Privacy

Avora Executive Homes, of Altura, Upper Hill, Nairobi, Kenya, is the data controller for the information described here. Questions or requests go to stays@avoraexecutivehomes.com, or you can reach a person through the contact page.

We handle your information under Kenya’s Data Protection Act 2019. If you would like our registration details with the Office of the Data Protection Commissioner, ask and we will send them.

Only what a booking actually needs:

Your name

So we know who is arriving

Email address

To send your confirmation and reach you about the stay

Phone number

Optional. Used for WhatsApp on the day of arrival

Country

Optional. Helps us plan arrivals and airport transfers

Your dates and party size

To hold the apartment and price the stay

Anything you write to us

The note on the booking form, if you use it

Marketing preference

Only if you tick the box

We also keep a record of each booking’s status changes, of the emails we send you about it, and of what has been paid against it. For security we store a one-way hash of the network address a booking request came from, so the form cannot be flooded. That hash cannot be turned back into an address.

We never see your card. Paying online sends you to Paystack’s own payment page, where you enter your card or M-Pesa details directly with them. Those details are never transmitted to this site and are not stored here. What comes back to us is the amount, the method used, and whether it succeeded.

Paystack is our payment processor, which means we pass them your email address and the amount to be charged so they can take the payment and send you a receipt. They are a separate company with their own privacy policy, and they keep records of the transaction as their own regulator requires. We do not pass them anything else about you.

The films on the apartment page are hosted by Instagram. Nothing is requested from Instagram, and no cookie of theirs is set, unless you press play — until then the page shows our own photograph. Pressing play loads their player, and from that point their terms and privacy policy apply to it as they would if you watched it on Instagram itself.

Whether or not you book, we keep a simple record of pages being read: which page, when, the network address the request came from, the country that address belongs to, and the make of browser. A random identifier is stored in a cookie so we can tell a returning browser from a new one. On its own it identifies the browser, not you. If you are signed in to an account, the pages you read while signed in are recorded against that account, so we can see what a guest looked at before booking or asking us something.

We do this to know whether anybody is finding the site and where they are coming from, which decides where we advertise and what we write. It is our own record, on our own server; nothing is shared with an advertising network or analytics company, and there is no third-party tracking script on this site. Everything in it is deleted after 90 days.

Four, all set by us. None come from advertisers, and none follow you to other sites.

avora_booking

Lets your browser reopen a booking you have already opened from your confirmation email. 60 days.

avora_guest

Keeps you signed in to your account, if you have one. 30 days.

avora_visitor

A random identifier, so a returning browser is counted once rather than as a new visitor each time. 1 year.

avora_admin

Signs our own staff into the booking console. 12 hours.

Because we are performing the booking contract you asked us to make, and because we have a legitimate interest in keeping the apartment from being double-booked, the booking form from being abused, and in knowing whether the website is reaching anyone. Marketing email is sent only on consent, and you can withdraw it at any time.

• Amazon Web Services — hosting, the database and the email that carries your confirmation. Data is held in the eu-north-1 region, which is Stockholm, Sweden.
• Nobody else. We do not sell personal information, and we do not list the apartment on booking platforms, so nothing is passed to one.

Because that hosting is outside Kenya, your information is transferred abroad. Under section 48 of the Data Protection Act 2019 we do this on the basis that the transfer is necessary to perform the contract between us — you cannot be sent a booking confirmation without your booking being stored and your email being sent. Amazon Web Services holds the data under its own contractual data-protection terms, and Sweden is subject to the European Union’s data-protection regime.

Booking records

7 years, which is what Kenyan tax law requires

Enquiries that never became a booking

12 months, then deleted

Email delivery records

24 months, so we can show what was sent

Marketing consent

Until you withdraw it

Anti-abuse hashes

24 hours

Under the Data Protection Act 2019 you may ask us for a copy of what we hold, ask us to correct it, ask us to delete it, object to how we use it, or ask us to stop sending marketing. Write to stays@avoraexecutivehomes.com and we will reply within 30 days. There is no charge, and we will not ask why.

Some of it you can do yourself: signing in to your account shows the bookings we hold for you. Ask us and we will delete an account outright — though we have to keep the booking records themselves for as long as tax law requires.

If you think we have got it wrong, you can complain to the Office of the Data Protection Commissioner in Nairobi. We would rather you told us first.

If this page changes materially we will say so here and update the date at the top. The booking terms are separate.