Darrel Paradise Resort (“we”, “us”) respects your privacy. This policy explains what personal data we collect when you use our website, book a stay, send an enquiry or visit the resort, why we use it, who we share it with and the rights you have under the Data Protection Act, 2019 (Kenya).
Who is responsible for your data
We are the data controller for the personal data described here. You can contact us about privacy at any time:
Darrel Paradise Resort
Bungoma–Mumias Road, Kabula, Bungoma County, Kenya
Email: info@darrelparadise.co.ke
Phone: +254 700 477 045 / +254 736 350 599
What we collect
- Enquiries and messages: your name, email, phone number, the subject of your enquiry and what you write to us, plus our replies.
- Bookings: stay dates, number of guests and rooms, children’s ages where you provide them, special requests, and payment status. Card or mobile-money details are entered with the payment provider and are not stored by us.
- Guest accounts: your name, email, password (stored only in hashed, one-way form), phone number, and two-step verification settings. If you sign in with Google we receive your name, email address and Google account identifier.
- Events and quotations: event details you share with our events team, quotations, invoices and receipts.
- Celebrations: if you choose to tell us about birthdays or anniversaries, the day and month (and year only if you give it) so we can send greetings. Information about a child is only added by a parent or guardian.
- Virtual concierge: the questions you ask our website assistant and its answers.
- Technical data: your IP address, browser type and the pages you visit, used for security, fraud prevention and — only if you agree — analytics.
Why we use your data, and our lawful basis
- To provide what you ask for — answering enquiries, taking and managing bookings, events and payments (performance of a contract, or steps before entering one).
- To meet legal obligations — keeping financial and tax records and responding to lawful requests.
- To keep our services secure — preventing spam, fraud and unauthorised access (our legitimate interests).
- With your consent — sending offers and news, celebration greetings, and analytics cookies. You can withdraw consent at any time.
Who we share it with
We do not sell your personal data. We share it only with service providers who help us run the resort and this website, under agreements that protect it, such as:
- our website hosting and email delivery providers;
- payment providers that process your payments;
- Google, if you sign in with Google, if analytics cookies are accepted (Google Analytics), when a map is loaded, or for spam protection on forms;
- an artificial-intelligence provider that generates answers for the virtual concierge (only the conversation is sent, not your account or booking records);
- professional advisers and authorities where the law requires it.
Some providers process data outside Kenya. Where they do, we rely on safeguards permitted under the Data Protection Act, 2019.
How long we keep it
- Booking, invoice and payment records are kept for as long as tax and accounting laws require.
- Enquiries that do not lead to a booking are deleted after about two years.
- Virtual concierge conversations are deleted after about 90 days.
- Account data is kept while your account is active; you can ask us to delete it.
Cookies
We use essential cookies to keep you signed in, protect forms against forgery, remember your colour theme and, if you choose, remember a trusted device for two-step verification. Analytics cookies are only set if you accept them in the cookie banner; you can change your choice at any time with Cookie settings at the foot of each page.
How we protect it
We use encrypted connections, hashed passwords, encrypted storage for sensitive settings, two-step verification for staff, role-based access so staff see only what they need, and an audit log of sensitive actions. Photos uploaded to our website have location data removed.
Your rights
Under the Data Protection Act, 2019 you have the right to be informed about how your data is used, to access it, to correct or delete it, to object to its use, to withdraw consent and to receive your data in a portable format. You can also unsubscribe from marketing using the link in any message. To exercise a right, contact us using the details above; we may ask you to confirm your identity.
If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
Children
Our website is not intended for children to use on their own. Information about children (for example, ages for a booking or a birthday greeting) is only provided by a parent or guardian.
Changes to this policy
We may update this policy. The date at the top shows when it was last changed; significant changes will be highlighted on the website.