Privacy policy
Your details travel carefully, too.
This policy explains what personal information Harmo Stays & Tours collects, why we use it, who we may share it with, and the choices available to you.
Made for clear plans,
from Diani Beach.
This is an interim privacy policy based on the current website and booking service. It will be reviewed against the company’s final approved documents, supplier arrangements and data-retention schedule.
Who this policy covers
Harmo Stays & Tours ("Harmo", "we", "us" or "our") is responsible for personal information collected through this website and through our enquiry, booking and customer-support channels.
This policy applies to website visitors, account holders, people making enquiries or bookings, travellers included in a booking, and people who contact us. A host, tour operator, car-hire provider, Safaricom or another supplier may also process information under its own privacy terms.
Information we collect
We collect information you provide, information created while arranging your trip, and limited technical information needed to operate and protect the website.
- Identity and contact details, such as your name, email address and phone number.
- Account details, including a securely protected password record, profile photo, saved listings and sign-in session information.
- Trip and booking details, including dates, destination, guest numbers, requests, messages, selected services and booking references.
- Payment records, including the amount, status, M-PESA phone number, transaction reference and receipt details. Harmo does not receive or store your M-PESA PIN.
- Information you choose to share about accessibility, dietary or other needs where it is necessary to arrange the requested service.
- Technical and security information such as device, browser, IP address, server logs and actions needed to diagnose errors, prevent misuse and keep sessions secure.
How we use your information
We use personal information only for specific and legitimate purposes connected with our travel service and business obligations.
- To respond to enquiries, prepare quotes, check availability and take steps you request before a booking.
- To create and manage your account, bookings, payments, wish list and customer support requests.
- To share the information needed for a host, guide, driver or other supplier to deliver your service.
- To send operational messages about payments, confirmations, itinerary changes, safety or service updates.
- To keep financial and booking records, prevent fraud, protect the website and comply with legal or regulatory duties.
- To improve our service using aggregated or limited operational information where this can be done fairly and proportionately.
Why we are allowed to use it
Under Kenya’s Data Protection Act, personal information must have a lawful basis. Depending on the situation, we process information because it is necessary to take steps at your request or perform a booking contract, comply with a legal obligation, protect vital interests, or pursue a legitimate business interest that does not unfairly override your rights.
Where consent is the appropriate basis—for example, for optional marketing or certain sensitive information—you may withdraw it. Withdrawing consent does not affect processing that was already lawful or information we still need for another lawful reason.
Storage & transfers outside Kenya
Some technology or supplier services may store or access information outside Kenya. Where personal information is transferred internationally, we will use a lawful transfer mechanism and reasonable safeguards appropriate to the information and destination.
You may contact us if you would like more information about the safeguards relevant to your information.
How long we keep information
We keep personal information only for as long as it is reasonably needed for the purpose collected, to support an active account or booking, to resolve a complaint, or to meet tax, accounting, fraud-prevention and other legal obligations.
Different records have different retention periods. When information is no longer needed, we take reasonable steps to delete, anonymise or securely archive it. Peter’s final company documents will be used to publish a more specific retention schedule where appropriate.
Children’s information
Bookings must be made by an adult. A parent or guardian may provide limited information about a child travelling in their party where it is needed for occupancy, safety, pricing or service arrangements.
Please do not send more information about a child than is necessary. If we learn that a child provided personal information directly without appropriate authority, we will take reasonable steps to address it.
Your privacy rights
Kenyan data-protection law gives you rights over your personal information. Subject to lawful limits, you may ask to be informed about its use, access information we hold, object to processing, correct inaccurate or misleading information, or request deletion of information that should not be retained.
You may also withdraw consent where processing relies on consent and raise a complaint with the Office of the Data Protection Commissioner. We may need to verify your identity before acting on a request and may retain information where the law requires or permits it.
Updates & contact
We may update this policy when our website, suppliers, technology or legal obligations change. The latest version will be posted here with a revised effective date. Material changes may also be communicated through the website or your registered contact details where appropriate.
Questions, concerns or requests can be sent to [email protected], or delivered to Harmo Stays & Tours at The Nest Apartments, Diani Beach, Kenya.
A real person, when you need one
Questions before you book?
Ask us about a service, a cancellation condition or how we use your information before you commit.