Last updated: 29 September 2026. This policy explains what personal data Eudoraz collects when you use eudoraz.com or stay in one of our apartments, why we collect it, who we share it with, how long we keep it and the rights you have under the Data Protection Act, 2019 of Kenya.
1. Who we are
Eudoraz (“Eudoraz”, “we”, “us” or “our”) operates the website eudoraz.com and manages the furnished apartments listed on it. We are based in Nairobi, Kenya. We offer furnished apartments for short and long stays in Kenya and take bookings through eudoraz.com.
For the purposes of the Data Protection Act, 2019 (the “Act”) and the Data Protection (General) Regulations, 2021, we are the data controller of the personal data described in this policy.
You can contact us about this policy or your personal data at:
- Email: stay@eudoraz.com
- Phone and WhatsApp: +254 726 127 228
2. Who this policy applies to
This policy applies to:
- visitors to eudoraz.com;
- guests who make, manage or stay under a booking, including the lead guest and every other person named on or staying under a booking;
- people who contact us by email, phone, WhatsApp or the contact form on our website.
If you make a booking for other people, you confirm that you have their permission to give us their personal data and that you have told them about this policy.
3. Personal data we collect
We collect only the personal data we need to take and manage bookings, run our apartments and keep them secure.
Data you give us
- Identity and contact details: your full name, email address and phone number.
- Booking details: the apartment, check-in and check-out dates, number of guests, the price, and any requests or messages you send about your stay.
- Payment details: the M-Pesa transaction code you enter or send us, the amount paid, and the name and phone number that appear on the M-Pesa confirmation for your payment. If you pay by bank transfer, the payer name, bank reference and amount. We never ask for, collect or store your M-Pesa PIN, card numbers or online banking passwords.
- Communications: emails, WhatsApp messages, call notes and contact form messages you send us, and our replies.
- Arrival and security details: where the estate or building requires it for entry, the names of the guests staying, a copy or the number of a national ID card or passport, and vehicle registration numbers.
Data we collect automatically
- Technical data: your IP address, browser type, device type, the pages you visit on our website and the time of your visit. This is recorded in our web server’s logs and used to run and protect the website.
- Cookies and similar technologies: see our Cookie Policy.
Data we receive from others
- Safaricom (M-Pesa) or your bank: confirmation of your payment, including the transaction code, amount, payer name and phone number.
- Other guests: if another person books for you, they give us your name and may give us your contact details.
We do not collect sensitive personal data, such as data about health, religion or ethnic origin, unless you choose to tell us something about your needs (for example an accessibility requirement). If you do, we use it only to help with your stay.
4. How we use your personal data and our lawful basis
| Purpose | Personal data used | Lawful basis under the Act |
|---|---|---|
| Taking your booking, holding the dates while you pay, confirming the booking and sending your booking emails | Identity, contact and booking details | Performance of a contract with you, or steps you ask us to take before entering into one |
| Checking and recording your payment, and matching it to your booking | Payment details | Performance of a contract; compliance with our legal obligations on financial and tax records |
| Giving you access to the apartment and the address, directions and check-in details | Identity, contact and booking details; arrival and security details where required | Performance of a contract; our legitimate interest in keeping the apartments and the estate secure |
| Answering your questions and requests, and handling complaints | Communications; identity and contact details | Performance of a contract; our legitimate interest in responding to people who contact us |
| Handling cancellations, refunds and caution deposits | Booking and payment details | Performance of a contract; compliance with legal obligations |
| Keeping accounting, tax and business records | Booking and payment details | Compliance with legal obligations, including the Tax Procedures Act, 2015 |
| Running, securing and improving our website, and preventing fraud and misuse | Technical data | Our legitimate interest in operating a safe and working website |
| Protecting our rights and those of our guests, and dealing with legal claims | Any relevant data | Our legitimate interest in establishing, exercising or defending legal claims; compliance with legal obligations |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can ask us for details of this assessment.
We do not send you marketing messages. The emails we send are about your booking. If we ever want to send you offers or news, we will ask for your consent first and every message will tell you how to stop them.
5. Who we share your personal data with
We do not sell your personal data. We share it only as described here, and only as much as each recipient needs.
a. Our staff and housekeeping team, who prepare the apartments and look after guests.
b. Service providers who process data on our behalf under written terms that require them to keep it secure and use it only on our instructions:
- our website hosting provider, which stores our website and booking records (currently Namecheap, Inc.);
- Google LLC, which provides our email (Google Workspace and Gmail), the fonts used on our website and, only if you choose to show it, the map on apartment pages.
c. Payment providers. Safaricom PLC (M-Pesa) and banks process your payment as independent controllers under their own terms and privacy policies. We receive confirmation of your payment from them.
d. WhatsApp (WhatsApp LLC, part of Meta Platforms), if you choose to contact us on WhatsApp. WhatsApp’s own terms and privacy policy apply to messages you send through it.
e. Professional advisers, such as our accountants, auditors and lawyers, where they need the data to advise us.
f. The management or security team of the estate or building where your apartment is, where they require guest names, ID or vehicle details to let guests in.
g. Government authorities, regulators, courts and law enforcement, where the law requires us to share data or where it is needed to prevent or detect crime or to protect people’s safety.
h. A buyer or successor of our business, if the business or its assets are sold or transferred, subject to this policy.
6. Transfers outside Kenya
Some of our service providers, such as our website host and Google, store or process data on servers outside Kenya, including in the United States and the European Union. When personal data is transferred outside Kenya, we do so in line with the Act and the Data Protection (General) Regulations, 2021, by relying on appropriate safeguards such as contractual commitments from the provider to protect the data to a standard at least equivalent to Kenyan law. You can ask us for more information about these safeguards.
7. How long we keep your personal data
| Data | How long we keep it |
|---|---|
| Booking and payment records | Five years after the end of the stay, as required for tax and accounting records, then deleted |
| Reservations that were not paid and were released | 12 months after the reservation was released, then deleted |
| Emails, WhatsApp messages and call notes about a booking | Two years after the end of the stay, unless needed for a complaint or claim |
| Contact form messages and questions that did not lead to a booking | 12 months after our last reply |
| ID and vehicle details collected for estate access | Deleted within 30 days after check-out |
| Web server logs | Up to 90 days |
We may keep data for longer if we need it to deal with a complaint, a legal claim or a request from an authority, and only for as long as that need lasts.
8. How we protect your personal data
We use technical and organisational measures appropriate to the risk, including:
- encrypted connections (HTTPS) for every page of our website;
- access to booking records limited to the people who need it, with password-protected accounts;
- links to manage a booking that work only with the booking code and the email address used to book, or a private link sent by email;
- keeping payment card and M-Pesa PIN details out of our systems entirely.
If a personal data breach is likely to put your rights at risk, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it and will tell you without undue delay, as the Act requires.
9. Automatic decisions
Our booking system automatically releases a reservation if payment is not received within the time shown on the booking page (currently one hour). This decision is based only on the time limit and whether a payment has been reported. It does not assess you as a person. If you think a reservation was released by mistake, contact us and a person will review it.
We do not use your personal data for profiling.
10. Your rights
Under the Act, you have the right to:
- be informed of how your personal data is used, which is the purpose of this policy;
- access the personal data we hold about you and receive a copy of it;
- ask us to correct personal data that is inaccurate, out of date, incomplete or misleading;
- ask us to delete personal data that we no longer have a lawful reason to keep;
- object to our use of your personal data where we rely on legitimate interests;
- ask us to restrict how we use your personal data in certain cases;
- receive personal data you gave us in a structured, commonly used format, and ask us to send it to another controller where this is technically possible;
- withdraw consent at any time, where we rely on your consent. This does not affect anything we did before you withdrew it.
Some rights have limits. For example, we must keep booking and payment records for as long as tax law requires, even if you ask us to delete them.
To exercise a right, email stay@eudoraz.com with your name, the email address or phone number you used, and your booking code if you have one. We may ask you to confirm your identity before we act on your request. We will respond without undue delay and within the period set by the Data Protection (General) Regulations, 2021. We do not charge a fee unless a request is manifestly unfounded or excessive.
11. Complaints
If you are unhappy with how we have handled your personal data, please contact us first so we can try to put it right. You also have the right to complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
12. Children
Our website and bookings are for adults. Bookings must be made by a person aged 18 or over. Children may stay as guests under a booking made by an adult, who gives us any details we need about them. We do not knowingly collect personal data directly from children. If you believe a child has given us personal data, contact us and we will delete it.
13. Guests from outside Kenya
We are based in Kenya and this policy is written under Kenyan law. If you live in the European Union or the United Kingdom, you may also have rights under data protection laws that apply to you there. You can exercise those rights by contacting us as set out above.
14. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. If we make a significant change, we will show a notice on our website or tell you by email if you have a booking with us.