Privacy policy
Draft — requires review by the owner before publication. Fields in [brackets] must be completed.
Who we are
This website is operated by Winnie Travelcation, a personal travel assistance service based in Diani Beach, Kenya. Responsible person / data controller: [full legal name or business name, postal address, email].
Which data we collect
- Inquiries: when you use the holiday planner, a contact or booking-request form, we store your name, your WhatsApp/phone number and/or email address, your preferred contact channel, your travel details (dates, number of guests, wishes, budget if given) and your message.
- Consent records: the time you agreed to be contacted and, separately, whether you agreed to receive marketing messages.
- Website statistics: we count page views and button clicks without cookies. IP addresses are not stored; we keep only a salted, one-way hash that changes every day, so individual visitors cannot be identified or followed over time.
- Optional analytics cookies: only if enabled and only after you accept, Google Analytics and/or Meta Pixel may be used. [List the tools actually in use.]
Why we use your data
- To answer your request and organise your holiday (pre-contractual measures / your consent).
- To share the necessary details with the accommodation, transport or tour provider you choose, so they can confirm and deliver the booking.
- Marketing messages only if you ticked the separate marketing box. You can withdraw this at any time.
If you contact us on WhatsApp, your messages are processed by WhatsApp (Meta) under their own privacy policy.
How long we keep data
Inquiries that do not lead to a booking are deleted or anonymised after [24] months. Booking records are kept as long as required for accounting and legal obligations [specify].
Your rights
Depending on where you live (for example under Kenya's Data Protection Act, 2019 or the EU GDPR) you may have the right to access, correct, delete or export your data, to object to processing and to withdraw consent. Use the contact form (choose "privacy request") or WhatsApp to make a request. You may also complain to the Office of the Data Protection Commissioner (Kenya) or your local data protection authority.
Security
Data is stored on a secured server; access to the admin area is restricted and logged.
Changes
Version: [date]. We will update this page when our processing changes.
To request a copy or deletion of your data, use the privacy request form.