Privacy & GDPR

1. Who is responsible for your data

Iliano Villas, Watamu, Kilifi County, Kenya, is the data controller. For any question about your data or to exercise your rights, write to stay@ilianovillas.com.

2. What we collect

• Booking details: the stay you choose, your dates, number of guests and preferred currency.
• Contact details and messages: your name, email address, phone or WhatsApp number and anything you tell us when you get in touch or book, including dietary needs or special requests you choose to share.
• Stay records: where Kenyan law requires it, identity details of adult guests at check-in.
• Payment information: online payments are processed by Paystack; we keep a record of amounts, dates and the payment method type, but never your card details.
• Technical data: like any website, our hosting provider records basic technical information such as your IP address, browser type and the pages requested, to keep the site secure and working.
• Preferences: your chosen language (stored in a cookie) and currency (stored in your browser).

3. Why we use it and our legal basis

• To answer your enquiries, take and manage your booking and look after you during your stay: to perform our contract with you, or to take steps at your request before entering into one.
• To keep accounting and tax records and meet guest registration rules: to comply with our legal obligations.
• To keep the website secure, prevent fraud and improve our service: our legitimate interests, balanced against your rights.
• To send you news or offers: only with your consent, which you can withdraw at any time.

4. Cookies and similar technologies

We use only what is strictly necessary for the site to work:

• "lang" cookie: remembers the language you chose, for one year.
• Browser storage: remembers the currency you chose.

We do not use analytics, advertising or social media tracking cookies, so we do not ask for cookie consent. Our fonts are hosted on our own server, so loading the site does not send your data to font providers.

5. Who we share it with

We never sell your data. We share it only where needed, with:

• our hosting and database providers (Google Cloud and Firebase) and our payment provider (Paystack), acting on our instructions;
• messaging services you choose to use with us, such as WhatsApp (Meta) or email;
• service providers you ask us to arrange, such as a private chef, only as needed for that service;
• professional advisers, and public authorities where the law requires it.

Our Google reviews are loaded by our server, so viewing them does not share your data with Google.

6. International transfers

We are based in Kenya and some of our providers operate in other countries, including the EU and the United States. Where your data is transferred outside the EU/EEA, the UK or Kenya, we rely on adequacy decisions or appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

7. How long we keep it

• Booking, payment and guest records: as long as required by tax and accounting law, normally up to 7 years.
• Enquiries that do not lead to a booking: up to 12 months.
• Marketing contacts: until you unsubscribe.
• Server logs: for a limited period set by our hosting provider, normally no more than a few weeks.

8. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased, where we no longer need it;
• restrict or object to how we use your data, including for direct marketing;
• receive your data in a portable format;
• withdraw your consent at any time, without affecting earlier processing.

To use any of these rights, email stay@ilianovillas.com. We will reply within one month and will not charge a fee in most cases.

9. Complaints

If you are unhappy with how we handle your data, please tell us first so we can try to put it right. You also have the right to complain to a supervisory authority: in Kenya, the Office of the Data Protection Commissioner (odpc.go.ke); in the EU, the authority in your country, such as the Garante per la protezione dei dati personali in Italy or the CNIL in France; in the UK, the Information Commissioner’s Office.

10. Security

We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), restricted access and trusted providers. No system is completely secure, but we work to keep risks low and will act promptly if something goes wrong.

11. Children

Bookings must be made by adults. We only hold data about children when a parent or guardian gives it to us as part of a booking.

12. Changes to this notice

We may update this notice from time to time. The date at the top shows when it last changed.