1 Statement of Intent

The purpose of this policy is to be transparent about how the Kembu East Africa Ltd and its subsidiaries will collect, use and protect the personal information you provide to us, whether online, via phone, email, in letters or in any other correspondence or from third parties.

Personal data is information that relates to identifiable living individuals.  Kembu East Africa Ltd will act in accordance with current legislation and meet current best practice with regard to the processing of personal data.  We are committed to safeguarding your personal information.

If you have any queries about this privacy policy, please contact Kembu East Africa Ltd, P. O. Box 23, Njoro 20107, Kenya or email info@kembucottages.com or call +254 722 361102.

 

1.2 Who we are

We are a small, family owned, accommodation business based near Nakuru overlooking the Rift Valley in Kenya.

Kembu East Africa Ltd is a registered company #  C. 115663 incorporated in March 2005

 

2 Collection of personal data

In any contact you have with Kembu East Africa Ltd, you may provide certain personal data to us which we will compile and process in accordance with this Privacy Policy. By providing such information you agree to its use and storage in accordance with the provisions of this Privacy Policy.  For example, this might occur when you engage with our social media, make a donation to us, book a holiday, buy merchandise, register for an event or otherwise provide us with personal information. When you do so, we’ll ask for personal information, like your name, email address and telephone number to store with your account.

When you are using our website, we, like all organisations, are able to collect information about your computer, including where available your IP address, operating system and browser type, for system administration and to report aggregate information. If you are simply browsing our website as an anonymous visitor, the Kembu East Africa Ltd may still collect certain information from you, such as your IP address.

Data protection law recognises that certain categories of personal information are more sensitive. This is known as sensitive personal data and covers health information, race, religious beliefs and political opinions. We do not usually collect sensitive personal data and in such an event clear notices will be provided so that is it clear what information we need and why we need it, such as participation in a fundraising event or where we need this information to ensure that we provide appropriate facilities or support to enable you to participate in an event, or visit one of our properties.

 

2.1 Cookies

Kembu East Africa Ltd also uses cookies on its website. Cookies are small text files on your device. They are made by your web browser when you visit a website. Every time you go back to that website, your browser will send the cookie file back to the website’s server. They improve your experience of using a website, for example, by remembering your preference settings and by measuring your use of a website to ensure that it meets your needs. See our separate Cookie Policy for more detail on how we use cookies and how you can control your cookie preferences.

The use of cookies enables us to:

estimate our audience size and usage pattern;

store information about your preferences, and so allow us to customise our website according to your individual interests;

speed up your searches;

recognise you when you return to our website.

You may refuse to accept cookies by activating the setting on your browser which allows you to refuse the setting of cookies.  However, if you select this setting you may be unable to access certain parts of our website.  Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you log on to our website.

 

2.1 Debit and credit card information

If you use your credit or debit card to make payment to us, buy something online, by post or over the phone, we will ensure that this is done securely and in accordance with the Payment Card Industry Data Security Standard. You can find our more information about PCI DSS here – https://www.pcisecuritystandards.org/security_standards/index.php.

We do not store your credit or debit card details at all following the completion of your transaction. All card details and validation codes are securely destroyed once the payment or donation has been processed. Only staff authorised and trained to process payments will be able to see your card details.

If we receive an email containing any credit or debit card details, it will be immediately deleted, no payment will be taken and you will be notified about this. All purchases can be completed securely through the payment page or online booking section on our website.

 

3 How we use your personal data

Kembu East Africa Ltd shall only use your data for the purposes for which it is provided or where there is a lawful basis.  For example by providing your name, address, email address and telephone number we are able to contact you about your booking requests, holiday reservations, payments and activity bookings (e.g. day excursions).

If you book a holiday, necessary information can be passed to our housekeepers and keyholders.

Bank account details will be collected to process donations and payments.

When we collect and use your personal information, we will make sure this is only done accordance with at least one of the legal grounds available to us under Data Protection law. One of these is where we have obtained your specific consent to use your information for a previously notified purpose, such as to send you email/text marketing or to provide you with a product, service or information at your request.

Another is where we have a legal obligation to use or disclose information about you – for instance, where we are ordered by a court or regulatory authority or we are legally required to hold transaction details for accounting/tax purposes.

In certain instances, we may collect and use personal information where this is necessary in our legitimate interest as a business, this includes being able to:

send direct marketing material by post about our work including holidays and new projects;

conduct research to better understand who our supporters are and better target our fundraising activity; monitor who we deal with to protect our business against fraud, money laundering and other risks; maintain and administer our donor database and systems.

In all cases, we balance our legitimate interests against your rights as an individual and make sure we only use personal information in a way or for a purpose that you would reasonably expect in accordance with this Policy and that does not intrude on your privacy or previously expressed marketing preferences.

Where we process sensitive personal data (as mentioned above), we will make sure that we only do so in accordance with one of the additional lawful grounds for processing such as where we have your explicit consent or you have made that information manifestly public. When we do this, we will tell you what sensitive personal data we are collecting and why.

 

3.1 Marketing materials

We want to ensure you receive the level of information about the Kembu East Africa Ltd that is right for you.

 

3.1.1 Email marketing

If you actively provide your consent to us along with your email address we may contact you for marketing purposes by email. By subscribing to Kembu East Africa Ltd emails or opting in to email communication from the Kembu East Africa Ltd, you grant us the right to use the email for the purposes specified when you opt-in.

 

3.1.2 Postal marketing

If you have provided us with your postal address we may send you information by post about our work unless you have told us that you would prefer not to receive such information. This may include newsletters, marketing of holidays in our buildings, and ways of supporting our work including conservation appeals and other events.

 

3.1.3 Your choices

It is always your choice as to whether you want to receive information about our work, how to support us, and the ways you can get involved. If you do not want us to use your personal information in these ways please indicate your preferences when we collect your data, on either the hard copy form or website registration form.

We will not use your personal information for email marketing purposes if you have indicated that you do not wish to be contacted by us for such purposes. However, we will retain your details on a suppression list to help ensure that we do not continue to contact you.

You may opt-out of our email marketing communications at any time by clicking the ‘unsubscribe’ link in at the end of our marketing emails or by contacting us as detailed in section 5 below. At any time you may opt-out of all postal marketing communications, or preferences for specific postal marketing (e.g. newsletters, fundraising appeals, raffle, legacies) by notifying us of your choices using the contact details given in Section 5.

 

3.2 Targeting communications and fundraising

We use profiling techniques to ensure communications are relevant and timely, and to provide an improved experience to our supporters. Profiling also allows us to target our resources effectively. We do this because it allows us to understand the background of the people who support us and use our services and helps us to make appropriate requests to supporters who may be able and willing to give more than they already do or to tailor our services to better suit them. Importantly it enables us to provide you with a service that it better suited for your needs while raising more funds, sooner, and more cost-effectively, than we otherwise would.

In order to create a profile for you, we (or our trusted service providers as third parties) may use the information which you give us and which we collect from external resources, including information that is publicly available about you. This sort of profiling can include us using information such as your age, where you live, your job, directorships, your financial circumstances, networks and any previous donations you have made, to assess how likely it is that you would be interested in donating to us and the level of donation that you may be able to give.

We may also use this information to help us determine whether and in what ways you might be interested in getting involved in our work and other fundraising activities. If you would prefer your information not to be used in these ways please contact us as detailed in section 5 below.

 

3.3 Third parties

We will only use your information within the Kembu East Africa Ltd for the purposes for which it was obtained. Kembu East Africa Ltd will not, under any circumstances, share or sell your personal data with any third party for marketing purposes and you will not receive offers from other companies or organisations as a result of giving your details to us.

We may need to share your information with “data processors” such as our service providers, associated organisations and agents who help us to prepare and send the materials relating to our projects and fundraising activities. These “data processors” will only act under our instruction and we will not allow these organisations to use your data for their own purposes and will take care to ensure that they keep your data secure.

We will also comply with legal requests where disclosure is required or permitted by law (for example to government bodies for tax purposes or law enforcement agencies for the prevention and detection of crime, subject to such bodies providing us with a relevant request in writing).

 

4 Users aged 16 or under

If you’re aged 16 or under, you must get your parent/guardian’s permission before you provide any personal information on our websites.

 

5 Storage and correction of personal data

We will hold your personal information on our systems for as long as is necessary for the relevant activity, for example we will keep a record of payments for at least ten years.

If you request that we stop sending you marketing materials we will keep a record of your contact details and appropriate information to enable us to comply with your request not to be contacted by us.

The accuracy of your information is really important to us. We want to ensure that we are able to communicate with you in ways that you are happy with, and to provide you with information that is of interest. If you wish to change how we communicate with you, or update the information we hold, then please contact us:

(i)                  by post to Kembu East Africa Ltd, P. O. Box 23, Njoro 20107, Kenya or

(ii)                by email to info@kembucottages.com or

(iii)               by telephone on +254 722 361 102 (Mon-Fri 9am-5pm)

Under current data protection law you have the right to request a copy of the personal information we hold about you and to have any inaccuracies corrected. We require you to prove your identity with two pieces of approved identification.

 

6. Links to other websites

Our website may, from time to time, contain links to and from the websites of other persons. If you follow a link to any of these websites, please note that they have their own privacy policies and that we do not accept any responsibility or liability for them.  Please check those policies before you submit any personal data to those websites.

 

7. Changes to this policy

We may make changes to this Privacy Policy by posting the new version on this website.

Last updated 10th May 2019