How Sandy Shells handles guest and booking data.

Sandy Shells is operated by the property owner/operator in relation to accommodation at Sandy Shores, Kikambala, Kilifi County, Kenya. For purposes of this policy, Sandy Shells acts as a data controller where it determines why and how guest or website personal data is processed.

This policy applies to personal data collected through the website, booking forms, enquiry forms, WhatsApp, telephone, email, social media messages, direct invoices, payment references, check-in processes and guest-support communications.

If a booking is made through a third-party platform, that platform may also process personal data under its own privacy policy. Sandy Shells is not responsible for the privacy practices of independent third-party booking platforms.

Sandy Shells aims to process personal data lawfully, fairly and transparently; collect data for explicit and legitimate purposes; limit collection to what is necessary; keep data accurate and updated; retain data only as long as necessary; and apply reasonable safeguards when sharing or transferring data.

These principles reflect Kenya's Data Protection Act, 2019 and the rights guidance published by the Office of the Data Protection Commissioner.

We may collect personal data directly from you when you browse the website, complete a form, submit a booking request, contact us, pay for a booking, check in, request support or provide feedback.

We may collect personal data from another person booking on your behalf, from third-party booking platforms, payment providers, property management or security teams, professional advisers, public authorities or fraud-prevention sources where appropriate.

If you provide personal data about another guest, you confirm that you have their permission or another lawful basis to do so and that you have made this Privacy Policy available to them.

Sandy Shells may process personal data because it is necessary to take steps before entering into a booking, perform a booking contract, comply with legal obligations, protect legitimate business interests, protect vital interests in an emergency or act on consent where consent is the appropriate basis.

Legitimate interests may include property security, fraud prevention, service improvement, guest support, debt recovery, dispute management, website security and direct communication with guests about related services, provided these interests do not override guest privacy rights.

Where we rely on consent, you may withdraw consent at any time, but withdrawal will not affect processing already carried out lawfully before withdrawal.

The website may use essential cookies for security, session management, forms, account access and booking functionality.

The website may also use analytics, performance or marketing cookies to understand how visitors use the website and to improve content, campaigns and user experience.

You can manage cookies through your browser settings. Blocking some cookies may affect website performance or booking functionality.

Sandy Shells does not sell guest personal data. Personal data may be shared only where reasonably necessary for the purposes described in this policy.

Some service providers, software systems, cloud hosting, email, analytics or communication platforms may process or store personal data outside Kenya.

Where personal data is transferred outside Kenya, Sandy Shells will take reasonable steps to ensure appropriate safeguards are in place or obtain consent where required by applicable data protection law.

Sandy Shells keeps personal data only for as long as reasonably necessary for the purpose it was collected, including booking administration, guest service, accounting, tax, legal, security, dispute-resolution, fraud-prevention and business-record purposes.

Typical retention periods may include: enquiry records for a reasonable follow-up period; booking and payment records for accounting and legal retention periods; incident, damage or dispute records for as long as needed to resolve the matter and protect legal rights; and website security logs for a limited security-review period.

When personal data is no longer needed, Sandy Shells will delete, anonymise or archive it in a secure manner, subject to technical backups and lawful retention needs.

Sandy Shells uses reasonable administrative, technical and organisational safeguards to protect personal data from unauthorised access, loss, misuse, alteration or disclosure.

Safeguards may include access controls, password protection, secure hosting, limited staff access, payment verification procedures, backup controls, staff instructions, device security and careful handling of guest identity or payment information.

No website, email, mobile money, internet or storage system is completely secure. Guests should avoid sending unnecessary sensitive information through insecure channels.

Subject to applicable law and reasonable verification, guests may have the right to be informed about how their personal data is used, access personal data held about them, request correction of inaccurate data, request deletion of certain data, object to certain processing, restrict certain processing and request data portability where applicable.

Requests may be sent to reservations@sandyshells.co.ke. Sandy Shells may ask for identity verification before acting on a request and may refuse or limit a request where allowed by law, for example where retention is required for legal, accounting, security or dispute-resolution purposes.

Guests may also raise concerns with the Office of the Data Protection Commissioner in Kenya if they believe their data protection rights have been infringed.

Children may stay at the property as part of a family or authorised booking. Sandy Shells may process limited child-related information where necessary for occupancy, safety, emergency support, legal compliance or service delivery.

A parent, guardian or authorised adult must provide child-related information and is responsible for supervising children during the stay, especially around balconies, pools, stairs, lifts, beach access, water slides and shared facilities.

Sandy Shells may send marketing messages about offers, availability, seasonal promotions or related accommodation services where permitted by law or where a guest has consented.

Guests can opt out of marketing messages by using the unsubscribe method provided, replying with an opt-out request or contacting Sandy Shells directly.

Service messages about existing bookings, payments, safety, policy updates or stay management are not marketing and may still be sent where necessary.

The website may link to third-party websites, maps, social media pages, payment providers, messaging platforms or booking platforms. Those third parties may collect and use personal data under their own policies.

Sandy Shells is not responsible for the privacy practices, content, security or policies of third-party websites or platforms.

If Sandy Shells becomes aware of a personal data breach that may affect guest rights or freedoms, it should investigate promptly, take reasonable containment steps and make any required notifications to affected persons or the relevant authority in accordance with applicable law.

Guests should report suspected privacy or security concerns as soon as possible using the contact details in this policy.

Sandy Shells may update this Privacy Policy from time to time to reflect legal, operational, technology, payment, booking-system or service changes.

The updated version should be published on the website with a new effective date. Material changes may also be communicated directly where appropriate.

Privacy questions, data-rights requests and complaints may be sent to reservations@sandyshells.co.ke or +254 723 807 327.

Postal or physical correspondence may be directed to Sandy Shells at the property address listed above, unless a different official business address is later published.