PRIVACY POLICY
Entim Sidai Wellness Sanctuary
Last Updated: 16th October 2026
- Introduction
Entim Sidai Wellness Sanctuary (“we,” “us,” or “our”) is committed to protecting your privacy and handling your personal data with care and transparency. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you visit our website, make a booking, or use our services.
We process personal data in accordance with the Kenya Data Protection Act, 2019 (DPA) and all applicable regulations. As a data controller, we are committed to upholding the principles of lawful, fair, and transparent data processing.
- Scope
This Privacy Policy applies to all personal data we collect and process from:
- Website visitors
- Guests staying in our accommodation (standard rooms and villas)
- Spa and wellness clients
- Restaurant (Enkima) diners
- Event and conference organisers and attendees
- Enquirers and subscribers
- Service providers and partners
- What Personal Data We Collect
We may collect the following categories of personal data:
Information you provide directly:
- Identity data — full name, date of birth, gender
- Contact data — email address, phone number, postal address
- Booking data — reservation dates, room or service preferences, guest numbers
- Payment data — billing details, payment method (processed securely via third-party providers)
- Health data (for spa and wellness services) — relevant medical conditions or treatment preferences
- Communication data — enquiries, feedback, reviews, and correspondence
Information collected automatically:
- Technical data — IP address, browser type, device information, operating system
- Usage data — pages visited, time spent on the site, referring URLs
- Cookie data — as described in Section 10 below
Health data is considered sensitive data under the DPA and is subject to additional protections.
- How We Collect Your Data
We collect personal data through:
- Online booking and enquiry forms on our website
- Email, telephone, or in-person correspondence
- Spa and restaurant reservations
- Event and conference bookings
- Website cookies and analytics tools
- Third-party booking platforms (where applicable)
- Guest feedback and review platforms
- Purpose of Data Collection
We process your personal data for the following purposes:
- To process and manage bookings, reservations, and enquiries
- To provide our accommodation, spa, dining, and event services
- To communicate with you about your visit or booking
- To personalise your experience and improve our services
- To process payments and maintain financial records
- To respond to your enquiries, feedback, and complaints
- To comply with legal, regulatory, and tax obligations
- To send you promotional offers or updates (only with your consent, and you may opt out at any time)
- To ensure the safety and security of our guests and premises
- Lawful Basis for Processing
We process your personal data based on one or more of the following lawful grounds under the DPA:
- Consent — where you have given us clear permission (e.g., to send marketing communications)
- Contract performance — where processing is necessary to fulfil a booking or service you have requested
- Legal obligation — where we are required to process data to comply with the law
- Legitimate interest — where processing is necessary for our legitimate business interests, provided your rights are not overridden
- Vital interest — where processing is necessary to protect your health or safety (e.g., in a medical emergency)
- Data Sharing and Disclosure
We do not sell your personal data. We may share it with:
- Trusted service providers — payment processors, booking systems, IT support, and marketing platforms that assist us in operating our business
- Wellness partners — where you have requested Ayurvedic treatments or other partner services, relevant details may be shared with the partner practitioner
- Professional advisers — lawyers, accountants, and insurers, where necessary
- Legal and regulatory authorities — where required by law, court order, or to protect our legal rights
- Business transfers — in the event of a merger, acquisition, or sale of assets
All third-party service providers are contractually required to protect your data and process it only for the purposes we specify.
- Data Retention
We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. Specifically:
- Booking and financial records — retained for five (5) years from the end of the reporting period, in accordance with the Tax Procedures Act and the Income Tax Act of Kenya.
Enquiry data (where no booking is made) — retained for up to two (2) years.
- Marketing data — retained until you withdraw your consent.
- Website analytics — retained for twenty-six (26) months after your last visit.
When data is no longer needed, it is securely deleted or anonymised.
- Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:
- Encryption of data in transit and at rest
- Access controls limiting data access to authorised personnel only
- Regular security reviews and audits
- Secure disposal of physical and electronic records
- Staff training on data protection and confidentiality
While we take reasonable steps to safeguard your data, no online transmission or storage system is completely secure. We cannot guarantee absolute security.
- Cookies
Our website uses cookies and similar technologies to enhance your browsing experience, analyse site traffic, and remember your preferences.
Types of cookies we use:
- Essential cookies — necessary for the website to function
- Analytics cookies — help us understand how visitors use our site
- Preference cookies — remember your settings and choices
You can manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect your experience on our website.
- Your Rights as a Data Subject
Under the Kenya Data Protection Act, 2019, you have the following rights:
- Right to be informed — to know how your personal data is being used
- Right to access — to request a copy of the personal data we hold about you
- Right to rectification — to request correction of inaccurate or incomplete data
- Right to erasure — to request deletion of your personal data where there is no lawful reason for us to retain it
- Right to object — to object to the processing of your personal data in certain circumstances
- Right to restriction — to request that we limit the processing of your data
- Right to data portability — to receive your data in a structured, commonly used format
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time
- Right not to be subject to automated decision-making — including profiling, where it produces legal or similarly significant effects
To exercise any of these rights, please contact us using the details in Section 15. We will respond within the timeframe required by the DPA.
- Children’s Privacy
Our services are not directed at children under the age of 18. We do not knowingly collect personal data from minors without verifiable parental or guardian consent. If you believe we have inadvertently collected data from a minor, please contact us so we can take appropriate action.
Rights of minors may be exercised by a parent or guardian.
- International Data Transfers
Your personal data is primarily stored and processed within Kenya. Where we transfer data outside Kenya, we will ensure that adequate data protection safeguards are in place, or we will obtain your explicit consent, in accordance with the DPA.
- Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any updates will be posted on this page with a revised “Last Updated” date. We encourage you to review this policy periodically.
- Contact Us
For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
Entim Sidai Wellness Sanctuary
Rura Drive, Karen, Nairobi, Kenya
info@entimsidai.com
0702577530
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC):
Office of the Data Protection Commissioner
www.odpc.go.ke
info@odpc.go.ke
020 780 1800