Privacy notice

Data controller

Glamour Watamu Limited, PIN P052414414P, P.O. Box 694 – 80202 Watamu, Kilifi, Kenya; apartments at Jacaranda Road, Infinity Kira, Watamu, Kenya. For any request about your data: info@dolcevitawatamu.com.

What data we handle

Booking or request data: first and last name, email, phone, country, dates, apartment, number of guests, arrival time, flight and transfer, extras, messages and notes.

Payment data: amount, outcome and transaction code. Card and M-Pesa details are handled by Pesapal only: we never see them.

Stay data: the identity document shown on arrival, where local rules require it, and our correspondence with you.

Browsing data: IP address and technical information logged by the server for security and operation; Google Analytics statistics and the code of the creator who referred you, only with your consent.

We do not ask for sensitive data. If you choose to tell us about health or dietary needs, we use them only to arrange your stay.

Why we handle it

Handling the booking, payments, refunds, pre-arrival messages and the stay: performance of the contract or of pre-contract steps you asked for (Art. 6(1)(b) GDPR).

Keeping accounts and meeting tax and legal duties: legal obligation (Art. 6(1)(c)).

Site security, fraud prevention and backups: our legitimate interest (Art. 6(1)(f)).

Visit statistics and crediting bookings to creators: consent (Art. 6(1)(a)), which you can withdraw at any time from the “Cookie settings” link at the bottom of the page.

Booking data is required: without it we cannot confirm the stay. We do not use your data for advertising or newsletters and make no automated decisions about you.

Who receives the data

Providers processing data on our behalf: Keliweb S.r.l. (Italy), site hosting; Neon (Frankfurt data centre, EU), database; Resend (EU servers), email delivery; Pesapal (Kenya), payments; No More Studio (Italy), site development and maintenance; Google, for Analytics (consent only) and typefaces (Google Fonts receives the IP address).

Booking.com receives only the booked dates from our calendar, with no personal data. We disclose data to the authorities only where the law requires it. We never sell or pass on your data.

Transfers outside the EU

The controller is based in Kenya, so booking data is also processed in Kenya: the transfer is necessary to perform the contract you asked for (Art. 49(1)(b) GDPR). With providers based in the United States, transfers rely on the EU-US Data Privacy Framework or standard contractual clauses.

How long we keep it

Requests that do not become bookings: deleted after 12 months. Bookings and payments: 6 years after the end of the stay, for tax and accounting duties, then deleted. Backups: refreshed daily and kept as long as needed for recovery. Google Analytics statistics: 14 months at most.

Your rights

You can ask for access, rectification, erasure, restriction and portability of your data, object to processing based on legitimate interest, and withdraw consent, by writing to info@dolcevitawatamu.com. We reply within one month.

You can lodge a complaint with the supervisory authority of your country or with Kenya’s Office of the Data Protection Commissioner.

Minors

Bookings must be made by adults. We receive data about children staying with us only from the parent or companion who books.

Cookies and updates

For cookies and similar technologies see the Cookie policy. We may update this notice: the date of the latest version is shown below.