1. Data we collect

• Booking & stay details: name, contact details, stay dates, preferences, party size, payment status (tokenized by payment providers), and correspondence.
• Website & forms: contact/booking form submissions, support messages, and metadata (time, IP, user agent).
• Operational data: invoices/receipts, incident reports, and records needed to meet legal and tax obligations.
• Cookies & device data: pages viewed, referrers, and aggregated analytics (see Cookies).

2. How we use your data

• Provide services you request: reservations, check-in/out, event bookings, billing, and guest support.
• Send transactional messages (e.g., booking confirmations, amendments, receipts, check-in instructions).
• Improve operations, safety, and website functionality.
• Comply with law (e.g., tax, accounting, record-keeping) and defend legal claims.

3. Lawful bases

We process personal data based on one or more of: (i) performance of a contract (your reservation or event booking); (ii) legitimate interests (operate a safe and efficient hotel, prevent fraud, answer inquiries); (iii) consent (when you choose to provide optional information); and (iv) legal obligations (tax and accounting records).

4. Cookies & analytics

We use strictly necessary cookies to run the site, plus optional analytics cookies to understand site usage in aggregate. You can adjust your browser settings to refuse cookies; some features may not function without them.

If anti-spam protection (e.g., CAPTCHA) is enabled on forms, your IP and interaction data may be processed by the provider to prevent abuse; their privacy terms will apply.

5. Sharing & processors

We share personal data with trusted service providers who act on our instructions, such as:

• Website hosting and analytics
• Email and messaging providers for transactional notices
• Payments and invoicing platforms
• IT security, maintenance, and backup services

We do not sell personal data. We disclose information when required by law or to protect our rights, guests, and staff.

6. International transfers

Service providers may process data in other countries. Where applicable, we use appropriate safeguards (such as contractual protections) consistent with data protection requirements.

7. Retention

We keep personal data only as long as needed for the purposes above and to meet legal, accounting, or reporting requirements. Typical retention is the booking period plus the limitation period required by law.

8. Security

We apply organizational and technical measures (access controls, encryption in transit, least-privilege access, and monitoring). No method of transmission or storage is 100% secure, but we work to protect your data.

9. Your rights

Subject to applicable law, you may have rights to access, correct, delete, or receive a copy of your data, to object or restrict certain processing, and to withdraw consent where processing is based on consent.

To exercise rights, use the contact details below. We may request information to verify your identity.

10. Children

Our services are not directed to children without appropriate adult involvement. If you believe a child provided personal data without necessary consent, please contact us and we will take appropriate steps.

11. Changes to this policy

We may update this policy to reflect operational, legal, or regulatory changes. We will adjust the “Last updated” date above and, where appropriate, provide additional notice.

12. Contact

Legacy Hotel & Conference Centre
Maralal Rd – Mburu Gichua Rd, Nakuru, Kenya
Phone: +254 720 630 778
Email: info@legacyhotel.co.ke
Website: legacyhotel.co.ke