employment history, and the referees you name. Used only to assess your application.
• Technical data — IP address, browser and device information, and session cookies. Used to keep you signed in, to keep the site secure, and to diagnose faults.

2. Our lawful basis

Under the Data Protection Act, 2019 we rely on the following grounds:

• Performance of a contract — to take, hold, deliver and bill your reservation or order.
• Legal obligation — guest identification records, and the tax and accounting records we are required to keep.
• Consent — marketing email and SMS, optional profile details, and any location you choose to share. You can withdraw consent at any time.
• Legitimate interest — securing our systems, preventing fraud, and handling complaints.

3. Who we share it with

We do not sell personal data. We share it only with providers who need it to run the service:

• Our payment processor, to take and reconcile payments.
• Our email and SMS providers, to send booking confirmations and — where you have consented — offers.
• Our hosting and infrastructure providers, who store the data on our behalf.
• Government bodies, auditors or advocates, where we are legally required to disclose.

Some of these providers operate outside Kenya. Where personal data leaves Kenya the Data Protection Act, 2019 requires appropriate safeguards; confirming which safeguards apply to each provider is one of the items outstanding in the legal review noted above.

4. How long we keep it

The periods below are the retention rules we intend to apply. They are proposed, and not yet confirmed by counsel:

• Reservation, folio and payment records — kept for the period required by Kenyan tax and accounting law, counted from the end of the financial year in which the stay took place.
• Guest identification records — kept for the period required of licensed accommodation providers, then deleted.
• Account details — kept while your account is open. If you close it, we delete or anonymise your profile and keep only the transaction records we are legally required to retain.
• Delivery coordinates — kept with the order record, and not used for any other purpose.
• Unsuccessful job applications — kept so we can consider you for future vacancies, then deleted. You may ask us to delete yours sooner.
• Marketing contact details — kept until you unsubscribe.

5. Your rights

Under the Data Protection Act, 2019 you have the right to be informed of how your data is used, to access it, to have inaccurate data corrected, to object to processing, to request deletion, and to receive a copy of the data you gave us.

To exercise any of these rights, email info@thealpshotelnakuru.com with "data request" in the subject line, together with the name and phone number you booked under so we can locate your records. We will confirm receipt and tell you what we need in order to verify your identity before acting on the request. We aim to respond within the timeframe set by the Act.

Where a deletion request covers records we are legally required to keep — tax records, for example — we will delete everything else and tell you exactly what has been retained and why.

6. Cookies

We use cookies that are necessary for the site to work: keeping you signed in, keeping your cart, and protecting forms against cross-site request forgery. You can block cookies in your browser, but parts of the booking and ordering flow will stop working if you do.

7. Complaints

If you are not satisfied with how we have handled your data or your request, you may complain to the Office of the Data Protection Commissioner of Kenya. Please raise it with us first — it is usually faster, and we would rather fix it.

8. Contact us

Data protection enquiries: info@thealpshotelnakuru.com
Phone: +254 716 411 119
Address: Maragoli Avenue, Milimani Estate, Nakuru, Kenya

A named data protection contact for The Alps Hotel Nakuru has not yet been appointed. Until one is, requests sent to the address above are handled by hotel management.