01Who we are
The Olkaria Geothermal Spa (“the spa”) is a facility of Kenya Electricity Generating Company PLC (“KenGen”, “we”, “us” or “our”), a public company incorporated in Kenya with its head office at Stima Plaza, Kolobot Road, Parklands, P.O. Box 47936-00100, Nairobi, Kenya.
KenGen is the data controller for the personal data described in this policy, as defined in the Data Protection Act, 2019 (“the Act”). This means we decide why and how your personal data is processed, and we are responsible for protecting it.
This policy explains what personal data we collect when you visit this website, book a visit, contact us, or use the staff dashboard; why we collect it; who we share it with; how long we keep it; and the rights you have. Please read it together with our terms and conditions and our cookie policy.
02Personal data we collect
When you book a visit
- Your full name and email address.
- Your national ID number or, for non-residents, your passport number and country. We use these to confirm your identity and your eligibility for the visitor rate you chose when you arrive.
- Your visitor type (for example Kenyan national, resident, non-resident, KenGen staff or student group).
- The date of your visit, the number of adults and children in your group, and any add-ons you select.
- The amount due, your booking reference and the date and time you booked.
We record only the number of children in a group. We do not ask for children's names or other details.
Payment
Payment is made on arrival at the spa. This website does not ask for, collect or store card, M-Pesa or bank details.
When you use the website
- Technical data such as your IP address, browser type, device type and the pages requested, which our hosting provider records in server logs to deliver and secure the site.
- Security signals collected by Google reCAPTCHA (part of Firebase App Check) to tell real visitors from automated abuse. See our cookie policy.
- To stop the booking and password reset forms being misused, we keep a one-way, irreversible code (a “hash”) of your IP address and email address for one hour, only to count how many requests have been made.
- Your cookie choices.
When you contact us
If you call, email or write to us, we keep what you tell us and our reply, so we can deal with your enquiry or complaint.
Staff dashboard users
For KenGen staff invited to the admin dashboard, we process your work email address, your role, your account status, sign-in events, password reset requests and an audit log of the changes you make (for example updating prices or booking statuses).
What we do not collect
We do not knowingly collect sensitive personal data (as defined in section 2 of the Act, such as health, ethnic, biometric or religious data) through this website. Please do not send us such data. We do not use analytics or advertising cookies, and we do not build marketing profiles.
03How we use your data and our lawful basis
Section 30 of the Act allows us to process personal data only where we have a lawful basis. The table below sets out each purpose and the basis we rely on.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Taking, confirming and managing your booking, and sending your confirmation email and letter | Booking details, name, email | Performance of a contract with you, or steps you asked us to take before entering into one |
| Checking your identity and visitor-rate eligibility at the gate | Name, ID or passport number, country, visitor type | Performance of a contract; our legitimate interest in charging the correct rate |
| Running the spa safely: capacity planning, closures, front-desk guest lists | Booking details, group size | Performance of a contract; legitimate interests in safe operations |
| Keeping financial and accounting records | Booking reference, amount, dates | Compliance with a legal obligation (for example tax and public finance laws) |
| Protecting the website, bookings and accounts from fraud, spam and attack | IP address (hashed), technical data, reCAPTCHA signals | Legitimate interests in security; compliance with the Computer Misuse and Cybercrimes Act, 2018 |
| Answering enquiries and complaints | Contact details, your message | Legitimate interests; performance of a contract where it concerns a booking |
| Understanding demand (for example how many visitors come each month) in aggregate reports | Booking data, combined so that individuals are not identified | Legitimate interests in planning and improving the spa |
| Playing embedded YouTube video | Data YouTube collects when the player loads | Your consent, which you can withdraw at any time |
| Managing staff dashboard accounts and keeping an audit trail | Staff email, role, activity log | Legitimate interests in security and accountability; compliance with legal obligations |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may object to this processing at any time (see “Your rights” below).
We do not use your personal data for direct marketing. If we ever want to send you marketing messages, we will ask for your consent first, as section 37 of the Act requires, and every message will include a simple way to opt out.
We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects (section 35 of the Act).
05International transfers
Some of our service providers store or process data on servers outside Kenya, including in the European Union and the United States. Where personal data is transferred outside Kenya, we do so in line with sections 48 to 50 of the Act and Part VI of the Data Protection (General) Regulations, 2021: we transfer it only to providers that give appropriate safeguards for its security and protection, such as binding contractual commitments and industry security certifications, or where another lawful ground for the transfer applies.
06How long we keep your data
We keep personal data only for as long as we need it for the purposes above (section 39 of the Act):
| Data | How long we keep it |
|---|---|
| Booking records | For the period needed to deliver your visit, then for as long as tax, audit and public finance laws require us to keep financial records (generally at least five years after the end of the relevant financial year), and then deleted or anonymised |
| Hashed IP and email codes used for rate limiting | One hour |
| Enquiries and complaints | Up to two years after the matter is closed, unless needed for a legal claim |
| Staff dashboard accounts | While the account is active; deleted when a super admin removes it or the user deletes their own account |
| Dashboard audit log | As long as needed for security and accountability, and in any case no longer than seven years |
| Your cookie choice | Six months, after which we ask you again |
| Server logs kept by our hosting provider | In line with the provider's standard log retention periods |
We may keep data for longer where the law requires it, or where it is needed to establish, exercise or defend a legal claim. Aggregated statistics that do not identify anyone may be kept indefinitely.
07How we protect your data
We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration and disclosure (section 41 of the Act). These include:
- Encryption in transit (HTTPS) for all traffic to the website, and encryption at rest by our hosting provider.
- Access to booking data restricted to invited, authenticated staff, with database rules that deny access by default and a separate, stricter role for prices and user management.
- An audit log of administrative changes.
- Automated protection against bots, spam and repeated requests.
- Temporary passwords that expire, and enforced password strength for staff accounts.
No system is completely secure. If a personal data breach is likely to put your rights and freedoms at risk, we will notify the Data Protection Commissioner within 72 hours of becoming aware of it, and we will tell you without undue delay where the law requires, as set out in section 43 of the Act.
08Your rights
Under sections 26 and 38 to 40 of the Act, you have the right to:
- Be informed of how your personal data is used, which is what this policy does.
- Access the personal data we hold about you and get a copy of it.
- Have inaccurate or misleading data corrected.
- Have data deleted where we no longer need it or have no lawful basis to keep it.
- Object to processing we carry out on the basis of legitimate interests.
- Ask us to restrict processing while a complaint about accuracy or lawfulness is looked into.
- Receive data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller (data portability).
- Withdraw your consent at any time where we rely on it, without affecting processing that happened before.
- Not be subject to a decision based solely on automated processing that significantly affects you.
To use any of these rights, contact us using the details at the end of this policy. We may ask you to prove your identity before we act, so that we never give your data to someone else. We will respond within the time limits set by the Data Protection (General) Regulations, 2021, and there is normally no charge.
Some rights have limits. For example, we cannot delete a booking record that the law requires us to keep for accounting purposes, but we will tell you if that is the case.
09Children
This website and our booking service are intended for adults. Bookings must be made by a person aged 18 or over, who is responsible for any children in the group. We do not knowingly collect personal data directly from children. If you believe a child has given us personal data, contact us and we will delete it.
10Links to other websites
This website links to other sites, including KenGen's corporate website and social media pages on Facebook, X, Instagram, LinkedIn and YouTube. Those sites are run by other organisations under their own privacy policies. We are not responsible for their content or how they handle your data.
11Complaints
If you are unhappy with how we have handled your personal data, please contact us first so we can try to put it right.
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.
12Changes to this policy
We may update this policy from time to time, for example when the law or our services change. The date at the top of the page shows when it was last updated. If we make significant changes, we will show a notice on this website and, where appropriate, ask for your consent again.
13Contact us
For any question about this policy, or to exercise your rights, contact KenGen's Data Protection Officer, care of the Olkaria Geothermal Spa:
Phone: 0711 036 040 (daily, 08:00–17:00)
The spa: Olkaria Geothermal Spa, Olkaria Geothermal Project, P.O. Box 785-20117, Naivasha, Kenya
Head office: Kenya Electricity Generating Company PLC, Stima Plaza, Kolobot Road, Parklands, P.O. Box 47936-00100, Nairobi, Kenya