Privacy Notice - The Boma Hotels

The Boma Hotels is committed to protecting your privacy and understands the need for appropriate protection of all personal information provided by you to us. As part of this commitment, The Boma Hotels makes every attempt to comply with the principles of the relevant data protection regulations, including the EU General Data Protection Regulation 2018 (GDPR).

This includes the provision of this Privacy Notice, which aims to explain which personal data we collect, how and why we collect it, and how it is used.

About The Boma Hotels
The Boma Hotels is owned by The Kenya Red Cross Society, located off Mombasa Road, off Popo Road, Nairobi, Kenya. The hotel is managed by Aleph Hospitality, a hospitality management company headquartered in Dubai. The Aleph Hospitality Privacy Notice is available upon request from

About This Privacy Notice
In this Notice, “we”, “us” or “our” refers to The Boma Hotels. This Privacy Notice supplements but does not supersede or replace any other consents you may have provided to The Boma Hotels, or any other agreements or arrangements that you may have with The Boma Hotels in respect of your personal data.

The Personal Data We Collect
Personal data is data that can be used to identify somebody. Examples of personal data include name, postal address, phone number, email address, social media account information, passport details, financial information such as credit or debit card number, IP address, transactional information based on your activities on our website, stay preferences, images and any other information of a personal nature.

Voluntary provision of personal data
We collect personal data that you voluntarily provide to us. What personal data we collect depends on the purposes for which the personal data is collected and what you have chosen to provide.

You can choose not to provide us with personal data. If you have provided consent, you also have the right to withdraw your consent by contacting us as per the procedure outlined in this Notice. However, if you do so, it may not be possible for us to fulfil the purposes for which we require the personal data, including processing your transactions or providing you with the products and services that you require.

Provision of personal data belonging to others
If you provide the personal data of anyone other than yourself (e.g. your family members), you are responsible for informing him/her of the specific purposes for which we are collecting his/her personal data and to ensure that he/she has provided valid consent for your provision of his/her personal data to us.

Accuracy of personal data
It is your responsibility to ensure that all personal data that you provide is accurate and complete and to inform us of relevant changes to your personal data.

If you are under 16 years of age, please obtain consent from your parent or guardian before you submit any personal data to us. If you are a parent or guardian of a minor and you have reason to believe your child has provided us with their personal data without your prior consent, please contact us to request for their personal data to be deleted or for the minor to be unsubscribed from our mailing lists.

The Ways in Which We Collect Personal Data

  • We collect personal data that is relevant to our relationship with you. Your personal data may be collected by us, directly or indirectly, for instance:
  • when you make a reservation or stay with us;
  • when you visit or make transactions at the food and beverage outlets at the hotel;
  • when you apply to be a member of any of our customer loyalty programmes, respond to our promotions, or subscribe to our mailing lists;
  • when you participate in competitions, contests or games organised by us;
  • when you “Like”, “Follow” or otherwise comment on, connect with or post to one of our social media pages;
  • when you attend events or functions organised by us, or conducted at the hotel, for example, sales events, promotional and marketing events and other social events;
  • when your images are captured by us via security cameras while you are at the hotel, or when photographs or videos of you are taken when you attend events or functions organised by us;
  • when you communicate with us by telephone, email, via our website or through other communication channels, for example, through social media platforms;
  • when you submit an employment, internship or secondment application to us or when you provide documents or information including your resume/CV in connection with such applications; and/or
  • when you submit your personal data to us for any other reason.

Depending on your relationship with us, we may also collect your personal data from third party sources, for example:
  • from our business partners such as airlines, tour operators, travel agencies, reservation systems and third parties providing advertising, marketing and promotional services to us;
  • from your referees, educational institutions or previous employers (if you have applied to us for a job);
  • from your family members or friends who provide your personal data to us on your behalf; and/or
  • from public agencies or other public sources.

How We Use Personal Data, Who This is Shared With and Why
Generally, we collect, use, disclose and process your personal data for purposes connected or relevant to our business or to manage your relationship with us, such as:
  • processing your transactions with us or to provide products and services to you;
  • administrative purposes, including finance, IT and HR purposes, quality assurance and staff training;
  • security and safety purposes;
  • compliance with laws and regulations, internal policies and procedures, including audit, accounting, risk management and record keeping;
  • carrying out research and statistical analysis, including development of new products and services or evaluation and improvement of our existing products and services;
  • assisting you with your requests, enquiries and feedback;
  • enforcing legal obligations owed to us, or responding to complaints, litigation or investigations concerning us;
  • such purposes that may be informed to you when your personal data is collected; and/or
  • any other reasonable purposes related to the aforesaid.

If you have given your consent, we may use your personal data for the purposes of marketing our products and services and those of our strategic partners and business associates, e.g. informing you of our latest activities, special offers and promotions. In order for us to market products and services which are of special interest and relevance to you, we may analyse and rely on your overall interaction with us (such as but not limited to your participation in promotions or events and your interactions with us).

In addition to collecting, using, disclosing and processing your personal data with your consent or for the performance of a contract entered with you, we may also do so to support our legitimate business interests (provided that this does not override your interests or rights), for example:
  • if you make a reservation or stay at our hotel, we may (a) use and disclose your personal data to assist you in making arrangements that you request for, such as arranging tours, airport transfers, restaurant reservations etc.; (b) send you pre-stay communications, post-stay communications and satisfaction surveys; (c) invite you to join our customer loyalty programmes or subscribe to our mailing lists; and (d) evaluate your preferences to improve and customise your experience for current and future reservations;
  • if you are a member of any of our customer loyalty programmes, we may send you (a) marketing and promotional information about the products and services; (b) information on events at our hotel which may be of interest to you; and (c) newsletters and magazines associated with our customer loyalty programmes;
  • if you are a job seeker, in addition to the specific position which you have applied for, we may disclose your personal data to other hotels operated by Aleph Hospitality for the purpose of offering additional employment opportunities;
  • in order to manage our business, we may disclose your personal data to third parties who provide services to us, including our carefully selected service providers and data processors (providing services such as hosting and maintenance services, analysis services, email messaging services, delivery services, handling of payment transactions, marketing, human resources, and professional services) and our management team, consultants and professional advisors (such as accountants, lawyers, auditors); and/or
  • in the case of a merger or acquisition, where we may disclose your personal data to a third party who acquires any part of our business or the business of any of our affiliates, whether such acquisition is by way of merger, consolidation, divestiture, spin-off, or purchase of all or a substantial portion of our assets.

We may also collect, use, disclose and process your personal data, without your knowledge or consent, where this is required or permitted by law.

When we contact or send you information for the purposes described above, we may do so by post, e-mail, SMS, WhatsApp, telephone or such other means provided by you. If you do not wish to receive any communication or information from us or wish to restrict the manner by which we may contact or send you information, you may contact us in accordance with the procedure outlined in this Notice.

Use of Cookies
Cookies are small data files that track a user’s activity online. The types of cookies we use on our website fall into 3 categories:

Essential cookies and similar technologies
These are vital for the running of our website. Without the use of these cookies, parts of our website would not function. For example, session cookies allow a navigation experience that is consistent and optimal to the user’s network speed and choice of device.

Analytics cookies and similar technologies
Like most websites, our website uses Google Analytics to track user interaction. We use this data to determine the number of people using our site, to better understand how they find and use our web pages, to see their journey through the website and to improve and optimise the user experience.

Although Google Analytics records data such as your geographical location, device, internet browser and operating system, none of this information personally identifies you to us. Google Analytics also records your computer’s IP address, which could be used to personally identify you, but Google does not grant us access to this. We consider Google to be a third-party data processor.

Google Analytics makes use of cookies, details of which can be found on Google’s developer guides. Disabling cookies on your internet browser will stop Google Analytics from tracking any part of your visit to pages within our website.

Tracking, advertising cookies and similar technologies
These types of technologies are used to provide advertisements that are more relevant to your interests. This can be done by delivering online adverts based on your previous web browsing activity. Cookies are placed on your browser which will remember the websites you have visited. Advertising based on what you have been looking at is then displayed to you when you visit websites who use the same advertising networks. Cookies and similar technologies may be used to provide you with adverts based on your interactions with our website.

Your Rights: How You Can Access, Update and Withdraw Your Consent for Us to Use Your Data

Changing Your Marketing Preferences
You can opt-out from receiving future marketing communications from us or change the ways in which we are permitted to contact you by:
  • Using the unsubscribe function in the email you receive from us; or
  • By contacting us by email or letter (see Contacting Us section below)

Withdrawing Your Consent
You may withdraw any consent that you have provided to us to process your information at any time.

Accessing your Information
In accordance with applicable law, you may access the personal data we hold about you. Any request to access or obtain copies of your personal data must be made in writing by contacting us using the details provided in the contacting Us section below. We may, depending on the applicable law in your country, be entitled to charge a nominal fee to cover some of our administration costs in connection with the provision of such information. We may also ask you to verify your identity and to provide further details relating to your request.

Correcting your Information
You may request that any inaccurate or incomplete personal data held by us or on our behalf is corrected, by contacting us using the details provided in the Contacting Us section below.

Deleting your Information
Under certain circumstances, you may request we delete personal data we hold about you by contacting us using the details provided in the Contacting Us section below. We will assess your request and determine, under applicable law, whether we are required to delete this information.

Objecting to Processing
If you would like us to stop processing your personal data, you can request this by contacting us using the details provided in the Contacting Us section below. We will assess your request and determine, under applicable law, whether we have any justification for the continued processing.

Transferring your Information
Under certain circumstances, you may request to receive your personal data in a format that allows you to send it to another company or to direct us to transfer it directly to another company.

Our Security and Your Data
While every precaution will be taken to ensure that the personal data you provide is protected against unauthorised or unintended access, we cannot be held responsible for unauthorised or unintended access that is beyond our control.

Furthermore, our website may contain links to other websites that are not operated by us, including social media sites. We have no control over how these websites may collect your information and no liability for the practices, policies and security measures implemented on these websites. You should read the privacy notices on those other websites before you submit your information through them.

We also cannot guarantee that our systems or applications are completely unsusceptible to security breaches, nor do we make any warranty, guarantee, or representation that your use of our systems or applications is safe and protected from viruses, worms, Trojan horses, and other vulnerabilities. We also do not guarantee the security of data that you choose to send us electronically. Sending such data is entirely at your own risk.

We keep your personal data only for so long as we need the personal data to fulfil the purposes we collected it for, and to satisfy our business and/or legal purposes, including audit, accounting or reporting requirements.

Reviewing This Notice
This Privacy Notice may change from time to time to conform with legislation and/or industry developments. The updated Notice will supersede earlier versions and will apply to personal data provided to us previously. We will not explicitly inform our clients or website users of these changes. Instead, we recommend that you check this page occasionally for any policy changes.

Contacting Us
If after reviewing this Privacy Notice, you have any questions, complaints or privacy concerns, or would like to make any requests in relation to your personal data, please send an email to or send a letter to:

The Boma Hotels
P.O Box 26601-00100

Update cookies preferences