Policies
Privacy policy
Draft for legal review. This page is a starting template and has not been reviewed by a lawyer. It must be reviewed against Kenyan and EU law before the site goes live. Set legal_reviewed to true in config.php to remove this notice.
Last updated: 21 October 2026
Who we are
This policy explains how [Registered business name], [Business address]. Email: [contact email] ("ELEVÉ STAYS", "we") handles personal data collected through this website. We act as the data controller. [Registration number with the Office of the Data Protection Commissioner, if applicable: to be added.]
What we collect
- Reservation details: your name, email address, phone or WhatsApp number, dates, number of guests, dietary needs and any notes you give us.
- Identity documents: a copy of your passport or government ID, which we require to verify guests before check-in.
- Payment: card payments are handled by Stripe. We never see or store your full card number. We keep the payment reference, amount and status.
- Enquiries and waitlist: the details you submit in an enquiry or waitlist form.
- Website usage: only if you accept analytics cookies, we count page views and button clicks. We do not store your IP address or a personal identifier for this.
Why we use it
- To check availability, confirm and manage your reservation, and take payment (performance of a contract).
- To verify identity before arrival and keep our residences and guests safe (legitimate interests, and legal obligations where they apply).
- To send booking confirmations, reminders and your house booklet (performance of a contract).
- To reply to enquiries and, if you ask, notify you when a residence opens (your request or consent).
- To understand how the website is used, only with your consent.
Who we share it with
Only service providers who help us run the service: Stripe (payments), our web hosting provider (Hostinger), and our email provider. Concierge, transfer or experience partners receive only what they need to deliver a service you request. We do not sell personal data.
Transfers outside Kenya
Stripe and some providers process data outside Kenya, including in the United States and the European Union. We rely on contractual safeguards with these providers. [Lawyer to confirm the transfer basis.]
How long we keep it
- ID documents for requests that are declined, expired or cancelled are deleted within 24 hours.
- ID documents for completed stays: [retention period to be confirmed, for example 90 days after check-out].
- Booking and payment records: [period to be confirmed to meet tax and accounting obligations].
- Analytics counts contain no personal data and are kept for reporting.
Your rights
Under the Kenya Data Protection Act, 2019 and, where it applies to you, the EU General Data Protection Regulation, you may ask to access, correct or delete your data, object to or restrict its use, withdraw consent, and receive a copy of your data. Contact us at the address above. You may also complain to the Office of the Data Protection Commissioner in Kenya or to your local supervisory authority.
Security
ID documents are stored in a private location that is not reachable from the public website, and only the owner can open them. Payments are encrypted in transit.
Changes
We may update this policy and will change the date above when we do.