Privacy Notice

This notice explains how we collect, use and protect your personal data when you visit this website or send us a booking enquiry. It is governed by the Data Protection Act, 2019 ("DPA") and the regulations made under it (in particular the Data Protection (General) Regulations, 2021), giving effect to Article 31 of the Constitution of Kenya.

1. Data Controller

2. Legal framework

The following legal frameworks apply to processing carried out via this website:

• Constitution of Kenya, Article 31 – right to privacy
• Data Protection Act, No. 24 of 2019 ("DPA")
• Data Protection (General) Regulations, 2021 – procedural rights and timelines

3. What data we collect

a) Server log files

When you visit the website, our hosting provider (see section 5) automatically records:

• IP address (truncated or anonymised where possible)
• Date and time of access
• Page accessed and amount of data transferred
• Browser type and operating system
• Referrer URL

Logs are deleted or anonymised after no more than 14 days. Data is not merged with other sources and is not used for profiling. Lawful basis: Section 30(1)(f) DPA – legitimate interest in secure operation of the site.

b) Booking enquiry form

When you submit the contact form we collect:

• Name
• Email address
• Arrival and departure dates
• Number of guests
• Content of your message
• Your IP address (for spam protection and rate-limiting; not stored beyond one hour)

The form is submitted to a small PHP script on our own server hosted by Novahost. From there, the enquiry is forwarded to our mailbox by email. No third-party form services are used.

Lawful basis: your express consent (Section 30(1)(a) DPA) and pre-contractual measures at your request (Section 30(1)(b) DPA). Enquiry data is retained only for as long as required to handle your enquiry, plus any statutory retention periods (e.g. tax records). You may withdraw your consent at any time by emailing us; this does not affect the lawfulness of processing carried out beforehand.

c) Honeypot anti-spam

The form contains a hidden field that real users do not see. If a bot fills it in, the submission is silently discarded. No personal data is collected through this field. Lawful basis: Section 30(1)(f) DPA – legitimate interest in spam prevention.

d) Availability calendar

The calendar shown on this site fetches an iCal feed from Airbnb server-side. Your browser does not connect to Airbnb. No personal data of yours is transmitted to Airbnb.

4. Hosting and data localisation

This website is hosted by Novahost Cloud Limited (novahost.co.ke), Nairobi, Kenya. All site content and form submissions are stored on Novahost servers located in Kenya, in line with the requirement that at least one serving copy of personal data be held on a server within Kenya.

5. Payment

No payment processing happens on this website. Payment is made on arrival in cash or via M-Pesa. We do not collect bank or card details via this site.

6. Cookies and tracking

This site does not set cookies or use comparable tracking technologies. There is no analytics, no advertising network, no third-party tracking pixel and no local-storage tracking. The only browser storage used is your chosen interface language preference, stored locally in your browser and not transmitted anywhere.

7. Fonts

The site uses the typefaces "Cormorant Garamond" and "Inter". Both are hosted locally on our own server. No font data is transmitted to third parties when you view this site.

8. Encryption

This website is delivered exclusively over TLS/HTTPS. You can recognise an encrypted connection by the address bar starting with "https://" and the lock icon in your browser.

9. Your rights as a data subject

Under Section 26 of the DPA, you have the right at any time to:

• Be informed of how your personal data will be used
• Access a copy of your personal data – we will respond within seven (7) days of a written request, in line with Regulation 9 of the General Regulations 2021
• Rectify or correct false, misleading or inaccurate data – we will respond within fourteen (14) days (Regulation 10)
• Have your data erased / deleted when no longer necessary or where you withdraw consent – we will respond within fourteen (14) days (Regulation 11)
• Object to processing of all or part of your personal data
• Restrict processing under specified circumstances
• Withdraw consent at any time, with effect for the future

To exercise any of these rights, please email info@nyotas-gem.com. We may need to verify your identity before fulfilling the request, in order to protect your data from unauthorised disclosure. There is no charge for exercising these rights.

10. Personal data breaches

If a breach of personal data occurs that is likely to result in risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner of Kenya within 72 hours of becoming aware of it (Section 43 DPA), and we will inform affected data subjects without undue delay where the risk is high.

11. Right to lodge a complaint

If you believe your rights have been infringed, you may lodge a complaint with the Office of the Data Protection Commissioner of Kenya (ODPC):

The Commissioner determines complaints within ninety (90) days.

12. Changes to this notice

We reserve the right to amend this notice to reflect changes in legal requirements or our processing activities. The version published on the site at the time of your visit applies.

Last updated: 08.05.2026