Privacy Policy | Utamaduni Nature Park

1. Introduction

Utamaduni Nature Park & Resort ("the Park", "we", "us", "our") is an eco-tourism and nature recreation facility based in Kenya. We are committed to protecting the privacy and personal data of all visitors, enquirers, and users of this website ("you", "your"). This Privacy Policy explains what personal information we collect, how we use it, how long we retain it, and your rights with respect to it.

By visiting our website, submitting a booking, or signing a digital waiver, you acknowledge and consent to the practices described in this Policy.

2. Information We Collect

We collect only the information that is necessary for the safe and efficient operation of the Park and its digital services. This includes:

Full name, age, and national ID or passport number.
Signature (captured digitally) and date of signing.
Emergency contact information (name and phone number).
Disclosure of any relevant medical conditions, where voluntarily provided.

This information is collected to fulfil our legal duty of care and insurance obligations, and to maintain a verifiable record of consent for all activity participants.

b) Group Booking Data

Name and contact details of the group organiser or booking representative.
Organisation or school name, group size, and intended visit date.
Special requirements or notes (e.g., accessibility needs, dietary requirements where catering is requested).

c) Contact & Enquiry Data

Name, email address, and the content of your message when you submit our contact form.

d) Technical & Usage Data

IP address, browser type and version, device type, operating system, and referring URL.
Pages visited, time and duration of visits, and general interaction patterns on this website.

This data is collected automatically for the purposes of website security, performance monitoring, and improving the user experience. It does not identify you personally.

3. How We Use Your Information

We process your personal data strictly for the following purposes:

Bookings & Visit Management: To process, confirm, and administrate your group visit reservation and any changes or cancellations.
Waiver & Legal Compliance: To maintain legally required indemnity and consent records for all visitors participating in activities at the Park.
Safety & Emergency Response: To contact your designated emergency contact in the event of an incident during your visit.
Communication: To respond to your enquiries, provide booking updates, and communicate any changes to your visit arrangements.
Website Improvement: To analyse how visitors use our website so we can improve its content, navigation, and performance.
Legal Obligations: To comply with applicable Kenyan laws, regulations, or enforceable government requests.

We do not use your data for unsolicited marketing communications. We will only contact you in relation to a specific enquiry, booking, or service you have engaged with.

4. Legal Basis for Processing

We process your personal data on the following legal grounds under applicable Kenyan data protection legislation (including the Data Protection Act, 2019):

Contractual Necessity: Processing required to fulfil a booking or service agreement with you.
Legal Obligation: Processing required to comply with our duty of care, insurance requirements, and applicable laws.
Consent: Where you have voluntarily provided information (e.g., via the contact form or waiver medical disclosure), and for the use of any non-essential cookies.
Legitimate Interests: For website security, fraud prevention, and the improvement of our digital services, where these interests are not overridden by your rights.

5. Data Sharing & Disclosure

We respect your privacy. We do not sell, rent, or trade your personal information to any third parties for marketing or commercial purposes.

We may share your information in limited circumstances:

Service Providers: Trusted third-party partners who assist us in operating our website or business (e.g., hosting providers, email services), bound by strict data confidentiality agreements.
Legal & Regulatory: Where disclosure is required by law, court order, or a competent regulatory authority.
Emergency Services: In the event of a medical or safety emergency on Park premises, relevant personal information may be disclosed to emergency responders.
Insurance Purposes: Waiver and incident information may be shared with our insurers where a claim is made or investigated.

6. Data Retention

Indemnity Waivers: Retained for a minimum of 7 years from the date of signing, as required by insurance regulations and Kenyan legal standards.
Booking Records: Retained for a minimum of 5 years for financial and operational record-keeping purposes.
Contact Enquiries: Retained for 12 months after the enquiry is resolved, then securely deleted unless a further relationship has been established.
Technical Data: Aggregated and anonymised data may be retained indefinitely for analytics. Identifiable technical data is deleted within 90 days.

After the applicable retention period, all personal data is securely and permanently deleted or anonymised.

7. Cookies

Our website uses cookies — small text files stored on your browser — to enable core website functionality (e.g., session management and form security). We do not use advertising or cross-site tracking cookies.

Essential Cookies: Required for the website to function correctly (e.g., CSRF tokens for form security). These cannot be disabled.
Analytics Cookies: If used, these are aggregated and anonymised to help us understand website usage patterns.

You can manage or disable non-essential cookies through your browser settings. Please note that disabling cookies may affect certain features of this website.

8. Data Security

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your information against unauthorised access, disclosure, alteration, or destruction. These include:

Encrypted data transmission (HTTPS/TLS) across our website.
Access controls ensuring only authorised staff can access personal data.
Regular review of our data handling practices.

Whilst we take all reasonable precautions, no digital transmission or storage system is entirely infallible. If you have concerns about data security, please contact us directly.

9. Your Rights

Under the Kenya Data Protection Act, 2019, you have the following rights regarding your personal data:

Right of Access: To request a copy of the personal information we hold about you.
Right to Rectification: To request correction of inaccurate or incomplete data.
Right to Erasure: To request deletion of your data where it is no longer required for legal or operational purposes.
Right to Object: To object to processing of your data in certain circumstances.
Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact our Data Controller at the details below. We will respond to all valid requests within 30 days. Note that certain data (e.g., signed waivers) may be retained for legal compliance even upon request for deletion.

10. Third-Party Links

Our website may contain links to third-party websites or social media platforms. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policy of any third-party site you visit.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our operations, technology, or legal requirements. The updated version will be published on this page with a revised "Last Updated" date. We encourage you to review this page periodically.

12. Contact Our Data Controller

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

Email: info@utamaduninaturepark.co.ke
Phone: +254 700 000 000
Address: Utamaduni Nature Park & Resort, Kenya