Privacy policy

This policy explains how Peponi handles personal data. It is written to comply with the Data Protection Act, No. 24 of 2019 of Kenya and the regulations made under it, and it reflects how this website actually works.

1. Who we are

The data controller is [full registered company name to confirm], trading as Peponi Beachfront Developments, registered in [jurisdiction and company number to confirm], with its registered office at [address to confirm] and operations on the Kenyan coast.

Contact for all data protection matters: invest@peponi-resort.com. [If a data protection officer is appointed, or once the controller is registered with the Office of the Data Protection Commissioner, add the name and registration number here.]

2. Scope of this policy

This policy covers personal data we collect through this website and the correspondence that follows an enquiry. Where a relationship progresses to a transaction, further data protection terms are set out in the transaction documents, and the due-diligence process is explained to you at the time.

3. What we collect

Information you give us through the enquiry forms: your name; email address; telephone number; organisation and role; country of residence; the type of enquiry; your indicative investment range or budget; your area of interest, preferred structure and timing; professional registration details; details of land you own or represent; and the content of your message.

Information generated automatically when you visit: the request logs kept by our hosting provider, which typically include IP address, date and time, pages requested, browser type and referring page. These are used for security and to keep the site running.

Due-diligence information, collected separately and never through this website: identity documents, proof of address, source-of-funds evidence, beneficial ownership details and sanctions-screening results, where a transaction progresses.

4. How we collect it

Directly from you, through the forms, by email or in conversation; automatically through server logs; and, for due diligence only, from your advisers, from public registers and from screening providers.

5. Why we use it

To respond to your enquiry and correspond with you; to assess whether there is a fit between your objectives and a project; to send project information and the updates you have asked for; to maintain our list of professional partners and landowner contacts; to carry out identity, source-of-funds and sanctions checks; to negotiate, enter and perform contracts; to keep records required by law; to establish, exercise or defend legal claims; and to operate and secure this website.

We do not sell your data. We do not share it with third parties for their own marketing, we do not use it for automated decision-making or profiling that produces legal effects, and an enquiry does not place you into an automated marketing sequence.

6. Lawful basis

Under section 30 of the Data Protection Act, 2019 we rely on: consent, where you tick the consent box on a form or ask to join the updates list; necessity for a contract, including steps taken at your request before entering one; legal obligation, for anti-money-laundering, tax and company record-keeping; and our legitimate interests in operating and securing the business, responding to enquiries and protecting our legal position, where those interests are not overridden by your rights.

7. Consent and withdrawal

Where we rely on consent, you may withdraw it at any time by emailing us. Withdrawal does not affect processing already carried out, and does not affect data we must keep under a legal obligation.

8. Who we share it with

Only where necessary, and only with: our professional advisers (legal, survey, environmental, accounting and tax); service providers acting on our instructions who host this website, deliver our email or store our records; screening providers used for anti-money-laundering checks; a counterparty's advisers where you ask us to deal with them; and regulators, authorities or law enforcement where we are legally required to disclose.

Our processors are engaged under written terms requiring them to act only on our instructions and to keep the data secure, as required by section 42 of the Act.

9. Transfers outside Kenya

Peponi works with international investors and partners, and some of our service providers are located outside Kenya. Your data may therefore be transferred to and stored in another country.

Where we transfer personal data out of Kenya we do so in accordance with sections 48 and 49 of the Data Protection Act, 2019 — on the basis of appropriate safeguards, your explicit consent, or the necessity of the transfer for the performance of a contract or for the establishment of a legal claim. [Confirm with counsel the specific safeguard relied on and the recipient countries, and record the transfer-impact assessment.]

10. How long we keep it

Enquiries that do not progress: retained for [period to confirm — commonly 24 months], then deleted. Professional-partner and landowner contacts: retained until you ask us to remove them, and reviewed periodically. Records relating to a transaction or an investor relationship: retained for the period required by Kenyan company, tax and anti-money-laundering law, which for AML records is generally seven years after the relationship ends. Server logs: a short rolling period for security purposes.

11. Security

The site is served over an encrypted connection, access to enquiry data is limited to the people who need it, and project data rooms are provided under separate access controls and confidentiality terms. We keep records of processing and review our security arrangements periodically.

No system is completely secure and we cannot guarantee the security of information transmitted to us over the internet. Please do not send passwords, identity documents, bank details or payment information through the website forms. We will never ask you for payment details by email, and we will never send you revised bank details by email — verify any payment instruction by telephone with a known contact before acting on it.

Where a personal data breach presents a real risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and will notify you where the Act requires it.

12. Your rights

Under section 26 of the Data Protection Act, 2019 you have the right: to be informed of the use of your personal data; to access the personal data we hold about you; to object to the processing of all or part of it; to have inaccurate or misleading data corrected; to have false or misleading data deleted; and to data portability. You may also withdraw consent where we rely on it, and ask us to restrict processing while a dispute is resolved.

These rights are not absolute. We may decline a request where the Act permits it — for example where retention is required by law, or where complying would prejudice the establishment or defence of a legal claim.

13. Exercising your rights

Email invest@peponi-resort.com stating what you want and enough detail for us to identify you. We may ask for proof of identity. We will respond without undue delay and in any event within the period required by the Act. There is no fee unless a request is manifestly unfounded or excessive.

14. Cookies and analytics

This website sets no advertising, analytics or tracking cookies. It loads a web-font stylesheet from Google Fonts, which means your browser makes a request to Google's servers and your IP address is visible to them; the font files can be self-hosted instead if you would prefer that request not to be made.

[If analytics, a marketing pixel or any non-essential cookie is added later, this section must be updated and a consent banner added at the same time. Consent under the Act must be express, informed and as easy to withdraw as to give.]

15. Children

This website is intended for business and investment audiences and is not directed at children. We do not knowingly collect personal data relating to a child. If you believe we have, contact us and we will delete it.

16. Changes

We may update this policy. The date at the top of the page shows when it was last revised, and material changes will be highlighted here.

17. Complaints

If you are concerned about how we have handled your data, contact us first and we will try to resolve it. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya, which supervises compliance with the Data Protection Act, 2019. If you are located elsewhere, you may also be able to complain to the data protection authority in your own country.

Note for publication: this is a general policy drafted against the Kenyan Data Protection Act, 2019 and matched to how this website actually operates. It must be reviewed and completed by a qualified Kenyan advocate before the site goes live. Note also that data controllers and processors in Kenya may be required to register with the Office of the Data Protection Commissioner; confirm whether Peponi meets the registration threshold and complete that registration before collecting enquiries at scale.