Privacy policy

Maskan Suites rents out furnished short-stay apartments (Airbnbs) in Kilimani, Nairobi. This policy explains what personal information we collect when you visit our website, book a stay, pay, contact us or stay with us, why we collect it, who we share it with, how long we keep it and the rights you have.

We are the data controller for this information under Kenya’s Data Protection Act, 2019. Our head office is at Woodlands Road, Kilimani, Nairobi, Kenya; you can reach us — email [email protected], or call or WhatsApp +254 705 111 222.

When you book or ask about a stay

• Your first and last name
• Your email address and mobile number
• Your country of residence (if you give it)
• Your dates, the number of adults, children and babies, and the apartment you chose
• Your expected arrival time and any special requests
• That you accepted our house rules, cancellation policy and terms, and when
• Whether you asked to receive offers by email, when, and the exact words you agreed to

When you pay

• For M-PESA: the phone number you paid from, the amount and the M-PESA transaction code
• For cards: the amount, the result of the payment and a reference from our payment provider. We never see or store your card number — you enter it on our payment provider’s secure page.
• Any refunds we make to you

When you contact us

• Messages you send us by WhatsApp, phone, SMS or email, and our replies

When you leave a review

• Your review, your rating, the name and country you want shown, the month you stayed, and whether you agreed to us publishing it

When you visit the website

• Our servers and our security provider briefly record technical details such as your IP address, browser and the pages you open, to keep the site running and safe
• We count taps on the WhatsApp, Call and Get directions buttons: which button, on which page and when. These counts do not include your name, phone number, IP address or any identifier, and we use no advertising or tracking cookies. We may also use Cloudflare Web Analytics, which counts visits and page speed without cookies and without identifying you.

When you check in

• A photo of each adult guest’s national ID or passport, and the details on it: name, ID or passport number, nationality and date of birth

We never ask for your ID or passport online — only in person at check-in. We don’t collect sensitive personal data. Your visitors register at the building’s reception, which keeps its own visitors’ record under the building’s rules.

• To take and manage your booking — confirm it, take payment, send your confirmation, check-in details and reminders, handle changes, cancellations and refunds. Basis: to carry out our contract with you.
• To look after you during your stay — answer questions and deal with problems. Basis: contract.
• To know who is staying in our apartments — we record each adult guest’s ID or passport at check-in, for the safety of our guests, neighbours and property, to deal with damage or disputes, and to answer lawful requests from the police or other authorities. Basis: our legitimate interests, and legal obligation where the law requires a record of guests.
• To keep proper records — accounts, tax and payment records. Basis: legal obligation.
• To protect our guests, our apartments and our business — prevent fraud and misuse, keep the website secure, and deal with damage, disputes or claims. Basis: our legitimate interests.
• To improve our website and service — using the anonymous counts described above and the reviews you choose to leave. Basis: legitimate interests.
• To publish your review — only with your agreement, which you can withdraw. Basis: consent.
• To send you occasional offers by email — only if you ticked the box asking for them. Basis: consent.

We do not sell your personal information, and we don’t make decisions about you by automated means alone.

Only with people and companies who need it to provide our service, and only what they need:

• Our team — the staff who manage bookings and look after the apartments
• Safaricom — when you pay by M-PESA
• Our email provider — to deliver your confirmation and other booking emails
• Our hosting and security providers — the companies whose servers run our website and database, and Cloudflare, which protects the site and delivers its pages quickly
• Our backup provider — copies of our database are encrypted before they leave our server, so the provider cannot read them
• WhatsApp (Meta) — when you choose to contact us on WhatsApp, under WhatsApp’s own privacy policy
• Building management and security — your name and stay dates where a building requires them to let you in
• ID and passport records — only with the police or other authorities when the law requires it, or with our lawyers or insurers if there is a claim. Never for marketing.
• Professional advisers and authorities — our accountants, lawyers and insurers, and the police, courts or government bodies when the law requires it

These providers may only use your information to provide their service to us, and must keep it safe.

Some of our providers — for example for hosting, security, email and backups — run servers outside Kenya, including in Europe and the United States. When your information is transferred abroad, we use providers that protect personal data to a standard at least as strong as Kenyan law requires, and we send only what is needed.

• Bookings and payments — for as long as Kenyan tax and accounting law requires us to keep business records (at least five years after your stay)
• ID and passport photos and details — 6 months after your stay, then deleted. We keep them longer only while they are needed for a damage claim, a dispute or a request from the authorities.
• Bookings you started but didn’t pay for, and enquiries that did not become a booking — up to two years
• Messages and emails — for as long as they are useful for your bookings, and no longer than the booking records
• Reviews — while they are published, and for as long as we keep the booking they relate to
• Your agreement to receive offers — until you withdraw it, plus a record that you did
• Technical logs — a short time, usually days or weeks
• Anonymous tap counts — two years, so we can compare with the year before
• Encrypted backups — as long as needed to recover from a failure

When we no longer need information, we delete it or make it anonymous.

Our website only works over a secure (HTTPS) connection. Staff sign in with a password and a second step (an authenticator code or passkey), and see only what their role needs. Card numbers never reach us. Backups are encrypted. ID and passport photos are kept in one secure place that only the staff who check guests in can open, and are not kept on staff’s personal phones or chats. No system is perfectly secure, but if a breach ever puts your information at risk, we will tell you and the Data Commissioner as the law requires.

Under the Data Protection Act, 2019 you have the right to:

• be told how your personal information is used (this policy)
• see the personal information we hold about you and get a copy
• have wrong or misleading information corrected, or deleted
• object to us using your information, including for marketing
• withdraw your consent at any time (for offers by email or a published review) — this does not affect what we did before
• receive your information in a common electronic format, or have it sent to someone else, where the law allows

To use any of these rights, email [email protected], or call or WhatsApp +254 705 111 222. We may ask you to confirm who you are first. We will reply as soon as we can and within the time the law allows.

Some information we must keep by law (for example payment records), even if you ask us to delete it. We will tell you if that applies.

If you are unhappy with how we handled your information, please tell us first. You can also complain to the Office of the Data Protection Commissioner (odpc.go.ke).

We only send offers if you ticked “Send me occasional offers by email” when booking. To stop them, reply to any of our emails asking us to stop, or contact us — we will stop straight away. Booking messages (your confirmation, check-in details and reminders) are part of your booking and are not marketing.

We use only the cookies our website needs to work:

• A booking cookie that keeps your dates held while you fill in your details and pay. It lasts up to two hours.
• Security cookies set by Cloudflare to tell people apart from harmful bots.
• Sign-in cookies for our staff area (they are only set for our staff).

We use no advertising, analytics or social media tracking cookies, so there is nothing to opt out of. Links to WhatsApp, Google Maps, Instagram or Facebook take you to those services, which have their own policies.

Bookings must be made by an adult (18 or over). We collect only the number of children and babies in a booking, not their names or details, unless a parent tells us something we need to know for the stay.

We may update this policy when our service or the law changes. The date at the top shows when it last changed. If a change affects a booking you have already made, we will tell you.