Hemingways Hospitality Ltd – Privacy Statement
August 2025
Hemingways Hospitality Limited (and its subsidiaries and affiliates) provides this privacy statement to describe how we may collect, use, share, and otherwise process your personal information, as an employee of one of our corporate clients or other individual to whom we offer or provide our services in hospitality, travel, meetings, events, and related products and services via our websites, mobile applications, email communications or other online and offline means.
Summary of key points
- What information we collect: We collect information about you in connection with your registration, use, purchase, or inquiries about our services.
- How we use your information: We use your information to provide our services, process payments, operate our websites and mobile applications, market products and services, create business insights and comply with law.
- How we share your information: We may have a contract with your employer or travel sponsor, who is our corporate client, with your travel agent or with you directly and we share your information with them, as well as with our affiliates, travel suppliers and vendors to offer hotel accommodation and related services, book travel arrangements and provide our services. We do not sell or share information with third parties so that they can independently market their own products or services directly to you.
- How we protect and store your information: We maintain reasonable administrative, technical, and physical security measures to protect your personal information from unauthorised access and use. The measures include but not limited to:
– Information or data on our computer is secured by strong passwords that are updated frequently.
– Data is encrypted in transit and at rest using industry standard protocols
– Data on removable media is encrypted, password protected and stored in a safe place when they are not in use.
– Only authorised staff can access servers with sensitive data which isguarded by security software. - Marketing and your choices: Subject to your consent, we use your information for marketing and respect your choices about how we communicate marketing to you. We have a simplified opt out mechanism should you not want your personal information used for direct marketing.
- International transfers: We transfer your information outside of your home country as permitted by law. To protect your information, international transfers will be made under appropriate data transfer agreements and other protections.
- Your rights: You have the right to be informed of whether we are processing your information, its usage, and to access, correct, delete, opt-out or object, upon request and free of charge, to our use of your information, to the extent required by applicable law.
- Changes: We will tell you about material changes to this privacy statement by posting it on our website before it goes into effect and, where appropriate, communicating directly to you about the change.
- Questions: If you have questions about this Privacy Statement, please contact us at [email protected]
The Detail – Information We Collect
Account Information – If you contact us, register with us or receive services from us, we collect information about you. This may include your name, email address, phone numbers, employer, and physical addresses. We may also require passport number, gender and date of birth. If we book travel for your travel companions, we may collect similar information about them. Account information goes into your guest/traveller profile, which is where we store the information necessary to provide our services. You may choose to provide more information in your guest/traveller profile, including frequent traveller credentials, government identifiers and emergency contact information.
Travel Information – If you book services with us, we collect the details of your travel (such as arrival and departure location, airline, hotel and car rental, rooming configuration) and any other information needed to complete your bookings. We may also collect special categories of information to provide accessibility, meal preferences or other requested services.
Payment Information – To pay for bookings and other transactions through our services, we collect payment card information and other details necessary to process payments.
Device Data – We collect information about how you access our services, including your computer’s IP address and information that can be derived from it (such as internet provider and general geographic location), your device’s unique identifier and other technical information. We also collect information about how you use our websites and mobile applications. We collect some of this information using cookies and similar technologies.
How we use your information
Provide you with hotel accommodation and related services, travel products and services – We use your information to provide hotel accommodation and related services, book your travel, organise meetings and events, prepare itineraries and invoices, communicate with you about your travel or our products and services, provide customer service, and manage your account.
Provide our products and services to corporate clients – We use your information to comply with our agreements with your employer, travel sponsor, or travel agent, communicate about our products and services, and help them ensure compliance with their policies.
Process payments – We use your information to process transactions and provide you with related customer service.
Operate websites and mobile applications – We use device data to monitor and improve the performance and content of our services, provide updates, analyse trends and usage in connection with our services, and measure whether our ads and offers are effective.
Operate and improve our business – We use your information for compliance with our company policies and procedures, for accounting and financial purposes, to detect or prevent fraud or criminal activity, to perform, analyse and improve our business and services, and otherwise as required by law.
Personal data protection principles
We adhere to the principles relating to processing of personal data set out in the Kenya Data Protection Act of 2019 (DPA) and the Data Protection Regulations in processing your personal information. Your information will:
- be processed lawfully, fairly and in a transparent manner (lawfulness, fairness, and transparency);
- be collected only for specified, explicit and legitimate purposes (purpose limitation);
- be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed (data minimisation);
- be accurate and where necessary kept up to date (accuracy);
- not be kept in a form which permits your identification for longer than is necessary for the purposes for which the data is being processed (storage limitation);
- be processed in a manner that ensures its security using appropriate technical and organisational measures to protect against unauthorised or unlawful Processing and against accidental loss, destruction or damage (security, integrity and confidentiality);
- not be transferred to another country without appropriate safeguards in place (transfer limitation); and
- be made available to you and you will be allowed to exercise certain rights in relation to your personal information (data subject’s rights and requests).
Marketing and your choices
We may use your personal information to tell you about our products and services or those from related businesses (such as restaurants, consumer products, tours, and entertainment), to help us determine whether you may be interested in new products or services, and to present advertising content that is tailored to your interests, location or itinerary (with your consent or as permitted by law). You have the right to select the category of marketing information you would like to receive and how you would prefer to receive it. We have a simplified opt-out mechanism should you not want your personal information used for direct marketing.
Subject to your express consent, we may send you direct marketing on our websites or mobile applications, and through email and other channels, in accordance with applicable law and your choices. You have choices about how we market to you. If you’d like us to stop sending you marketing messages, you can follow the instructions in our communications or update your guest/traveller profile at any time by contacting us at marketing[at]hemingways.co.
We also send you messages that are essential for our services; for example, we communicate with you about your travel, to service your account, to fulfil your requests, or otherwise as required by law. Some of these service messages contain information presented to you as part of our service relationship with your employer or travel sponsor (for example, messages that help you comply with their travel policies). If you opt out of marketing messages, you will continue to receive these service messages.
How we share your information
Your employer, travel sponsor or travel agent – Our services to you may be provided under the terms of service agreements with your employer, travel sponsor or travel agent. We share your information with them to allow them to manage their business travel needs and assure compliance with their company travel policies. At the request of your employer, travel sponsor or travel agent, we may also share information with their vendors.
Affiliates – We may share information within our corporate family to the extent permitted by law to allow them to provide, analyse and improve their and our products and services.
Travel suppliers and other travel service providers – We share information with travel suppliers (for example, airlines and hotels) and travel service providers (for example, ticket distribution systems and travel application providers), and the vendors for both, as necessary to book your travel and provide travel-related services to you and your employer, travel sponsor or travel agent. We do not sell information to third parties so that they can independently market their own products or services directly to you.
Vendors – We share information with vendors that perform functions on our behalf, such as travel agencies, meeting and event planners, visa and passport service providers, mobile application and software developers, and vendors who provide IT support, data hosting, marketing and communications services, and collections. These vendors access information only as necessary to perform their functions, as instructed in our contracts with them.
Business insights – We may combine data from many people to create aggregated statistics that do not identify you personally. We use this data to understand business trends and insights, and we may share them with third parties.
Business transfers – If we negotiate or complete a transaction involving all or part of the business (for example, a reorganisation, merger, sale or acquisition), we may disclose information to third parties involved in the transaction to the extent permitted by law.
As required or permitted by law – We may disclose information to regulatory authorities, courts, and government agencies where we believe doing so would be permitted or required by law, regulation or legal process, or to defend the interests, rights or property of the Hemingways group or others.
We may also share personal information with other parties as directed by you or subject to your consent.
How we protect and store your information
We maintain reasonable administrative, technical, and physical security measures to protect your information from unauthorised access and use.
Administratively:
- we have created an authorization matrix that is used by authorised employees;
- no personal data is processed beyond the intended purpose, and personal data is minimized as much as possible;
- we have confidentiality commitments taken from our employees who may come in contact with your personal information;
- we have ensured that the contracts we have signed with third parties, to whom data is transferred, include data security provisions; and
- we have organised that the necessary security measures are in place in relation to the entry and exit of areas that contain personal data.
Technically:
- we use firewalls. intrusion detection and prevention systems to secure the personal data we collect;
- we use strong and up to date anti-virus software for detection of malware;
- the access logs to the information systems are kept in a way that prevents any user intervention;
- all the personal data is retained upon being backed up, and adequate security measures have been put in place;
- we have means to limit the access rights to a specific range of data within the personal data set processed in the IT system.
We retain your information only as long as needed to provide our Services, for legitimate business purposes and in accordance with our Data Retention policy, unless we are required by law or regulation or for litigation and regulatory investigations to keep it for longer periods of time. Accordingly, we maintain a data retention policy and schedule that outlines the appropriate retention periods for different types of data in accordance with legal, regulatory, and business requirements, unless a different time period is provided under law or regulation or for litigation and/or regulatory investigations. Our data retention practices are designed to protect individuals’ privacy rights, and mitigate risks associated with data storage in compliance with the DPA.
International transfers
We may transfer your information to jurisdictions outside of your home country, including to countries with commensurate levels of data protection as your home country if it is necessary for the provision of our services to you. Any such transfer of your personal data will be carried out in compliance with applicable laws and we will take reasonable steps to ensure that there are appropriate safeguards in place with respect to the security and protection of your personal data. To protect the information, transfers will be made in accordance with appropriate data transfer agreements and other protections. Regardless of where we process your information, we protect it in the manner described in this Privacy Statement and in accordance with applicable laws.
Your rights
If you have created an online account with us and would like to update the information you have provided to us, you can access your account to view and make changes or corrections to your information. You also have the right to be informed of whether we are processing your information and to access, correct, delete or object, upon request and free of charge, to our use of your information. To exercise these rights, please contact us at: dataprotection.hospitality[at]hemingways.co. We will try to comply with your request as soon as reasonably practicable. Please note that we may need to retain certain information for recordkeeping, to complete any transactions you began before your request, or for other purposes as permitted by law.
Children’s Privacy
In compliance with the DPA and the data protection regulations, we recognise the importance of protecting the privacy of children when processing their personal data. We will only process personal data of children where we have obtained verifiable consent from their parent or guardian, or where processing is otherwise permitted by the DPA and any other applicable laws.
Our data processing activities prioritise the best interests of children and adhere to the principle of data minimisation, purpose limitation and confidentiality. We provide for clear and age-appropriate information regarding the processing of children’s data and also have mechanisms against unauthorised access, disclosures, alteration, or destruction. Parents and guardians may review, update, or request the deletion of their children’s data by contacting us through the provided channels.
We do not knowingly collect or solicit personal data from anyone under the age of 18 or knowingly allow such persons to use our services. If you believe we have inadvertently collected personal information from a child without the consent of their parents or guardian, please contact us, and we will take appropriate steps to delete the information.
Changes
We may change this Privacy Statement from time to time as our business changes or legal requirements change. If we make material changes to this Privacy Statement, we will post a notice on our website before the changes go into effect, and notify you as otherwise required by applicable law.
Questions
If you have questions or complaints about Hemingways Hospitality Limited and privacy, please contact us at:
PO Box 146, 00502 Nairobi, Kenya
Tel: +254 20 2295 000
Email : dataprotection.hospitality[at]hemingways.co
In most cases, we will ask that you put a complaint in writing. We will investigate your complaint and will generally respond to you in writing within 30 days of receipt. If we fail to respond or if you are otherwise dissatisfied with the response that you receive from us, you may have the right to make a complaint to your regulator.
Cookies and similar technologies
We use session and permanent “cookies,” small data files transferred to your device, along with similar technologies (e.g., internet tag technologies, web beacons and embedded scripts) (collectively referred to herein as “cookies and similar technologies”) to help provide you a better, more personalised user experience (technical cookies). These technologies are used to make the user experience more efficient, remember your preferences (such as browsing language and account login information) (profile cookies), and help us understand and improve how visitors use our websites, including which of our pages and products are viewed most frequently (analytical cookies), and to allow us to market our products and services and third-party products and services to you (advertising cookies).
The Options/Settings section of most internet browsers and devices will tell you how to manage the cookies and other technologies that may be transferred to your device, including how to disable such technologies. You can disable our cookies or all cookies through your browser or device settings, but please note that disabling cookies may impact some of the website’s features. Other than as described above, we generally do not comply with “do track signals” sent by web browsers.
For more information on managing cookies, visit the help pages for Microsoft Edge, Internet Explorer, Firefox, Chrome, or Safari.
more at
Hemingways
