Breathe easy, you are home. This page is Part C of the TeaCrest Website Legal, Booking and Privacy Pack (Version 1.0, effective 1 January 2025), read together with Part A — Booking Terms and Conditions, Part B — Guest, Property and Activity Rules and Part D — Gift of Rest Referral and Promotional Programme Terms.
1.Controller and contact
TeaCrest Farmstead Ltd is the data controller for personal data it determines how and why to use. Company No. PVT-2LAIB7L; Mwalimu Wanyoike Farm, Kinare Road, Gatundu, Kiambu County, P.O. Box 178-01030, Kenya; teacrestbooking@gmail.com; +254 708 593530. Address privacy requests to "Data Protection Contact". Payment providers, booking marketplaces and social-media platforms may act as separate controllers under their own notices.
2.Scope and principles
This Policy applies to our website, direct bookings, visits, guest records, referral programme, communications, photography and marketing. TeaCrest processes personal data lawfully, fairly and transparently; for specified purposes; only to the extent necessary; accurately; for no longer than needed; and with appropriate security and accountability. Kenyan law applies. The EU General Data Protection Regulation, UK GDPR or another foreign privacy law applies only where its territorial rules are actually met.
3.Data we may collect
- Identity and contact data: name, WhatsApp/mobile number, email, address, identification details where lawfully required, nationality where needed for a guest register, and emergency contact.
- Booking and guest data: dates, package, headcount, children's age bands, preferences, accessibility requests, communications, reviews, complaints and visit history.
- Payment and transaction data: amount, currency, provider, transaction reference, status, refunds, disputes and limited payment metadata. TeaCrest should not receive or store full card numbers, CVVs, M-Pesa PINs or one-time passwords.
- Health-related data voluntarily supplied for dietary, allergy, accessibility or emergency safety. This is sensitive personal data and is restricted to what is necessary.
- Referral data: referrer and recipient names and WhatsApp numbers, campaign or reward codes, completed referrals, consent and reward status.
- Images and media: photographs, video, audio, testimonials and social-media handles only under the rules below.
- Technical and usage data: IP address, device/browser information, page events, cookie choices, security logs, acceptance timestamp and Terms version.
- Fraud, safety and incident data: duplicate profiles, payment anomalies, property damage, accidents, witness information and lawful correspondence with insurers, advisers or authorities.
4.Sources of data
We collect data directly from the Lead Guest or participant; from a person authorised to book for a group; from a referral recipient who supplies the referrer's permitted details; from Paystack, Safaricom M-Pesa, banks or marketplaces; from website and communications systems; from staff incident records; and from public social-media interaction where appropriate. A person providing another individual's data must have authority and direct them to this Policy.
5.Purposes and lawful bases
| Purpose | Typical data | Lawful basis |
|---|---|---|
| Quote, verify, confirm and perform bookings; communicate service information | Identity, contact, booking, payment status | Contract or steps requested before contract |
| Safety, dietary, accessibility and emergency response | Relevant health, age and emergency data | Explicit consent, vital interests, contract and/or legal duty as applicable |
| Payments, accounting, tax, fraud, disputes and debt recovery | Transaction, identity, evidence and logs | Contract, legal obligation and legitimate interests |
| Referral programme and reward administration | Name, WhatsApp number, codes, visit/reward history | Programme contract, legitimate interests and service communications; marketing consent is separate |
| Customer service, quality, claims, security and business records | Communications, reviews, incidents, technical logs | Legitimate interests, contract and legal claims |
| Promotional email, SMS or WhatsApp offers | Contact, preferences and engagement | Separate express consent; withdraw at any time |
| Identifiable promotional photography or video | Image, voice, testimonial and consent record | Separate, specific and freely given consent |
| Website analytics and non-essential cookies | Device, usage and identifiers | Consent where required; strictly necessary cookies support service/security |
| Legal compliance and regulatory cooperation | Data required by law or lawful request | Legal obligation and public interest |
6.Booking communications and direct marketing
Booking confirmations, payment notices, safety information, itinerary changes, service follow-up and earned reward notices are service communications and do not require marketing consent where sent only to administer the booking or programme.
Promotional communications are optional. TeaCrest will use a separate, unticked opt-in for email, SMS or WhatsApp offers and keep evidence of the wording, channel, date, source and withdrawal. Refusing marketing does not affect a booking. Every promotional message will identify TeaCrest and provide a simple opt-out, including replying STOP or using an unsubscribe link. TeaCrest will action objections within the applicable legal period and maintain a minimal suppression record so the person is not re-added accidentally. TeaCrest will not send direct marketing to children or buy unverified marketing lists.
7.Referral programme privacy
- The recipient must provide at least the referrer's name and WhatsApp number for verification. The WhatsApp number is the primary customer identifier and will be normalised to international format.
- The person sharing the card should have joined the referral programme and permitted TeaCrest to use their details for verification and reward service messages. The recipient must not invent, scrape or disclose a number without permission.
- TeaCrest will not tell the referrer the recipient's identity, package or payment details without permission. A message may state only that a referral booking or completed visit has activated or progressed a reward.
- Referral service messages do not enrol either person in general marketing. Each person must separately opt in to offers.
- Fraud indicators are subject to human review. TeaCrest will not make a significant adverse decision solely by an opaque automated process without a review route.
8.Photography, video, testimonials and social media
Booking acceptance is not consent to use a guest's identifiable image, voice or testimonial for advertising. Promotional consent must be separate, specific, unticked and capable of withdrawal without affecting the guest's service.
- Before planned promotional capture, TeaCrest will explain the intended media and channels and obtain consent from identifiable adults. A parent or guardian must give specific verifiable consent for an identifiable child.
- Where filming occurs in a group or event area, TeaCrest will provide visible notice and a practical way to avoid capture or request exclusion. Identifiable commercial use still requires an appropriate lawful basis and, as TeaCrest policy, express consent.
- A person may withdraw consent for future use by contacting TeaCrest. TeaCrest will stop new use and take reasonable steps to remove the material from channels it controls. Withdrawal does not make lawful past processing unlawful and cannot guarantee deletion of copies already lawfully shared, printed or independently reposted by others.
- Testimonials may be edited only for length, spelling or clarity without changing meaning. TeaCrest will not fabricate attribution or imply endorsement beyond the permission given.
9.Children's data
TeaCrest collects only the minimum child data needed for pricing, safety and service delivery, usually name where necessary and age band rather than a full birth date. The parent or guardian must authorise processing where required, act in the child's best interests and exercise the child's data rights. TeaCrest does not use children's data for behavioural advertising, direct marketing or unnecessary profiling.
10.Cookies and similar technologies
TeaCrest will use a consent-management banner that allows visitors to accept or reject non-essential cookies and change choices later. Strictly necessary cookies may operate without optional consent because they support security, booking, payment hand-off, load balancing and consent storage.
| Category | Purpose | Consent | Typical duration |
|---|---|---|---|
| Necessary | Booking session, security, payment hand-off, preferences | Not optional where essential | Session to 12 months |
| Analytics | Understand aggregate website use and improve journeys | Opt-in before placement where required | Up to 13 months |
| Functional | Remember optional preferences or embedded features | Opt-in unless strictly necessary | Up to 12 months |
| Advertising | Measure campaigns or personalise advertising | Express opt-in | As disclosed in banner; review at least annually |
The live cookie banner must list actual vendors, cookie names, purposes and durations after the developer completes a scan. TeaCrest must not publish invented vendor entries.
11.Sharing and processors
TeaCrest may share the minimum necessary data with: Paystack, Safaricom M-Pesa, banks and card schemes; website, booking, communications, email, cloud, CRM, security and analytics providers; approved guides, hosts, caterers or transport providers where necessary; insurers, auditors, accountants and legal advisers; emergency services; regulators, courts and law-enforcement bodies under lawful process; and a buyer or successor under confidentiality and data-protection safeguards. TeaCrest does not sell personal data.
Where a supplier processes data only for TeaCrest, TeaCrest will use a written data-processing agreement, confidentiality, security, deletion/return and assistance terms. Where a marketplace or payment provider is an independent controller, its own privacy notice also applies.
12.International transfers
Some providers may store or access data outside Kenya. TeaCrest will assess the destination and use a lawful transfer mechanism, appropriate contractual and security safeguards, or explicit consent where permitted. Sensitive personal data will be transferred outside Kenya only under the additional safeguards required by law. Where EU or UK law applies, TeaCrest will use an applicable adequacy decision, standard contractual clauses or another valid mechanism.
13.Retention schedule
| Record | Default retention | Reason / deletion rule |
|---|---|---|
| Booking, invoice, payment, tax and refund records | 7 years after the relevant financial year | Accounting, tax, contract and dispute evidence; review if law requires longer |
| Terms acceptance and consent audit logs | 7 years after booking or last relevant use | Prove contract and consent; retain suppression evidence as needed |
| Referral and reward transaction records | 7 years after last transaction | Reward, fraud, accounting and dispute evidence |
| Health, allergy and accessibility notes | 12 months after visit | Delete earlier if no longer needed; retain longer only for an incident or claim |
| Incident, damage, complaint or legal claim files | Until final resolution plus the applicable limitation period | Legal claims, insurance and safety improvement |
| Unsuccessful enquiries or abandoned bookings | 12 months after last contact | Customer service and fraud control, unless consent supports longer marketing |
| Marketing contacts | Until withdrawal or 24 months of inactivity, then review | Consent-based marketing; keep minimal suppression record after opt-out |
| Promotional media and releases | For stated campaign/use, reviewed at least every 3 years | Stop future use after valid withdrawal; preserve necessary legal evidence |
| Security and website logs | Up to 12 months unless an incident requires longer | Security, fraud and diagnostics |
| CCTV, if introduced | Normally up to 30 days unless an incident requires extraction | Must be separately signposted and documented before use |
These periods are operational defaults. TeaCrest may retain a record longer where law, litigation hold, chargeback, insurance, tax audit or investigation reasonably requires it, and will securely delete or anonymise it when the purpose ends.
14.Security and breach response
TeaCrest applies proportionate access control, least privilege, strong authentication, encryption where appropriate, backups, patching, staff confidentiality, processor due diligence, secure payment redirection, audit logs and incident response. No system is risk-free. TeaCrest will document incidents, contain and assess them, notify the Data Commissioner within the legally required period where there is a qualifying real risk of harm, and communicate to affected people as required. Staff and processors must report suspected breaches immediately.
15.Your data rights
Subject to legal conditions and exemptions, a data subject may request information and access; object to processing; correct inaccurate data; delete data that is no longer lawfully needed; restrict processing; receive portable data; withdraw consent; object absolutely to direct marketing; and request human review of a qualifying solely automated decision. TeaCrest may verify identity and may retain data required by law or a legal claim.
Send requests to teacrestbooking@gmail.com or the address in section 1. TeaCrest will acknowledge and respond within applicable Kenyan timeframes. Current ODPC guidance indicates, depending on the right, periods such as 7 days for access and direct-marketing objection, 14 days for correction/erasure/restriction or general objection, and 30 days for portability. If dissatisfied, contact the Office of the Data Protection Commissioner at odpc.go.ke.
16.Changes to this Policy
TeaCrest may update this Policy to reflect law, technology, providers or Services. The website will show the effective date and archive the version applicable to each booking. Where a change requires consent, TeaCrest will obtain it rather than relying only on website publication.
Head to the booking page to reserve your visit — you'll be asked to confirm you've read this pack before you pay.