Privacy policy

Last updated: October 2026

Coast & Culture Kenya is a guiding business based in Mombasa, Kenya. We handle personal data in line with the Kenya Data Protection Act, 2019, and the guidance of the Office of the Data Protection Commissioner (ODPC).

What we collect

• Booking details: name, email, group size, chosen date and experience.
• Payment references from our payment processor. We never see or store card numbers or M-Pesa PINs.
• Enquiry messages you send through the contact form or WhatsApp.
• Guest photographs you submit, only with the consent you record at submission.
• Basic, privacy-friendly site analytics (page views), without cookies or cross-site tracking.

Why we use it

To deliver the experiences you book, take payment, communicate about your booking, answer enquiries, and meet our legal and accounting obligations. We do not sell personal data and we do not send marketing email without your agreement.

How long we keep it

Booking and payment records are kept as long as tax and accounting rules require. Enquiries are kept until resolved and then for a reasonable period for follow-up. Guest photo permissions remain on record for as long as the photograph may be published, and can be withdrawn at any time.

Your rights

Under the Data Protection Act you may request access to your data, correction of inaccurate data, deletion where we no longer need it, and withdrawal of consent for optional uses such as guest photographs. To exercise any of these rights, contact us through the contact page. If you are not satisfied, you may complain to the ODPC.

Sharing and location

We share the minimum necessary data with our payment processor (Paystack) and email provider to deliver the service. Transactional data may be processed outside Kenya under appropriate safeguards permitted by the Act.