Privacy notice

Queensy BnB (“we”) is the data controller for personal data collected through this website. We process personal data in line with the Kenya Data Protection Act, 2019 and, where it applies to our guests, other data protection laws such as the EU/UK GDPR.

What we collect

• Account details: your name, email address, mobile number (in international format) and a securely hashed password.
• Booking details: the stay, dates, number of guests, price, any notes you add, booking status and payments recorded against it.
• Messages: conversations with our team and enquiries sent through the contact form.
• Preferences and consent: your marketing choices and a record of when you gave or withdrew consent.
• Usage data: first-party, pseudonymous product analytics (for example pages and properties viewed, searches) linked to a random identifier stored in a cookie. We do not store your IP address with analytics, and we don't record analytics if your browser sends a Do-Not-Track or Global Privacy Control signal.

Why we use it

• To create and secure your account and to take, manage and support your bookings (performance of a contract).
• To reply to your enquiries and messages (legitimate interests / steps before a contract).
• To send booking confirmations, updates and replies — these are service messages and are always sent.
• To send offers and news only if you opt in, separately for email, SMS and WhatsApp (consent). You can withdraw consent at any time in your account or via the unsubscribe note in each email.
• To understand how the site is used so we can improve it (legitimate interests), and to meet legal, tax and accounting obligations.

Who we share it with

We don't sell personal data. We share it only with service providers who help us run the platform (for example hosting, database, email delivery and file storage), under contracts that require them to protect it, or where the law requires. Some providers may process data outside Kenya; where they do, we rely on appropriate safeguards as required by the Act.

How long we keep it

Account data is kept while your account is active. Booking and payment records are kept for as long as needed for legal and accounting purposes. Raw analytics events are deleted after about 13 months. Consent records are kept as proof of your choices.

Your rights

You have the right to be informed, to access your data, to object to processing, to have inaccurate data corrected, to have data deleted where there is no legal reason to keep it, and to data portability. You can download a copy of your data from Account → Privacy & communications. For other requests contact us at the contact details on our Contact page. You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.

Security

Passwords are hashed with Argon2id, sessions use secure HTTP-only cookies, and access to customer data is restricted to authorised staff and logged.

Cookies

We use a strictly necessary session cookie to keep you signed in, and a first-party analytics identifier as described above. We don't use third-party advertising cookies.