🔒 Privacy Policy

At HotBook ("we", "our", "us"), accessible at https://hotbook.co.ke, we are committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have over your data.

This policy is written to comply with the Kenya Data Protection Act, 2019 and reflects the requirements of the Office of the Data Protection Commissioner (ODPC). By using HotBook, you agree to the practices described in this policy.

1. Information We Collect

1.1 Information You Provide Directly

When you register, log in, book a room, order food, or contact us, we may collect:

• Account information: Your full name, email address, phone number, and password (stored securely as a hash).
• Booking information: Guest name, phone number, check-in and check-out dates, number of guests, room type, and any special requests.
• Food order information: Pickup date and time, items ordered, and any special instructions.
• Payment confirmation details: M-Pesa confirmation codes and transaction references used to verify your bookings and unlocks.
• Hotel owner information (for hotels): Hotel name, address, contact details, payment till/paybill numbers, and photos.
• Reviews and feedback: Any reviews, ratings, or comments you post on our platform.

1.2 Information Collected Automatically

When you visit our website or use our mobile app, we automatically collect certain technical information:

• Device and browser information: Device type, operating system, browser, screen size, and language.
• Usage data: Pages visited, time spent, features used, and links clicked.
• Approximate location: Derived from your IP address (typically city-level, e.g., "Homa Bay, Kenya").
• Log information: Server logs including IP address, access times, and error reports.

1.3 Information from Third Parties

We may receive limited information from third-party services:

• M-Pesa (via Tuma): Payment confirmation status and transaction references for unlocking hotels.
• Google Analytics: Aggregated, anonymised traffic statistics (see Section 5).

2. How We Use Your Information

We use your information only for the following purposes:

• To provide our services: Creating your account, processing bookings and food orders, unlocking hotel details, and verifying payments.
• To communicate with you: Sending booking confirmations, payment receipts, password reset links, and important service updates.
• To improve HotBook: Analysing usage patterns to make the platform faster, more reliable, and easier to use.
• To ensure security: Detecting fraudulent activity, preventing abuse, and protecting your account.
• To comply with the law: Meeting our legal obligations under Kenyan law, including responding to lawful requests from authorities.

We do not sell your personal information to third parties. We do not use your data for automated decision-making that produces legal effects.

3. Legal Basis for Processing

Under the Kenya Data Protection Act 2019, we process your personal data on the following legal bases:

• Consent: You have given clear consent (e.g., when you accept our cookie banner or create an account).
• Contract: Processing is necessary to fulfil our service agreement with you (e.g., processing a booking you requested).
• Legal obligation: Processing is required to comply with applicable laws.
• Legitimate interest: Processing is necessary for our legitimate interests in operating and improving HotBook, provided it does not override your rights.

4. Sharing Your Information

We share your information only with the following parties, and only as necessary:

4.1 With Hotels

When you make a booking or place a food order, we share your name, phone number, booking details, and any special requests with the relevant hotel. This is required for them to fulfil your booking.

4.2 Service Providers

We use trusted third-party providers to run HotBook:

• Supabase / PostgreSQL: Secure database hosting.
• Render: Backend server hosting.
• Tuma: M-Pesa payment processing.
• Google Analytics: Website analytics (see Section 5).
• Truehost: Domain and website hosting.

4.3 Legal Requirements

We may disclose your information if required by law, court order, or a lawful request from the Office of the Data Protection Commissioner, Kenya Police Service, or other government authorities.

4.4 Business Changes

If HotBook is acquired or merged with another business, your information may be transferred as part of that transaction. We will notify you before any such transfer and any new privacy policy will apply.

5. Cookies & Analytics

5.1 What Are Cookies?

Cookies are small text files stored on your device that help websites remember information about your visit. HotBook uses a small number of cookies for essential functionality and analytics.

5.2 Types of Cookies We Use

• Essential cookies: Required for login, session management, and core functionality. These cannot be disabled without breaking the site.
• Analytics cookies: Set by Google Analytics to help us understand how visitors use HotBook. These are only set after you accept our cookie banner.

5.3 Google Analytics

We use Google Analytics 4 (GA4) to collect aggregated, anonymised information about how our website is used. GA4 collects:

• The pages you visit on HotBook
• How long you spend on each page
• Your approximate location (city-level only)
• Your device type and browser
• How you arrived at HotBook (e.g., from Google, WhatsApp, or directly)

We have enabled IP anonymisation, which means Google truncates your IP address before storing it. GA4 data is retained for 14 months. Google may transfer this data to servers outside Kenya; Google is certified under appropriate data transfer frameworks.

5.4 Managing Cookies

Most browsers allow you to refuse or delete cookies through their settings. If you disable essential cookies, some parts of HotBook may not work. You can also revisit our cookie banner by clearing your browser's local storage for hotbook.co.ke.

6. Payment Information

HotBook does not store your full M-Pesa or bank account details. Payment processing works as follows:

• M-Pesa payments (for unlocking hotels) are processed via Tuma, a licensed payment aggregator. You enter your M-Pesa PIN on your phone — never on our site.
• Booking and food payments are made directly to the hotel's M-Pesa till or paybill. We store only the confirmation code and amount you provide for verification and record-keeping.
• Confirmation codes are stored securely in our database and used only to verify that a payment was made, prevent duplicate use, and generate receipts.

We never see your M-Pesa PIN, and we do not store it anywhere.

7. Data Retention

We keep your personal data only as long as necessary for the purposes described in this policy:

• Account information: Retained while your account is active, and for 12 months after your last login. You can request deletion at any time.
• Booking and order records: Retained for 7 years to comply with Kenyan tax and financial record-keeping requirements.
• Payment confirmation codes: Retained for 7 years as part of financial records, but linked only to booking references, not to your account after 12 months.
• Analytics data: Retained for 14 months in Google Analytics, then automatically deleted.
• Reviews: Retained indefinitely unless you request removal.

8. Data Security

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, alteration, or loss:

• All traffic to and from HotBook is encrypted using HTTPS/TLS.
• Passwords are stored using bcrypt, a strong one-way hashing algorithm. We cannot read your password.
• Our database is hosted on Supabase, which provides encryption at rest and regular automated backups.
• Access to production systems is restricted to authorised personnel only.
• Login sessions use signed JWT tokens that expire after 30 days.

No system is 100% secure. If we ever become aware of a data breach affecting your information, we will notify you and the Office of the Data Protection Commissioner within 72 hours, as required by the Data Protection Act 2019.

9. Your Rights

Under the Kenya Data Protection Act 2019, you have the following rights:

• Right to be informed: You have the right to know what data we collect about you and how it's used (this policy provides that).
• Right of access: You can request a copy of all personal data we hold about you.
• Right to rectification: You can correct any inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): You can request that we delete your account and associated personal data, subject to legal retention requirements.
• Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
• Right to object: You can object to processing based on legitimate interests, including profiling.
• Right to data portability: You can request your data in a machine-readable format (JSON or CSV).
• Right to withdraw consent: If we process your data based on consent, you can withdraw that consent at any time.

To exercise any of these rights, contact us at info@hotbook.co.ke. We will respond within 30 days.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke if you believe we have violated your data protection rights.

10. Children's Privacy

HotBook is not intended for children under 18 years. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at info@hotbook.co.ke and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do:

• We will update the "Effective Date" at the top of this page.
• For material changes, we will notify registered users via email or an in-app notification.
• Your continued use of HotBook after changes are posted means you accept the updated policy.

We recommend checking this page periodically to stay informed about how we protect your data.

12. Contact Us

If you have questions, concerns, or requests about this Privacy Policy or your personal data, please contact us:

Data Protection Officer: For data protection matters specifically, please email info@hotbook.co.ke with the subject line "Data Protection Request".

By using HotBook, you acknowledge that you have read and understood this Privacy Policy.

Last updated: