1. Who we are
Nanyuki Country Home (“we”, “us”) is a privately owned holiday home in Nanyuki, Laikipia County, Kenya. We are the data controller for the personal data described here, as that term is used in the Data Protection Act, 2019 (No. 24 of 2019).
You can reach us at nanyukicountryhome@gmail.com or on WhatsApp at +254 723 426190. This policy covers this website, nanyukicountryhome.com, and the enquiries and bookings that come through it.
2. What we collect
- Your enquiry. Name, email address, phone or WhatsApp number, number of guests, check-in and check-out dates, how you heard about us, and whatever you write in the message box.
- Correspondence. What you send us by email, WhatsApp or phone, and our replies.
- Booking details, if the enquiry becomes a stay: guest names, arrival arrangements and payment references. Card details never pass through this website.
- Technical records. Our website host and content delivery network keep standard server logs, including IP addresses and pages requested, to keep the site available and secure.
We run no analytics and no advertising trackers on this site.
3. Why we use it, and our lawful basis
Under section 30 of the Act we rely on:
- Steps taken at your request before a contract — answering your enquiry, checking availability and sending a quote.
- Performance of a contract — managing your booking and your stay.
- Legal obligation — keeping tax and accounting records.
- Legitimate interests — keeping the website secure and working, and preventing fraud and spam.
- Your consent — anything you specifically ask us to do, such as sending you news about the house. You can withdraw consent at any time.
We do not sell your data, and we will not add you to a mailing list without asking you first.
4. Who we share it with
- Formspree (Formspree Inc., United States) receives the enquiry form and delivers it to our inbox.
- Google receives your IP address when the Google Maps panel on our contact page and the Google Fonts used across the site load in your browser.
- GitHub Pages and Cloudflare host and deliver the website.
- Our advisers, or the authorities, where the law requires it.
These providers act as our data processors, or as independent controllers for their own service. None of them receives your data for their own marketing.
5. Data sent outside Kenya
Formspree, Google, GitHub and Cloudflare store and process data on servers outside Kenya. We make those transfers under sections 48 and 49 of the Act: they are necessary to answer your enquiry and to perform our contract with you, and the providers commit to appropriate safeguards in their own terms.
If you would prefer your details not to leave Kenya, contact us on WhatsApp or by phone instead of using the enquiry form.
6. How long we keep it
- Enquiries that do not become bookings — 24 months, then deleted.
- Booking and payment records — 7 years, to meet Kenyan tax and accounting requirements.
- Correspondence — no longer than the purpose it was sent for requires.
7. Your rights
Section 26 of the Act gives you the right:
- to be told how your data is being used;
- to access the data we hold about you;
- to have inaccurate or misleading data corrected;
- to have your data deleted;
- to object to processing, or ask us to restrict it;
- to receive your data in a portable form, where that applies.
We make no decisions about you by automated means, and we do not profile you. To exercise any of these rights, email nanyukicountryhome@gmail.com. We will respond within 30 days and may first ask you to confirm your identity. There is no charge unless a request is clearly unfounded or excessive.
8. Cookies and embedded content
This website sets no cookies of its own and stores nothing in your browser. The Google Maps panel on the contact page may set cookies when it loads or when you interact with it; that is governed by Google’s privacy policy. Our links to Instagram, TikTok and WhatsApp take you to those services, which have policies of their own.
9. Children
This site is not directed at children and we do not knowingly collect their data. Where a booking includes children, the adult making the booking gives us their details and is responsible for doing so.
10. Keeping your data safe
The site is served over HTTPS, enquiries travel over an encrypted connection, and they arrive in a password-protected mailbox and a Formspree account that only the owners can access. No system is completely secure. If a breach affects your rights and freedoms, we will notify you and report it to the Data Commissioner as the Act requires.
11. Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Office of the Data Protection Commissioner at complaints@odpc.go.ke or www.odpc.go.ke.
12. Changes to this policy
If this policy changes, the revised version will be posted on this page with a new date at the top.