Privacy Policy
Last updated: 20 October 2026
1. Controller and scope
is the intended data controller for Niko Booked under Kenya's Data Protection Act 2019 and applicable regulations. Privacy enquiries: . Our registration and representative details, where required, will be added following legal review.
2. What we collect
We collect account name and email, phone numbers, booking dates and guest/traveller names, booking and payment references, payment status, M-Pesa receipts, support messages, preferences and usage/security information. Hosts provide identity documents, proof of ownership or permission to let, payout details and exact property addresses. We do not collect M-Pesa PINs.
3. Why and lawful grounds
We process information to fulfil bookings and payments, verify hosts and listings, prevent fraud, send transactional notices, resolve support requests, calculate payouts and meet legal obligations. Depending on the purpose, the proposed grounds are contract, legal obligation, legitimate interests assessed against your rights, and consent for optional marketing. This assessment will be confirmed during legal review.
4. Who receives information
Booking information necessary for fulfilment is shared with the relevant organiser, venue, travel agency or host. Payment, SMS, hosting and other contracted service providers process necessary information for us. Authorised staff may access information for verification, finance or support. We may disclose information when legally required. Host identity files, payout data and exact addresses are not public. Exact addresses and host contact unlock for the paid guest.
5. Security, storage and transfers
We restrict access by role, keep host verification files private and protect payment processing. Providers may process information outside Kenya; any such transfers require the safeguards and conditions applicable under Kenyan law. Provider locations and transfer safeguards will be documented before final approval. No service is completely risk-free.
6. Retention
We keep booking, payment and accounting records for applicable legal retention periods and only retain verification/support information for the purpose and necessary period. Specific retention periods: [Retention schedule]. We will delete or anonymise information when no longer needed, subject to lawful preservation requirements.
7. Your rights
Subject to applicable law, you may request information about processing, access, correction, deletion, restriction or objection, withdraw consent and exercise other applicable rights. Contact ; we may verify your identity before acting. You may complain to Kenya's Office of the Data Protection Commissioner. Withdrawal of marketing consent does not stop necessary booking messages.
8. Cookies, children and updates
Essential storage supports sign-in and security. Any optional analytics or marketing technologies will be disclosed with appropriate controls. Our service is not intended for children to create accounts independently; suppliers may allow children on bookings arranged by an adult. Material changes will be dated and notified as appropriate.