Only what a stay needs
Names, contact details, dates and preferences — collected to book, welcome and look after you.
§ PRIVACY POLICY
What we collect when you browse, book, dine or message us — why we need it, who else sees it, and how to see, correct or delete it with a single message.
15 September 2026
Last updated
3
Minute read
10
Sections
1.0
Version
§ AT A GLANCE
Six things worth knowing before you read the full policy.
Names, contact details, dates and preferences — collected to book, welcome and look after you.
We do not sell or rent personal data. Partners receive only what they need to deliver a service.
Nothing beyond the necessary loads until you choose. Change your mind any time.
Access is limited to the team that needs it, and card data is handled by certified payment processors.
Each record has a retention period, after which it is deleted or anonymised.
See, correct, delete or move your data — or withdraw consent — by WhatsApp, email or at the desk.
§ THE FULL DOCUMENT
Last updated: 15 September 2026 · Version 1.0
The Emin Pasha Hotel & Spa is operated by [Registered company name] (registration no. [Company registration number]), Plot 27 Akii Bua Road, Nakasero, P.O. Box 74764, Kampala, Uganda. We are the data controller for the personal data described in this policy, registered with the Personal Data Protection Office (PDPO) of Uganda under [PDPO registration number].
Our Data Protection Officer is [Data Protection Officer name], reachable at [privacy contact email], on +256 312 264 712, or by WhatsApp using the buttons on this page.
| Category | Examples | Source |
|---|---|---|
| Identity | Name, title, nationality, passport or ID number | You, at booking or check-in |
| Contact | Email, phone, WhatsApp number, postal address | You, or your travel agent |
| Stay | Dates, room, guests, special requests, dietary and access needs | You |
| Payment | Card type and last four digits, invoices, billing company | You, payment processor |
| Wellness | Health disclosures for treatments, spa history | You, at the spa |
| Security | CCTV images in public areas, key-card logs | Our systems |
| Online | Device, pages viewed, cookie choices | Our website, with consent |
| Purpose | Lawful basis |
|---|---|
| Taking and managing bookings, check-in and billing | Performance of a contract |
| Registering guests as required by Ugandan law | Legal obligation |
| Safety of guests and staff, including CCTV | Legitimate interests |
| Answering enquiries on WhatsApp, phone or email | Legitimate interests |
| Newsletters and offers | Consent — withdraw any time |
| Analytics and marketing cookies | Consent — see the Cookie policy |
| Spa health screening | Explicit consent |
Some of our service providers store data outside Uganda. Where they do, we rely on the safeguards the Data Protection and Privacy Act requires — adequate protection in the destination country or contractual clauses — and, for EU and UK guests, the equivalent GDPR mechanisms.
| Record | Kept for |
|---|---|
| Guest registration and invoices | 7 years after departure (tax and legal) |
| Enquiries that did not become a booking | 12 months |
| Spa health disclosures | 3 years after your last treatment |
| CCTV footage | 30 days, unless needed for an incident |
| Newsletter subscription | Until you unsubscribe |
You can ask to access, correct or delete your data, object to or restrict how we use it, receive a portable copy, and withdraw consent. We will reply within 30 days and may ask you to confirm your identity first. There is no charge for a reasonable request.
We collect children's details only as part of a booking made by a parent or guardian. This website is not directed at children, and we do not knowingly collect their data online.
We review this policy at least once a year. This version was last updated on 15 September 2026; material changes will be highlighted on this page.
§ YOUR RIGHTS
Under Uganda's Data Protection and Privacy Act 2019 — and the GDPR if you live in the EU or UK. Tap a card and the message is already written for you.
Ask for a copy of the personal data we hold about you and how it is used.
Changed your email, or spelled your name differently on arrival? We will update our records.
Ask us to erase your data where we no longer need it or have no legal reason to keep it.
Stop marketing emails and any profiling for offers — immediately and for good.
Receive the data you gave us in a common, machine-readable format.
Where we rely on your consent, you can withdraw it at any time without affecting past processing.
§ DISCRETION, BY DESIGN
Diplomats, delegations and guests who simply want to be left alone have chosen the estate for its quiet. The same discretion applies to your details: collected only to look after you, never sold, and kept behind the garden walls.
Your details are never sold or rented
Card payments handled by certified processors
One message to see, correct or delete your data
§ STILL HAVE A QUESTION?
About your data, a booking term, cookies or access to the estate. One WhatsApp message, and the desk takes it from there.
§ POLICIES & SETTINGS
What we collect, why, how long we keep it — and your rights over it.
