THA NICHOLEE HOTEL

Data Protection & Cybersecurity Policy

1. Policy Statement

Tha Nickolee Hotel is committed to protecting the privacy, confidentiality, and integrity of all personal and organizational data. We recognize the importance of cybersecurity in maintaining trust with our guests, employees, partners, and vendors. We take proactive steps to ensure the secure handling, storage, and transmission of data.

2. Purpose

This policy is designed to:

• Ensure compliance with the Kenya Data Protection Act, 2019.
• Protect personal data from unauthorized access, loss, disclosure, or misuse.
• Establish clear guidelines for cybersecurity and responsible data handling.
• Promote data protection awareness and accountability among all staff.

3. Scope

This policy applies to:

• All employees, contractors, and service providers who handle hotel data.
• All digital and physical records, including guest records, human resources files, and financial data.
• All devices and systems used for hotel operations, including computers, servers, email, Wi-Fi networks, and point-of-sale (POS) systems.

4. Definitions

• Personal Data: Information relating to an identified or identifiable individual, such as a name, identification number, contact details, or booking information.
• Data Subject: The individual whose personal data is being processed, such as a guest or employee.
• Data Breach: A security incident involving unauthorized access to, loss, disclosure, alteration, or destruction of personal data.
• Cybersecurity: Measures and practices used to protect systems, networks, and data against digital attacks and unauthorized access.

5. Data Protection Principles

Tha Nickolee Hotel is committed to ensuring that personal data is:

• Collected lawfully, fairly, and for specified, legitimate purposes.
• Processed transparently and used only for appropriate purposes.
• Limited to the data necessary for the intended purpose.
• Accurate and kept up to date where necessary.
• Stored securely and retained only for as long as necessary or legally required.
• Accessible only to authorized personnel with a legitimate business need.

6. Cybersecurity Measures

• Password Protection: Hotel systems must use strong passwords and appropriate password management practices. Passwords should be changed when required by security policy or when compromise is suspected.
• Access Control: Access to systems and data is restricted according to staff roles and business responsibilities.
• Antivirus and Firewalls: Appropriate security software and firewall protections are maintained and updated on supported devices and systems.
• Secure Wi-Fi: Staff and guest networks should be appropriately secured and separated where technically feasible.
• Data Encryption: Sensitive data should be protected through appropriate encryption during transmission and, where supported, while stored.
• Backup Systems: Regular backups are maintained, with appropriate access restrictions and recovery procedures to help protect against data loss.
• System Monitoring: Systems are monitored, where appropriate, for unusual activity, security incidents, and unauthorized access.

7. Staff Responsibilities

All staff members are required to:

• Complete assigned data protection and cybersecurity training.
• Keep passwords confidential and secure devices when unattended.
• Report suspicious activity, lost devices, or suspected data breaches to management or the designated responsible team immediately.
• Use only authorized systems and avoid storing hotel data on personal devices unless specifically authorized and appropriately secured.
• Dispose of physical documents containing personal data securely when they are no longer required, subject to applicable retention requirements.

8. Guest Data Handling

• Guest data is collected and processed for specified, legitimate purposes, such as reservations, accommodation, payments, and related hotel services, in accordance with applicable law.
• Personal data is shared with third parties only where there is a lawful basis for sharing, including where required to provide a service, required by law, or otherwise permitted under applicable data protection requirements.
• Guests may exercise their applicable data subject rights, including requesting access to or correction or deletion of their personal data, subject to the conditions and limitations provided by law.

9. Breach Management

In the event of a suspected or confirmed data breach:

1. The incident must be reported to management or the designated responsible team immediately.
2. The incident will be assessed and investigated, and reasonable steps will be taken to contain it and reduce potential harm.
3. Relevant evidence and incident details will be documented and preserved where appropriate.
4. Affected individuals and the Office of the Data Protection Commissioner (ODPC) will be notified where required by applicable law and within the applicable reporting timelines.

10. Third-Party Compliance

Vendors, contractors, and service providers who access or process hotel data, including booking platforms and payment providers, must:

• Enter into appropriate data protection agreements where required.
• Apply suitable technical and organizational measures to protect personal data.
• Comply with applicable data protection laws and relevant contractual requirements.
• Report security incidents involving hotel data in accordance with their contractual and legal obligations.

11. Policy Review

This policy is reviewed annually or when necessary in response to:

• Changes in applicable laws and regulatory requirements.
• Emerging cybersecurity threats and identified security risks.
• System upgrades, changes in hotel operations, or new data processing activities.

Our Commitment

Tha Nickolee Hotel values the trust our guests and staff place in us. We are committed to protecting personal information through responsible data handling, appropriate security measures, and continuous improvement of our data protection practices.