This policy explains HotelDesk processing under Kenya’s Data Protection Act, 2019 and applicable regulations. For hotel guest and employee records, the subscribing hotel is normally the data controller and the HotelDesk service provider is its data processor. For billing, security and account administration data, the service provider may act as controller.
Information processed
Account and contact details; guest identity and stay information; reservations, room assignments, invoices and payments; staff activity and audit logs; support communications; device, IP, security and diagnostic data; and integration identifiers from M-Pesa and eTIMS. Card PINs, M-Pesa PINs and plaintext provider secrets are not requested.
Purposes and lawful basis
Data is processed to perform the subscription contract, operate hotel workflows, comply with legal and tax obligations, protect systems and users, resolve support requests, and pursue legitimate interests that do not override individual rights. Consent is used where the law requires it.
Sharing and transfers
Data may be shared with authorised hotel users, infrastructure and support providers, Safaricom, KRA, professional advisers and authorities where required. Processors are restricted by contract and security obligations. Cross-border transfers, if any, require safeguards permitted by Kenyan law.
Security and retention
Controls include tenant separation, role permissions, encrypted secrets and backups, audit logging, monitoring and restore tests. Data is retained according to the Customer’s instructions, legal obligations and the Service Agreement. Security records are retained as needed for investigation; archived audit data is encrypted.
Your rights
Individuals may request information, access, correction, objection, restriction, deletion where applicable, or portability. Guest and employee requests should first be directed to the relevant hotel. Complaints may be lodged with Kenya’s Office of the Data Protection Commissioner.
Incidents and contact
Report privacy or security concerns through the Support process and mark them Critical. The service provider will notify the Customer without undue delay where a breach affects Customer Data so the controller can assess required notices. The legal entity, privacy contact and Data Protection Officer details are those stated in the Customer Order Form and must be published before commercial onboarding.