Privacy Policy | Inspira Luxury Homes

Who we are

Inspira Africa Limited (“Inspira”, “we”, “us”) is the data controller for personal data collected through this website and for your stay with Inspira Luxury Homes.

D5 Duchess Park, Hatheru Road, Lavington, Nairobi (P.O. Box 1833, 00100, Nairobi)
Phone: +254 722 982071, +254 722 376873
Email: info@inspiraafrica.co.ke, marked for the attention of the Data Protection Officer

What we collect

Booking and enquiry details you give us on this website, by WhatsApp, phone or email: your name, email, phone number, dates, number of guests, the home you want and any notes.
Check-in and identity details: a valid government-issued photo ID or passport for every adult guest, the names of everyone staying, and your expected arrival time and special requests.
Payment records for M-Pesa, bank transfer and card payments, deposits and any charges.
Stay records such as entry and damage photos of the apartment, and messages between you and our team.
Website cookies needed for the site to work, such as the session and security cookies that let you submit forms.

We collect only what is adequate, relevant and necessary for these purposes. Children cannot make a booking; where children’s data is processed, parental or guardian consent is required and we apply extra protection.

Why we use it, and our lawful basis

We use your information to manage your booking, verify identity and keep our homes secure. We process personal data only where at least one of these applies:

Contract: to take and manage your booking and provide your stay.
Legal obligation: for example guest registration, tax and accounting records.
Legitimate interests: such as building security and protecting our homes, balanced against your rights and freedoms.
Vital interests: to protect you or another person in an emergency.
Consent: for anything else, such as marketing messages. Consent must be explicit and recorded in writing or electronically, and you can withdraw it at any time.

Our principles

Lawfulness, fairness and transparency in how we process your data.
Purpose limitation: we collect data for specified purposes and do not use it in ways incompatible with them.
Data minimisation: only what is necessary.
Accuracy: we keep data up to date and correct errors without delay.
Storage limitation: we keep data no longer than necessary.
Integrity and confidentiality: we protect it against unauthorised use, loss or damage.
Accountability: we take responsibility for, and can demonstrate, our compliance.

Sharing and cross-border transfers

We do not sell your data. We share it only as the law requires or as needed to provide your stay, for example:

With building security, who register adult guests at the gate.
With service providers who process data on our behalf, such as payment providers. They must sign a Data Processing Agreement, act only on our documented instructions, keep your data confidential, and delete or return it when the service ends.
With authorities where the law requires it.

We transfer personal data outside Kenya only on a basis recognised under Regulation 40 of the Data Protection (General) Regulations, 2021: an adequacy decision, appropriate safeguards such as standard contractual clauses, necessity (for example to perform a contract), or, as a last resort, your explicit and informed consent. Every transfer is documented.

Security and retention

We protect your data with measures that include role-based access so staff see only what their role requires, encryption of sensitive personal data at rest and in transit, strong passwords and multi-factor authentication, secure backups, and regular staff training. Door codes are issued per stay and deactivated after check-out.

We keep personal data only for as long as operational needs or the law require, under our retention schedule. After that it is permanently deleted, anonymised or securely shredded.

If a data breach poses a real risk of harm to you, we will notify the ODPC and you within the legally prescribed timelines.

Your rights

You have enforceable rights over your personal data. Requests are free of charge, except where the Regulations allow a reasonable fee. To make a request, email info@inspiraafrica.co.ke.

Right	We respond	Notes
Information	At or before we collect your data	Who we are, why we collect it, what we collect, who we share it with, any transfer risks, and your right to withdraw consent.
Access	Within 7 days	Free of charge. We give you a copy of, or access to, your data.
Rectification	Within 14 days	If we refuse, we tell you why within 7 days.
Erasure	Within 14 days	Where the data is no longer needed or you withdraw consent. We may refuse only where the law requires us to keep it or for a legal claim.
Data portability	Within 30 days	In a structured, machine-readable format. A reasonable fee may apply.
Object / withdraw consent	Within 14 days; immediately for direct marketing	You can always stop direct marketing, and we stop as soon as you ask.

If we refuse a request, we give you written reasons within 7 days. Administrative burden or internal policy is never a valid reason for refusal. You also have the right not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects on you.

Complaints

If you are unhappy with how we have handled your personal data or a request, contact our Data Protection Officer at info@inspiraafrica.co.ke. We will acknowledge your complaint and investigate it promptly.

You can also complain to the Office of the Data Protection Commissioner at any time, free of charge, including anonymously.

How we protect your personal data