Privacy Policy

1. Introduction

Bueno Leisure Limited ("Bueno Leisure," "we," "us," or "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you interact with us through our website at www.buenoleisure.com (the "Website"), through our social media channels, via WhatsApp or email, or when you engage our luxury event planning and travel services.

This Privacy Policy is issued in compliance with the Kenya Data Protection Act, 2019(the "Kenya DPA") and the regulations made thereunder. Where we process the personal data of individuals located in the European Union or the United Kingdom, we also comply with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR. We are further aware of the Protection of Personal Information Act, 2013 ("POPIA") of South Africa and the California Consumer Privacy Act("CCPA") and take reasonable steps to honour the rights of individuals under those frameworks where applicable.

2. Data Controller

The data controller responsible for your personal data is:

Bueno Leisure Limited
Nairobi, Kenya

Email: privacy@buenoleisure.com
General enquiries: info@buenoleisure.com
Website: www.buenoleisure.com

Bueno Leisure Limited is registered as a Data Controller with the Office of the Data Protection Commissioner (ODPC) of Kenya, in accordance with the Kenya Data Protection Act, 2019.

3. Personal Data We Collect

We collect personal data that is necessary to provide you with our services, to communicate with you, and to comply with our legal obligations. The categories of personal data we collect include:

3.1 Identity and Contact Information

• Full name (as it appears on your passport or national identification document)
• Gender
• Date of birth and age
• Nationality
• Postal and physical address
• Email address
• Telephone and mobile phone number(s)
• WhatsApp contact details

3.2 Travel Documentation

• Passport number, issue date, expiry date, and place of issue
• National identification number (for East African residents)
• Visa details and immigration status
• Frequent flyer or loyalty programme numbers

3.3 Travel and Event Requirements

• Dietary requirements and food allergies
• Medical conditions, disabilities, or mobility limitations relevant to the safe provision of services
• Special requests and accessibility needs
• Emergency contact details (name, relationship, phone number)
• Body weight (where required for light aircraft transfers or specific activities with weight restrictions)
• Event preferences, themes, and specifications
• Guest lists and seating arrangements (for event planning)

3.4 Financial Information

• Billing address
• M-Pesa transaction details (phone number, transaction codes)
• Bank transfer reference details

Note: Bueno Leisure does not receive, process, or store your full credit card or debit card numbers. Card payments are processed through secure, PCI-DSS compliant third-party payment gateways. We receive only transaction confirmation details.

3.5 Communication Records

• Emails, WhatsApp messages, and other correspondence with us
• Records of phone conversations (where you are informed at the start of the call)
• Feedback, reviews, and survey responses

3.6 Technical and Website Data

• IP address
• Browser type and version
• Operating system
• Pages visited on our Website, time spent, and navigation patterns
• Referral source (how you found our Website)
• Cookie data (see our Cookie Policy for details)

3.7 Photographs and Media

• Photographs and video footage taken during travel experiences or events that we organise
• Photographs or media you voluntarily share with us

4. How We Collect Your Data

We collect personal data through the following means:

• Directly from you: When you make an enquiry, request a quotation, make a booking, sign an Event Brief, fill in forms on our Website, communicate with us via email, WhatsApp, phone, or social media, or provide information at an event or during travel.
• From third parties: From travel Suppliers (hotels, airlines, ground operators) who share relevant booking information; from event venues; from referrals by other clients or partners; from social media platforms where you interact with our content.
• Automatically: Through cookies and similar technologies when you visit our Website (see our Cookie Policy).

5. Legal Basis for Processing

We process your personal data on the following legal grounds, as required by the Kenya DPA 2019 and, where applicable, GDPR Article 6:

5.1 Performance of a Contract

Processing that is necessary to fulfil our contractual obligations to you - including managing your Booking or Event, coordinating with Suppliers, processing payments, and delivering the Services you have requested.

5.2 Legitimate Interests

Processing that is necessary for our legitimate business interests, provided those interests are not overridden by your fundamental rights and freedoms. Our legitimate interests include: efficient service provision and administration; maintaining and improving our services; protecting our business against fraud; internal record-keeping; and staff training. We have conducted a balancing assessment for each legitimate interest and are satisfied that your rights are protected.

5.3 Consent

Where you have given us your specific, informed, and freely given consent - particularly for: receiving marketing communications (newsletters, promotions, offers); the use of non-essential cookies on our Website; and the use of your photographs or testimonials in marketing materials. You may withdraw consent at any time (see Section 9).

5.4 Legal Obligation

Processing that is necessary to comply with a legal obligation, including: Kenya Revenue Authority (KRA) tax record requirements; immigration and visa documentation requirements; anti-money laundering regulations; and responding to lawful requests from courts or regulatory authorities.

5.5 Vital Interests

In rare circumstances, processing that is necessary to protect your vital interests or those of another person - such as sharing medical information with emergency services during a medical emergency on safari or at an event.

6. How We Use Your Data

We use your personal data for the following purposes:

• Service delivery: To process and manage your travel bookings and event arrangements, including coordinating with Suppliers, confirming reservations, and providing itineraries and event plans.
• Communication: To respond to your enquiries, provide quotations, send booking confirmations, issue invoices, and provide updates about your travel or event arrangements.
• Payment processing: To process deposits, balance payments, refunds, and manage financial records.
• Travel documentation: To assist with visa applications, flight bookings, and immigration requirements.
• Safety and wellbeing: To ensure your dietary, medical, and accessibility needs are communicated to relevant Suppliers, and to coordinate emergency assistance if needed.
• Quality improvement: To gather feedback, improve our services, and train our staff.
• Marketing (with consent): To send you newsletters, promotional offers, and information about new services and destinations that may interest you.
• Legal and regulatory compliance: To maintain records as required by Kenyan law, respond to legal processes, and protect our legal rights.
• Website operation: To operate, maintain, and improve our Website, and to analyse Website usage patterns.

7. Sharing Your Data

We share your personal data only where necessary and with appropriate safeguards:

7.1 Suppliers and Service Providers

We share relevant personal data with our Suppliers to fulfil your Booking or Event, including:

• Hotels, lodges, and accommodation providers
• Airlines and flight booking systems
• Ground transport operators and transfer companies
• Safari and excursion operators
• Event venues
• Caterers, florists, photographers, entertainment providers, and other event vendors
• Visa processing agents
• Travel insurance providers

We share only the data that each Supplier needs to provide their specific service.

7.2 Payment Processors

Financial transaction data is shared with secure, PCI-DSS compliant payment processors for the purpose of processing your payments.

7.3 Government and Immigration Authorities

Passport details, nationality, and other required information is shared with immigration authorities, national park authorities (for park entry permits), and government agencies as required by law.

7.4 Professional Advisers

We may share data with our legal, accounting, and insurance advisers where necessary for the management of our business.

7.5 Law Enforcement and Regulatory Bodies

We may disclose your data where required by law, court order, or regulation, or where necessary to protect our legal rights or the safety of any person.

7.6 No Sale of Data

Bueno Leisure does not sell, rent, or trade your personal data to any third party for marketing purposes. We do not share your data with unrelated third parties for their own direct marketing.

8. International Data Transfers

As an internationally-focused business headquartered in Kenya, we may transfer your personal data outside Kenya in the course of delivering our services - for example, to international hotel chains, airlines, or overseas event Suppliers.

Where personal data is transferred outside Kenya, we ensure that appropriate safeguards are in place, including:

• Transfers to countries recognised by the ODPC as providing adequate data protection.
• Standard Contractual Clauses or equivalent contractual mechanisms approved under the Kenya DPA.
• The recipient's binding corporate rules or certification under an approved framework.

For individuals in the EU/UK, international transfers of your data comply with GDPR Chapter V requirements, including the use of Standard Contractual Clauses where necessary.

9. Your Rights

Under the Kenya Data Protection Act, 2019 (and, where applicable, GDPR), you have the following rights in relation to your personal data:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations.
• Right to restrict processing: You may request that we limit how we use your data in certain circumstances.
• Right to data portability: You may request to receive your personal data in a structured, commonly used, machine-readable format.
• Right to object: You may object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right not to be subject to automated decision-making: You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

How to Exercise Your Rights

To exercise any of these rights, please contact us at:

Email: privacy@buenoleisure.com

We will respond to your request within thirty (30) days of receipt. In complex cases, we may extend this period by a further 30 days, and will notify you of any extension. We may request proof of identity before processing your request.

Right to Lodge a Complaint

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya:

Office of the Data Protection Commissioner
Website: www.odpc.go.ke

For individuals in the EU/UK, you may also lodge a complaint with the relevant supervisory authority in your country of residence.

10. Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Our specific retention periods are:

After the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to you.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (SSL/TLS) on our Website and email systems.
• Access controls limiting data access to authorised personnel on a need-to-know basis.
• Secure storage of physical documents in locked facilities.
• Regular review of our security practices and procedures.
• Staff training on data protection and confidentiality obligations.
• Secure, PCI-DSS compliant third-party payment processing (Bueno Leisure does not store card details).

While we take all reasonable steps to protect your data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security but are committed to maintaining the highest practical standard of data protection.

12. Children's Privacy

Bueno Leisure does not knowingly collect personal data from children under the age of thirteen (13) without parental or guardian consent. Where we process data relating to minors in the context of a family booking or event (for example, children attending a family safari or a birthday celebration), we collect only the data necessary for the booking and do so with the consent of the parent or guardian making the booking.

If you believe we have collected data from a child under 13 without appropriate consent, please contact us immediately at privacy@buenoleisure.com and we will take steps to delete such data.

13. Third-Party Links

Our Website may contain links to third-party websites (such as hotel websites, airline booking platforms, social media platforms, and payment gateways). Bueno Leisure is not responsible for the privacy practices or content of these third-party websites. We encourage you to read the privacy policies of any third-party website you visit.

14. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or regulatory guidance. Updated versions will be published on our Website with the revised "Last Updated" date. We will notify you of material changes by email or prominent notice on our Website. Your continued use of our Services after any update constitutes acceptance of the revised Privacy Policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal data, please contact us:

Data Protection Contact
Bueno Leisure Limited
Nairobi, Kenya

Email: privacy@buenoleisure.com
General enquiries: info@buenoleisure.com
Website: www.buenoleisure.com

Bueno Leisure Limited is registered as a Data Controller with the Office of the Data Protection Commissioner (ODPC) of Kenya in accordance with the Data Protection Act, 2019.

Bueno Leisure Limited - Where Every Moment Becomes an Unforgettable Experience.