Privacy Policy

This policy explains what personal data Severin Sea Lodge collects when you visit our website, book a stay, contact us, subscribe to our newsletter or apply for a job – and what rights you have.

1. Who is responsible

Severin Sea Lodge (E.A.) Ltd.
P.O. Box 82169, Malindi Road, Mombasa 80100, Kenya
Email: reservations@severinsealodge.com
Phone: +254 746 994 520 · WhatsApp: +254 746 995 690

We process personal data in line with the Kenya Data Protection Act, 2019. Where guests from the European Union or the UK are concerned, we also respect the rights granted by the GDPR / UK GDPR.

2. Visiting our website

Our website is hosted by Webflow, Inc. (USA). When you open a page, your browser automatically transmits technical data: IP address, date and time, page requested, referring page, browser type and operating system. Webflow uses this data to deliver the site securely and to detect attacks. We do not use it to identify you.

Legal basis: our legitimate interest in a secure, working website (GDPR Art. 6(1)(f)).

3. Cookies and your consent

When you first visit, a banner asks which cookies you allow. Nothing beyond strictly necessary storage is used until you agree. You can change or withdraw your choice at any time via “Cookie Settings” in the footer of every page.

The banner is provided by Finsweet Consent Pro. It stores your choice on your device so we don’t ask again on every page.

• Essential – Consent Pro (Finsweet): stores your cookie choice; 12 months.
• Analytics – Google Analytics 4 (_ga, _ga_93P3V9G37B): random ID to count visits and page views; up to 2 years.
• Marketing – YouTube (privacy-enhanced mode): playback settings in local storage; until deleted.

Google Analytics is loaded via Google Tag Manager only after you accept analytics cookies. It tells us which pages are read and where visitors come from, so we can improve the site. IP addresses are not stored by GA4. Provider: Google Ireland Ltd. / Google LLC (USA). Opt-out: Cookie Settings or Google’s browser add-on.

YouTube videos (on our media page) load only after you accept marketing cookies. Until then you see a placeholder. Our main film on the homepage is hosted by us and sets no cookies.

Legal basis: your consent (GDPR Art. 6(1)(a); Kenya DPA s. 30(1)(a)), which you can withdraw at any time.

4. Booking your stay

When you book through the “Book your stay” button, you use the booking engine of Mews Systems (our property management system). Mews processes your name, contact details, stay dates, guest numbers, special requests and payment data on our behalf. Card data is handled by Mews’ certified payment provider; we never see full card numbers.

We use the same data to prepare your stay, issue invoices and meet legal duties (e.g. guest registration and tax records under Kenyan law).

If you book via Booking.com, a tour operator or another agent, that company is responsible for the data it collects. It passes us only what we need to host you.

Legal basis: performance of a contract and legal obligations (GDPR Art. 6(1)(b) and (c); Kenya DPA s. 30(1)(b)).

5. Contacting us

If you write to us by email, via the contact form, by phone or WhatsApp, we use your details only to answer your request.

• Contact form: submissions are stored by Webflow and forwarded to our inbox. To block spam and bots, our forms use Cloudflare Turnstile (Cloudflare, Inc., USA), which checks technical browser data and your IP address when you submit a form.
• Email: we use Google Workspace (Gmail). Video calls, e.g. for events or groups, run on Google Meet.
• WhatsApp: if you message us on WhatsApp, WhatsApp (Meta Platforms) processes your number and messages under its own terms.

Legal basis: steps before a contract and our legitimate interest in answering enquiries (GDPR Art. 6(1)(b) and (f)).

6. Newsletter

If you sign up for our newsletter, we use your email address (and your name, if given) to send news and offers from Severin Sea Lodge. We send it via Mailchimp (Intuit Inc., USA). Mailchimp records whether a newsletter was opened and which links were clicked, so we can see what interests our readers.

You can unsubscribe at any time via the link at the bottom of every newsletter, or by writing to reservations@severinsealodge.com.

Legal basis: your consent (GDPR Art. 6(1)(a); Kenya DPA s. 30(1)(a)).

7. Job applications

We manage applications with JOIN (JOIN Solutions AG, Switzerland). When you apply via our careers page or a JOIN job ad, we receive the details you send, such as your name, contact details, CV and cover letter. Only the people involved in hiring see them.

If we don’t hire you, we delete your application 6 months after the decision, unless you agree that we keep it for future openings.

Legal basis: steps before an employment contract (GDPR Art. 6(1)(b); Kenya DPA s. 30(1)(b)).

8. Who else receives data

We only share personal data with service providers that work on our behalf and under contract:

• Webflow, Inc. – website hosting, forms (USA)
• Google (Workspace, Analytics, Tag Manager, YouTube) – email, meetings, statistics, videos (Ireland / USA)
• Mews Systems – booking engine, guest management (EU)
• Intuit Mailchimp – newsletter (USA)
• JOIN Solutions AG – job applications (Switzerland)
• Finsweet (Consent Pro) – cookie banner (USA)
• Meta (WhatsApp) – messaging, only if you contact us (USA)

Some providers are outside Kenya and the EU. Where this is the case, transfers rely on adequacy decisions (e.g. EU-US Data Privacy Framework), standard contractual clauses or other safeguards under s. 48–50 Kenya DPA and Chapter V GDPR.

We never sell your data.

9. How long we keep data

• Booking and invoice records: as long as Kenyan tax and accounting law requires (generally 7 years).
• Enquiries: until the matter is settled, then up to 2 years.
• Newsletter: until you unsubscribe.
• Applications: 6 months after the decision (see section 7).
• Analytics data: 14 months.

10. Your rights

You have the right to:

• know what data we hold about you and get a copy,
• have incorrect data corrected,
• have data deleted or its use restricted,
• object to processing based on our legitimate interests or for direct marketing,
• receive your data in a portable format,
• withdraw consent at any time, without affecting earlier processing.

To use any of these rights, email reservations@severinsealodge.com. We reply within 30 days.

You can also complain to the Office of the Data Protection Commissioner, Kenya (www.odpc.go.ke). If you live in the EU, you may contact the data protection authority in your country.

11. Security

Our website runs over encrypted HTTPS connections. Access to guest data is limited to staff who need it for their work.

12. Children

Our website is not aimed at children. We only collect children’s data (e.g. names and ages for a family booking) from the adult making the booking.

13. Changes

We update this policy when our services or the law change.