Privacy Policy

Jinna Suites Hotel ("Jinna Suites", "the hotel", "we", "us", "our") is a hotel business operating at Bukerere Road, Misindye, Mukono, Uganda. This privacy policy explains how we collect, use, store, share and protect personal data when you visit our website, contact us, make a booking, stay with us, attend an event, or use any of our digital services, including the concierge chat and its automated assistant.

For the purposes of the Uganda Data Protection and Privacy Act, 2019 (the "DPA") and its regulations, Jinna Suites Hotel is the data controller in respect of the personal data described in this policy. That means we decide why the data is collected and how it is used, and we are accountable for it.

Where we process personal data of individuals located in the European Economic Area, the United Kingdom, Kenya or another jurisdiction with its own data-protection law, we also apply the additional safeguards described in section 30 of this policy. Where those laws give you stronger rights than the DPA, we honour the stronger standard.

Our contact details are:

• Postal address: Bukerere Road, Misindye, Mukono, Uganda
• Email: info@jinnasuites.com
• Telephone: +256 705 732 344
• Website: https://jinnasuites.com/

This policy applies to the website and to the hotel's guest-facing operations. It does not apply to third-party websites, applications or services that we link to but do not control. Those services publish their own privacy notices, and we encourage you to read them.

How to read this document

The document is long because it covers every way we handle personal data, from a room reservation to a photograph taken at a wedding. Section 3 gives a plain-language summary if you have five minutes rather than fifty. Sections 4 to 14 describe what we collect and why. Sections 15 to 24 explain how we share, transfer, retain and protect it. Sections 25 to 29 set out your rights and how to exercise them. The remaining sections cover automated tools, changes to this policy and jurisdiction-specific additions.

Where we refer to "personal data" we mean any information relating to an identified or identifiable individual. An identifiable individual is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

"Processing" means anything done to personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure or destruction. It is a deliberately wide term, and it is the term the law uses.

This policy covers:

• visitors to https://jinnasuites.com/ who browse without making a booking;
• people who enquire by email, telephone, the concierge chat, social media or a booking channel;
• guests who reserve and stay in the hotel, including members of their party;
• people who attend conferences, weddings, receptions and other events at the hotel;
• suppliers, contractors and business contacts who deal with us;
• people whose image is captured by our security cameras or by photography commissioned at an event.

It does not cover employees and job applicants, who receive a separate internal notice, or the practices of third parties whose websites and applications you use to reach us.

The short version

We collect only the information we need to hold your room, look after you while you are here, keep the hotel secure and meet our legal obligations. We do not sell personal data. We do not share it with advertisers so that they can build a profile of you. We use a small number of carefully chosen service providers — a payment processor, an email provider, a booking system — and we require them to protect what they handle on our behalf.

Our website sets essential cookies so that it works. Analytics and marketing cookies are off until you switch them on, and you can change your mind at any time from the Cookie settings link in the footer. The concierge chat asks for your name and telephone number before the conversation begins because the front desk needs to know who it is speaking to and how to reach you if the connection drops.

We keep booking and financial records for seven years because tax and accounting law requires it. We keep marketing preferences until you withdraw them. We delete or anonymise most other operational data much sooner. Section 23 sets out the full retention schedule.

You can ask to see your data, correct it, delete it, restrict how we use it, object to a particular use, or receive a copy in a portable format. Section 25 explains how, and section 27 explains what happens if we get it wrong.

The table below is a navigational aid, not a substitute for the detail in the sections that follow.

We do not deliberately collect information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, or sexual orientation. If you volunteer such information in a message — for example, asking for a quiet room because you are observing a religious fast — we will use it only to accommodate the request and will not record it in a marketing profile.

When you enquire or book, we collect your name, telephone number and, where you provide it, your email address. At check-in we additionally record your nationality, date of birth where required, and the number and type of identification document you present, because Ugandan law requires hotels to maintain a guest register.

We ask for a telephone number for two reasons. First, the front desk may need to reach you on the day of arrival — a road closure, a delayed flight, a room that is not ready. Second, the concierge chat uses your number to reconnect you to your conversation if the page reloads or your connection drops, so you do not have to repeat yourself.

We do not require you to create an account, and we do not ask for a password to book a room. If we introduce accounts in future, this policy will be updated before that feature goes live.

Where you book on behalf of someone else, you are responsible for making sure that person knows you have shared their details with us and has agreed to it. We will use their details only for the booking.

Where you provide a business email address or company name, we treat that information as business contact data. We may use it to administer a corporate rate agreement, but we will not add a business contact to a consumer marketing list without a clear opt-in.

A reservation generates a record that includes the dates of stay, the room category, the number of adults and children, the rate agreed, the currency displayed, any special requests, and the status of the booking as it moves from pending to confirmed to checked-in to checked-out.

Special requests are optional, but they can reveal sensitive information if you choose to share it — for example, "ground floor please, my mother cannot manage stairs" or "severe nut allergy". We treat such notes as confidential, restrict them to the staff who need them, and do not use them for any purpose other than delivering the stay. Section 15 explains this in more detail.

We record whether you have stayed with us before, so that the desk can recognise a returning guest and avoid asking the same questions twice. That history is limited to stay dates, room category and service notes. It is not a behavioural profile and it is not shared with advertisers.

Where you use the concierge chat before booking, the transcript forms part of your enquiry record. If you then book, the transcript is linked to the reservation so the desk can see what was promised. If you do not book, the transcript is retained for the period described in section 23 and then deleted.

We also record operational data about the stay: the time you checked in and out, wake-up calls you requested, restaurant and spa bookings charged to your room, and any maintenance issue reported in your room. This is ordinary hotel accounting and service data.

Our booking flow does not take payment. You reserve the room, and you settle the bill at the hotel. That design is deliberate: it reduces the amount of financial data we hold and removes the risk that card details are captured by a website that does not need them.

When you pay at the desk, we record the amount, the currency, the method (card, cash or mobile money), the date, and a transaction reference. If you pay by card, the terminal prints or transmits a slip that shows the last four digits of the card number; we keep the merchant copy for reconciliation and do not store the full card number, the expiry date or the security code in any of our systems.

If you pay by mobile money, the reference number from the network operator is recorded against your folio. We do not receive or store your mobile money PIN.

If a refund is due, we process it through the same method where possible and record the refund reference. Refunds to a card can take several business days to appear, depending on your bank. We will tell you when the refund has been released from our side.

Where a corporate account is used, we may share an invoice with the company that is paying, limited to the stay dates, the room rate and the amount due. We do not share special requests or other guest notes with a corporate payer.

Financial records, including invoices and receipts, are retained for seven years to meet Uganda Revenue Authority requirements. This retention obligation overrides a deletion request in respect of the financial record itself, though we will delete other data you ask us to remove.

The Uganda Hotels Act and related regulations require hotels to keep a register of guests. At check-in we therefore record your full name, nationality, identification document type and number, the date of arrival and the date of departure, and the room assigned.

We verify the document against the person presenting it. We do not photocopy or scan identity documents as a matter of routine. Where a scan is required — for example, by a corporate client's travel policy or by an immigration requirement for a foreign national — we store it in a restricted folder accessible only to the general manager and the front-office supervisor, and we delete it when the statutory retention period ends.

The guest register is available to authorised inspectors and to the police where the law requires it. We do not disclose it for any other purpose, and we do not sell or rent the information in it.

If you decline to provide identification, we may be unable to complete your check-in. We will explain the legal basis at the desk and, where possible, offer an alternative that satisfies the requirement without unnecessary collection.

When you contact us, we keep a record of the conversation. That record exists so that the next person who helps you does not make you start again, and so that there is an agreed version of what was promised.

The concierge chat

Before a chat begins, the widget asks for your name and telephone number, and optionally your email address. The name lets the desk address you properly. The telephone number is the minimum contact the front desk needs to follow up a booking or a lost item, and it is the identifier we use to reconnect you to your thread. You are not required to provide an email address to chat.

Chat messages are stored on our own server, not on a third-party messaging platform. They are visible to the front-desk team and to the concierge manager. The automated assistant may read your message in order to answer it; section 28 explains how that works and what it does not do.

If you send a photograph through the chat — a picture of a damaged item, a transfer meeting point, a document you are asking about — it is stored with the message. Please do not send images of identity documents, payment cards or anything you would not want a hotel employee to see. We accept up to three images per message, each no larger than five megabytes, in JPEG, PNG or WebP format.

Outside front-desk hours, the assistant offers to take a message and an email address so that the desk can reply in the morning. That capture is optional. If you provide an address, it is used only to answer that enquiry unless you separately opt in to marketing.

Email and telephone

Emails sent to info@jinnasuites.com are stored in our business mailbox and are accessible to the staff who need to respond. Telephone calls are not recorded. The desk keeps a written note of the substance of a call when it affects a booking.

Transactional email — confirmations, modifications, cancellation notices, receipts — is sent because it is necessary to perform the contract with you. Marketing email is sent only where you have opted in, and every marketing message contains an unsubscribe link that works without requiring you to log in.

WhatsApp and social media

If you message us on WhatsApp, Instagram, Facebook or another platform, the platform operator also processes the data under its own terms. We receive the message content and your profile name, and we keep a copy in our enquiry records where it relates to a booking. We do not control the platform's retention or its use of metadata; please read its privacy notice.

The hotel operates closed-circuit television in the car park, at the main entrance, in the lobby, along the external walkways and at the service entrances. Cameras are not installed in guest rooms, bathrooms, changing areas or the spa treatment rooms. Signs at the entrances tell guests that recording is taking place.

CCTV footage is used for the prevention and investigation of crime, the safety of guests and staff, and the protection of property. It is viewed only by authorised security staff and management, and only when there is a reason to view it. Footage is retained for thirty days on a rolling basis and then overwritten, unless it is preserved because it relates to a specific incident, an insurance claim or a police request.

If you are involved in an incident, we may create a written record that includes your account, the accounts of staff and witnesses, and relevant footage. Incident records are kept for the period described in section 23 and are shared with our insurer or the police only where necessary.

Event photography

Weddings, conferences and celebrations are often photographed. Where we commission a photographer, the contract requires the photographer to take reasonable care with guests' images and to credit the hotel where images are published. Where the organiser commissions the photographer, the organiser is responsible for obtaining consent from their guests. We will always tell you if a photographer is working in a public area, and you are welcome to ask not to be photographed.

We may use images of the venue, and wide shots of an event in which individuals are not the focus, in our own marketing. We do not use a close-up portrait of an identifiable guest in marketing without that guest's permission.

Like every website, ours receives technical information when a page is requested. Our server records the IP address that made the request, the date and time, the page requested, the referring page, the browser's user-agent string, and the response status. These logs are used to keep the site running, to diagnose errors, to detect abusive traffic and to investigate security incidents.

We do not use server logs to build a profile of an individual visitor, and we do not combine them with booking records except where an investigation requires it — for example, to trace a fraudulent booking or a sustained attack on the site.

Server logs are retained for thirty days. Security incidents that require an investigation may be retained longer, in a restricted location, until the matter is closed.

The site is served over HTTPS. That encrypts the connection between your browser and our server, but it does not make the information you type invisible to us — it protects it from interception in transit.

We use a web application firewall and rate limiting to protect the site. These tools may temporarily record an IP address in order to block abusive requests. The records are short-lived and are not used for marketing.

A cookie is a small text file that a website asks your browser to store. When you return to the site, the browser sends the file back, which lets the site remember that you have been here before. Cookies can be set by the site you are visiting ("first-party cookies") or by another company whose code runs on that site ("third-party cookies"). Similar technologies include local storage, session storage, pixels and software development kits in mobile applications. This section and the inventory in section 12 cover all of them.

We use cookies for four reasons, and we group them into four categories in the consent banner:

• Necessary. These keep the site working and secure. They remember a form submission while you move between pages, protect against cross-site request forgery, keep your session alive in the booking flow, and record your cookie choice itself. They cannot be switched off, because without them the site cannot function.
• Preferences. These remember choices you have made: the currency you prefer to see prices in, whether you want the dark or light theme, and the language you selected. They are set only when you interact with the relevant control.
• Analytics. These help us understand which pages are used, which are ignored, and where people abandon the booking flow. They are off until you switch them on.
• Marketing. These would allow advertising platforms to recognise you after you leave our site, so that a campaign can be measured or a relevant offer shown. They are off until you switch them on, and we do not use them to build an advertising profile of you.

Our opt-in model

When you first arrive, only necessary cookies are active. The banner offers three equally prominent choices: accept all, reject all optional cookies, or open the preferences panel and choose category by category. Rejecting is as easy as accepting, and neither choice degrades your ability to browse or book. Nothing is pre-ticked except the necessary category, which cannot be ticked or unticked because it does not depend on consent.

Your choice is stored in a first-party cookie called jinna_consent. The value records which categories you allowed and when you decided, and it carries a signature so that the site can tell a genuine choice from a forged one. The timestamp inside the record is not covered by the signature; it exists so that we can expire the record and ask you again after a reasonable interval. The cookie lasts for 180 days, after which the banner appears once more. You can change your mind at any time from the Cookie settings link in the footer; the change takes effect immediately and the page reloads so that any tag you have just disabled stops running.

What happens when you withdraw consent

Withdrawal stops future processing. It does not make lawful the processing that happened while consent was in place, and it does not require us to delete records that we hold on another legal basis — for example, a booking confirmation held to perform the contract. Where a tag has already set a third-party cookie, withdrawing consent prevents that tag from loading again, but the existing cookie may remain in your browser until it expires or you delete it. Section 12 explains how to remove cookies yourself, and our Cookie settings panel also clears the first-party cookies that we control when you reject the category that set them.

Do Not Track and Global Privacy Control

Some browsers send a "Do Not Track" signal. There is still no agreed standard for how a site should respond, and we do not treat the signal as a consent decision on its own. We do, however, honour Global Privacy Control where your browser sends it, treating it as a request to opt out of sale and sharing for cross-context behavioural advertising, and as a request to disable analytics and marketing cookies by default for that browser. You can still opt in explicitly from the banner if you wish.

Managing cookies in your browser

Every major browser lets you view, block and delete cookies. The controls are usually under Settings, then Privacy and security, then Cookies and site data. Blocking all cookies will break parts of this site: the currency switcher will forget your choice, the booking form may lose its place, and the consent banner will reappear on every page. If you use a private or incognito window, cookies are deleted when you close the window, which is a simple way to browse without leaving a trace on a shared computer.

We do not use cookies to fingerprint your device, to read data from other sites, or to identify you personally unless you have given us your name in a form or a chat. The technical identifiers in analytics cookies are pseudonymous: they distinguish one browser from another, not one person from another.

The table below lists every cookie and browser storage key that the site can set, what it does, how long it lasts and which category it belongs to. It is kept in step with the code; if we add a cookie, this table is updated in the same release.

Analytics and marketing rows are conditional. If you have not consented, those cookies are not set at all: the scripts that would set them are not printed into the page, rather than being loaded and then blocked. This matters because a blocked script can still make a request in some browsers, and we would rather not make the request at all.

Third-party content

The contact page and the home page embed a Google Maps frame. The frame is loaded with a privacy-enhanced referrer policy, but Google may still receive your IP address and set its own cookies when the map loads. We do not control those cookies. If you would rather not load the map, you can use the written directions on the contact page, which contain the same information. The weather strip and the currency converter call our own server; our server queries Open-Meteo and an exchange-rate service on your behalf, so those providers see the hotel's server address rather than yours.

How to remove cookies yourself

Deleting cookies is a browser action, not something we can do remotely. In Chrome, open Settings, Privacy and security, Third-party cookies, then See all site data and permissions, search for the site and delete its data. In Safari, open Settings, Privacy, Manage Website Data, search and remove. In Firefox, open Settings, Privacy and Security, Cookies and Site Data, Manage Data. In Edge, open Settings, Cookies and site permissions, Manage and delete cookies and site data. Clearing site data also clears the chat thread and your currency and theme choices.

If you would like us to delete a server-side record associated with your cookie identifier, contact us using the details in section 33. Because the identifiers are pseudonymous, we may need additional information to locate the right record, and we will tell you what we need without asking for more than is necessary.

We send marketing only to people who have asked for it. There are three ways to end up on our list: you tick a box on the newsletter form, you tick a box during booking, or you ask the front desk to add you. In each case the box is unticked by default and the wording explains what you will receive. Booking a room does not sign you up for marketing, and providing an email address for a booking confirmation does not authorise us to send you offers.

Confirmed opt-in

Where we operate a confirmed opt-in, the first message after you subscribe asks you to confirm that the address is yours. Until you confirm, the address is held in a pending state and receives no marketing. This protects both of us: it stops someone else subscribing you without your knowledge, and it keeps our list accurate. If you do not confirm within thirty days, the pending record is deleted.

What we send and how often

We send seasonal offers, news about the hotel, and occasional information about events. We aim to send no more than twice a month, and we do not send marketing to a guest who is currently staying with us unless they have asked for it. Every message identifies the sender, includes a physical postal address, and carries a one-click unsubscribe link that works without a password. You can also reply to any message and ask to be removed; a person will action it.

We do not buy or rent email lists, and we do not add addresses harvested from enquiries, business cards or social media to a marketing list. We do not share our list with other companies for their own marketing, and we do not run co-registration campaigns in which a single tick subscribes you to several businesses.

Measuring campaigns

If you have allowed analytics or marketing cookies, we may be able to see that a campaign led to a visit or a booking, in aggregate. If you have not, we can still see that a campaign produced clicks through the email provider's own link tracking, which records that a link was clicked but not who clicked it beyond the email address we already hold. Opening pixels are used by most email providers; if you would rather avoid them, set your mail client to block remote images.

Changing your mind

Every marketing message contains an unsubscribe link. Using it removes you from the marketing list within twenty-four hours, although a confirmation of the change may follow and transactional messages already in progress will still arrive. Unsubscribing from marketing does not delete your booking records, and it does not stop service messages about a stay you have booked.

You can also ask us to stop profiling your engagement with our emails, to send you only certain kinds of message, or to contact you by post instead of email. Section 26 explains how to make such a request and what we will do with it.

Analytics tells us whether the site works. We want to know which room pages people read, where they abandon the booking form, whether the search box is used, and whether the site is fast enough on a mobile connection. That information is collected in aggregate and is used to improve the site, not to sell advertising.

We use Google Analytics 4, loaded only after you allow analytics cookies. The configuration we use has IP anonymisation enabled, advertising personalisation disabled, and data-sharing with Google's advertising products turned off. We do not use Google Signals, we do not link analytics identifiers to booking records, and we do not upload customer lists to an advertising platform for matching. Retention of event data in the analytics property is set to fourteen months.

We also read our own server logs, described in section 10, and a small amount of first-party measurement that does not require a cookie: for example, a counter of how many times the booking form was started and completed in a day, held in aggregate. Aggregate counters cannot be traced back to an individual.

We do not currently use session-replay tools, heat maps, cross-device graph services, or third-party tag managers beyond the consent-gated tags described in section 12. If we introduce a new measurement tool, we will add it to the inventory, put it behind the appropriate consent category, and update this policy before it goes live.

Why we do not rely on legitimate interests for analytics

Some organisations treat analytics as a legitimate interest and load it without asking. We do not. The Ugandan regime, the GDPR and the ePrivacy rules that apply to visitors from Europe all treat storage on your device as something that needs a clear permission unless it is strictly necessary to deliver the service you requested. Analytics is useful, but it is not strictly necessary, so we ask. The consequence is that our numbers are lower than they would otherwise be, and we accept that as the cost of a defensible consent model.

If you allow analytics and later change your mind, the withdrawal takes effect on the next page load. The existing _ga cookie remains in your browser until it expires or you delete it, but no further events are sent. You can also install Google's opt-out browser add-on, which blocks Analytics across all sites that use it.

Some of the most useful things you can tell a hotel are also the most sensitive. "I use a wheelchair" describes a health condition. "I am coeliac" describes a health condition. "I am fasting for Ramadan" reveals a religious belief. We handle these details with care because getting them wrong can ruin a stay, and because the law treats them as a special category of personal data.

What we collect and why

• Accessibility needs. A request for a ground-floor room, a step-free bathroom, a shower chair, a visual alarm or a quiet room near a lift. We use this only to assign a suitable room and to brief the staff who will look after you.
• Dietary requirements and allergies. A note that you are vegetarian, vegan, coeliac, allergic to nuts or unable to eat a particular ingredient. We pass this to the kitchen as a preparation instruction and keep it on the reservation so the same mistake is not made twice.
• Religious or cultural observations. A request for a quiet room during prayer, a particular meal at a particular hour, or a room away from alcohol service. We use it to accommodate the request, not to record your beliefs.
• Medical information you volunteer. For example, that you are travelling with medication that needs refrigeration, or that you may need assistance in an emergency.

We do not ask for these details as a condition of booking, and the booking form does not contain a field labelled "medical conditions" or "religion". You choose whether to mention them. Where a request can be met without recording the underlying reason — "a room on the ground floor" rather than "a room for a wheelchair user" — we record the request, not the diagnosis.

Legal basis and safeguards

Where we process special-category data, we do so on the basis of your explicit consent, given by the act of sending us the information and asking us to act on it, or where the processing is necessary to protect your vital interests in an emergency. Access is restricted to the staff who need it: the front-office supervisor, the housekeeping supervisor, the kitchen lead and the general manager. The note appears on the arrival sheet and the kitchen sheet, not on a public-facing document, and it is not visible to other guests.

We do not use sensitive data for marketing, profiling or analytics. We do not share it with a corporate payer. If a third-party supplier needs to know — a transport provider collecting you from the airport, for example — we will ask you before telling them, and we will tell them only what they need.

We keep dietary and accessibility notes for the duration of the stay and for thirty days afterwards, so that a follow-up question can be answered, and then delete them from the reservation record. We keep a small number of historical notes where a returning guest has asked us to remember a preference, and you can ask us to delete those at any time.

If you would rather not tell us

You are never obliged to disclose a health condition or a belief. If you prefer, describe the practical requirement without the reason: "I cannot manage stairs", "I need a fridge in the room", "no nuts in any dish". We will act on the practical requirement. The only exception is where we cannot safely serve you without knowing — for example, a severe allergy that affects kitchen preparation — and in that case we will explain why we are asking and what we will do with the answer.

Our website and the concierge chat are intended for adults. We do not knowingly collect personal data from a child under thirteen through the website, and we do not direct marketing to children. If you believe a child has sent us personal data without your consent, contact us and we will delete it.

A booking must be made by someone aged eighteen or over, who becomes the responsible guest for the reservation. That adult provides the names and ages of the children in the party so that we can allocate the right room, prepare the right bedding and, where relevant, apply a child rate. We do not ask for a child's email address, telephone number or identity document, and we do not create a separate profile for a child.

Children are included in the statutory guest register where the law requires it, typically as accompanying guests of the responsible adult. We record the minimum the register requires: name, age band where needed, nationality where the register requires it, and the room occupied.

Photography

We do not photograph children for marketing without the consent of a parent or guardian. Where an event photographer is working, the organiser is responsible for telling guests and for obtaining consent for any image in which a child is identifiable. If you see a photograph of your child on our website or social media that you did not agree to, tell us and we will remove it promptly.

Our CCTV covers public areas, as described in section 9. It is not installed in guest rooms or in areas where children are likely to be changing. Footage is retained for thirty days and viewed only when there is a reason.

Children using the chat

The chat asks for a name and a telephone number before it starts. A child should not use it without an adult present, and we will not knowingly continue a conversation with a child who has identified themselves as under thirteen. If a conversation suggests that a child is unaccompanied or at risk, we will escalate to a manager and, where appropriate, to the authorities.

When you book a conference, a wedding, a reception or a block of rooms, you may give us a list of attendees. That list usually contains names, organisations, dietary requirements and sometimes room preferences. We treat it as personal data and we ask you to send only what we need.

Who is responsible for the list

For the attendee list, the organiser is the controller and Jinna Suites is a processor: we use the list to prepare badges, allocate rooms, cater the event and manage access, and for nothing else. We act on the organiser's documented instructions, keep the list confidential, and delete it at the end of the agreed period. If an attendee asks us to correct or delete their details, we will pass the request to the organiser and help them respond.

For everything that happens on our premises — security, incident reports, CCTV, safeguarding — we are the controller, because we are responsible for the safety of everyone at the hotel, not only the people on the organiser's list.

Practical details

• Badges show the name the organiser supplies. If an attendee prefers a different name or pronoun, the organiser can tell us and we will print it.
• Dietary sheets are given to the kitchen, kept for the duration of the event, and destroyed within seven days afterwards unless the organiser asks us to retain them for a follow-up event.
• Signed attendance sheets, where used, are retained for the period the organiser specifies and for no longer than twelve months.
• We do not photograph attendees for our own marketing without the organiser's agreement and without notices at the venue. Close-up portraits require the individual's consent.
• Where an event is filmed or streamed, the organiser is responsible for notices and consents. We will help by displaying signage and by announcing the recording at the start.

Corporate and group payers

A company paying for a group may receive an invoice that lists the rooms, nights and rates. It does not receive special requests, dietary notes, chat transcripts or any other guest content. If the company needs an attendance confirmation, we will confirm whether a named person stayed, and nothing more, unless the individual has agreed otherwise.

We hold contact details for the people who supply the hotel: food and beverage suppliers, laundry, maintenance contractors, photographers, entertainers, transport providers, professional advisers and the staff of corporate clients. The data is usually limited to a name, job title, employer, work email, work telephone number and the history of our dealings.

We use it to place orders, manage contracts, arrange deliveries, process invoices and keep an accurate record of who agreed what. The legal basis is the performance of a contract or the steps needed before a contract, and our legitimate interest in running the business. We do not add business contacts to consumer marketing lists, and we do not sell the data.

Due diligence

Before we share guest data with a contractor — for example, a transport company collecting a guest from the airport — we check that the contractor understands the confidentiality obligation and has a written agreement where the law requires one. Contractors who work on site sign in, wear identification, and receive a short briefing on guest privacy, photography and the areas they may not enter.

We keep supplier records for the duration of the relationship and for seven years afterwards where they support tax, contractual or insurance records. Contact details for people who have left a supplier are deleted when we are told, or when a message bounces and we cannot find a replacement.

Business contact preferences

If you would rather we contacted you on a different number, stopped sending a particular kind of update, or removed you from our records because you have changed role, tell us and we will action it. We do not require a formal request for a change of contact preference; an email to the address in section 33 is enough.

Every use of personal data needs a lawful basis. We rely on four: performance of a contract, consent, legal obligation, and legitimate interests. The table below maps each purpose to its basis and explains the reasoning. Where we rely on legitimate interests, we have carried out a balancing exercise and concluded that our interest does not override your rights, taking account of the sensitivity of the data, your reasonable expectations and the safeguards we apply.

Legitimate interests in more detail

Where we rely on legitimate interests, we have considered whether a less intrusive approach would achieve the same result, whether you would reasonably expect the processing, and whether the data is sensitive. For security and fraud prevention, the interest is strong and the intrusion limited: we look at patterns and references, not at the content of your conversations. For service improvement, we prefer aggregate data and avoid identifying individuals. You have the right to object to processing based on legitimate interests, and section 25 explains how to exercise it.

Consent is separable

Consent for marketing and for optional cookies is separate from the booking contract. Refusing either does not prevent you from booking a room or from receiving the service messages that the booking requires. We do not bundle consent into terms and conditions, and we do not treat a failure to opt out as consent.

We do not sell personal data. We do not rent it, trade it, or hand it to an advertising network so that it can build a profile of you across other websites. The sharing that does happen falls into a small number of categories, each with a reason and a limit.

Service providers

We use companies that provide infrastructure and services: web hosting, email delivery, payment processing, booking distribution, mapping, and — only with your consent — analytics and advertising measurement. They receive the minimum needed to perform the task, they are bound by a written agreement that requires confidentiality and security, and they may not use the data for their own purposes. Section 21 lists the categories and the main providers.

Payment and financial institutions

If you pay by card, the transaction passes through the acquiring bank and the card network. We receive an authorisation result and a reference, not your full card number. If you pay by mobile money, the network operator processes the payment and returns a reference. Banks and payment providers are independently responsible for their own compliance, and their privacy notices apply to what they do.

Corporate payers

Where a company pays for your stay, we may share the fact of the stay, the room nights and the amount due. We do not share special requests, dietary information, chat transcripts or other guest content. If you do not want the fact of your stay disclosed to a particular payer, tell us before arrival and we will discuss how to handle the billing.

Legal and regulatory disclosures

We may disclose personal data where the law requires it: to the Uganda Revenue Authority, to the police or immigration authorities acting under a lawful power, to a court order, or to a regulator exercising a statutory function. We may also disclose it where necessary to establish, exercise or defend a legal claim, or to protect the vital interests of a guest or another person. Where we are permitted to do so, we will tell you that a request has been made, unless telling you would undermine the investigation or put someone at risk.

Professional advisers and insurers

Our lawyers, accountants, auditors and insurers may see personal data where it is relevant to a matter they are advising on. They are bound by professional duties of confidentiality, and we share only what the matter requires.

Business transfer

If the hotel business is sold, merged or reorganised, personal data may form part of the assets transferred. We would require the buyer to continue to honour this policy, and we would tell you before your data became subject to a materially different policy. You would retain the right to object or to ask for deletion where the law allows.

What we never do

• We do not sell personal data, and we do not share it for cross-context behavioural advertising.
• We do not publish a guest list, a guest's room number, or the dates of a guest's stay.
• We do not confirm to a caller whether a named person is staying with us. Messages are passed on, not confirmed.
• We do not share chat transcripts with advertisers, analytics providers or social media platforms.
• We do not transfer guest data to a supplier in a country without safeguards; section 22 explains the mechanism.

This section lists the main categories of processor we use and, where a provider is named, what it does. We review the list at least once a year and whenever a service changes. A processor is a company that handles personal data on our instructions; it does not decide why or how the data is used.

Each processor is engaged under a written agreement that requires it to act only on our instructions, to keep the data confidential, to apply appropriate security, to assist with your rights, to notify us of a breach, and to delete or return the data at the end of the engagement. Where a processor uses a subcontractor, the same obligations flow down, and we are told before a new subcontractor is used. We do not authorise a processor to use guest data for its own marketing or product development.

Services that do not receive personal data

The weather and currency features are server-side. Your browser asks our server for a forecast or a rate; our server asks Open-Meteo or the exchange-rate service; the answer comes back to you. The third party sees the hotel's server address, not yours, and the request contains no cookie, no account and no guest identifier. The geocoding lookup works the same way.

Your right to ask

You can ask us for the name of the processor that handled a particular part of your data, and for a copy of the relevant safeguards where data was transferred abroad. We will provide it unless doing so would compromise security or the rights of another person. Section 26 explains how to make the request.

Jinna Suites is based in Uganda. Some of our processors are based elsewhere, or store data in data centres outside Uganda. That means personal data may be transferred across a border. We take steps to make sure the protection travels with the data.

Where data goes

Website hosting and mailboxes are provided on servers whose location is stated in our hosting agreement; the provider may replicate backups to another region. Email delivery, analytics, mapping and advertising measurement involve providers established in the United States, the European Union and the United Kingdom. Payment processing stays with the acquiring bank and the card network in the region where the transaction is taken.

The safeguards we rely on

• Contractual clauses. With processors outside Uganda, we use written data-processing terms that include the standard contractual clauses approved by the European Commission, or the UK International Data Transfer Addendum where UK law applies, together with a transfer risk assessment.
• Adequacy. Where a destination country benefits from an adequacy decision, we may rely on it. We check that the decision is current before relying on it.
• Necessity and minimisation. We send only what the service needs. Analytics receives a pseudonymous identifier, not a name. The mapping provider receives an IP address because a browser has to make the request; it does not receive your booking.
• Encryption. Data in transit is protected by TLS. Backups are encrypted at rest, and the keys are held separately from the backup files.
• Supplementary measures. Where a transfer risk assessment identifies a gap, we add measures: pseudonymisation, restricted access, EU-based storage where available, or a change of provider.

Ugandan law

The Uganda Data Protection and Privacy Act, 2019 restricts the transfer of personal data outside Uganda unless the destination provides an adequate level of protection, the data subject consents, or the transfer is necessary for the performance of a contract with the data subject or for a legal claim. We rely on the appropriate ground for each transfer and record it in our transfer register. Where we rely on consent, we explain the destination and the risk before asking.

Your rights over transfers

You can ask for a copy of the safeguards used for a particular transfer, and you can object to a transfer that relies on legitimate interests. If you object, we will explain whether we can still provide the service without that transfer. In some cases we can route the processing through a different provider; in others, the service cannot function without it, and we will tell you plainly.

We keep personal data only for as long as we need it for the purpose we collected it, or for as long as the law requires. The table below is the schedule we work to. Where a period has expired, the record is deleted or anonymised; anonymised data cannot be linked back to you and is used only for statistics.

Deletion and anonymisation

Deletion means the record is removed from the live system and from backups within the backup rotation period, which is ninety days. Where a legal hold applies — a tax audit, an insurance claim, a court case — the relevant records are preserved until the hold is lifted, and access is restricted to the people who need them. Where deletion would destroy statistical value, we may anonymise instead: names, contact details, references and free-text notes are removed, and only the aggregate remains.

Some records are kept in a suppression list after you unsubscribe or object. The suppression list contains the minimum needed to make sure we do not contact you again: an email address or telephone number, hashed where possible, and the date of the request. It is not used for any other purpose.

Backups

Backups exist so that the hotel can recover from a failure. A deleted record may persist in a backup until that backup is rotated out, but it is not restored to the live system except to recover the whole site, and access to backups is restricted. If a restore brings back data that should have been deleted, we re-apply the deletion immediately.

Security is a process, not a product. We apply technical and organisational measures that are appropriate to the size of the hotel and the sensitivity of the data, and we review them when something changes — a new service, a new member of staff, an incident.

Technical measures

• The site is served over HTTPS with a valid certificate, and HTTP requests are redirected.
• Passwords are stored as salted hashes by WordPress; we do not store plain-text passwords.
• Administrator accounts use strong, unique passwords. Multi-factor authentication is enabled for the accounts that can change site settings, install plugins or read the database.
• Access follows the principle of least privilege. A receptionist can read a conversation and reply; a manager can also reassign and close threads; only an administrator can change settings, edit the knowledge base or install software.
• Database and file backups are encrypted, stored separately from the live site, and tested by restoring them periodically.
• The site runs a web application firewall, rate limiting and login throttling. Failed logins are logged and reviewed.
• Software is kept up to date. Plugins and themes that are no longer maintained are removed rather than left dormant.
• Uploaded files are checked for type and size. The chat accepts only JPEG, PNG and WebP images, up to five megabytes each and three per message.

Organisational measures

• Staff receive a written confidentiality undertaking and a short privacy briefing at induction, refreshed annually.
• Only the staff who need guest data for their role can see it. Chat transcripts are visible to the front-desk team and the concierge manager, not to the whole staff body.
• Departing staff lose access on their last day, and shared passwords are not used for any system that holds guest data.
• Incidents are recorded, investigated and, where required, reported. Section 31 sets out the process.
• Suppliers who handle guest data sign a processing agreement and are reviewed before renewal.

Payment security

We do not take card payments on the website. Card payments at the desk are processed by a terminal that is compliant with the Payment Card Industry Data Security Standard. We do not write down card numbers, we do not store the security code, and we do not accept card details by email or chat. If someone asks you for card details by email claiming to be from the hotel, do not send them; call the number in section 33 to check.

What we cannot promise

No system is completely secure. We cannot guarantee that a determined attacker will never succeed, and we cannot protect data that you send to us over a channel we do not control, such as a public social-media message. What we can promise is that we take the risk seriously, that we limit what we hold, that we respond quickly if something goes wrong, and that we will tell you when a breach affects you and the law requires notification.

Your part

Please use a strong password if you create an account in future, keep your booking reference private, and avoid sending identity documents or card images through the chat. If you receive a message that appears to come from us but asks for payment to a different account, stop and call us. We will never change bank details by email without a verified telephone call.

You have rights over your personal data. Some are absolute; some depend on the basis we rely on and on the circumstances. This section explains each right, when it applies, and what we will do. Section 26 explains how to make a request.

Right to be informed

You have the right to know what we collect, why, how long we keep it and who we share it with. This policy is the main way we meet that right. If something is unclear, ask, and we will explain it in plain language.

Right of access

You can ask for a copy of the personal data we hold about you, together with information about the purposes, categories, recipients and retention. This is sometimes called a subject access request. We will provide the data in a commonly used electronic format, usually PDF or CSV, and we will explain any redaction made to protect another person's data.

Right to rectification

You can ask us to correct inaccurate data and to complete incomplete data. If a booking record contains the wrong spelling of your name or the wrong telephone number, tell us and we will fix it. Where the record has already been used for an invoice or a tax filing, we may need to keep a note of the correction rather than rewrite the original document.

Right to erasure

You can ask us to delete your data where it is no longer necessary for the purpose it was collected, where you withdraw consent and there is no other basis, where you object and we have no overriding interest, where the processing was unlawful, or where the law requires deletion. The right is not absolute: we must keep booking, tax and guest-register records for the periods in section 23, and we may need to keep data to establish or defend a legal claim. Where we refuse, we will tell you why and explain how to complain.

Right to restriction

You can ask us to pause the use of your data while a dispute about accuracy or lawfulness is resolved. While restriction applies, we store the data but do not use it, except with your consent, to protect your rights, or for a legal claim.

Right to object

You can object to processing based on legitimate interests, including profiling. We will stop unless we can show compelling legitimate grounds that override your interests, or unless the processing is for a legal claim. You can object to direct marketing at any time, and that objection is absolute: we stop immediately and do not charge for it.

Right to data portability

Where processing is based on consent or contract and is carried out by automated means, you can ask for your data in a structured, commonly used, machine-readable format, and you can ask us to send it to another controller where technically feasible. Booking data and chat transcripts qualify; paper records and data held solely because the law requires it do not.

Right to withdraw consent

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal. For cookies, the Cookie settings link in the footer is the fastest route. For marketing, the unsubscribe link in any message works. For sensitive data, tell the desk or write to us; we will delete the note and explain any consequence for your stay.

Rights relating to automated decisions

You have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. We do not make such decisions. The concierge assistant suggests answers; it does not decide whether you may book, what you must pay, or whether you may stay. Section 28 explains this in detail.

Right to complain

You can complain to us, and you can complain to a supervisory authority. Section 27 sets out both routes.

How the rights differ by jurisdiction

Visitors from the European Economic Area and the United Kingdom have the rights in the GDPR as well as those in this policy. Visitors from Kenya have the rights in the Data Protection Act, 2019, including the right to be informed of the purpose of collection and the right to object to processing for direct marketing. Visitors from California have the rights described in section 30, including the right to know, delete, correct and opt out of sale or sharing. Where a local law gives you a stronger right, we apply the stronger standard to you.

To exercise a right, contact us using the details in section 33. You do not need a special form, and you do not need to use legal language. A short message that says what you want and how we can identify you is enough. If you prefer, you can ask the front desk in person.

What to include

• Your name and the contact details we should use to reply.
• The right you want to exercise — access, correction, deletion, restriction, objection, portability, or withdrawal of consent.
• Enough information to locate the record: a booking reference, the dates of your stay, the telephone number or email address you used, or the approximate date of a chat.
• If you are acting for someone else, evidence that you are authorised to do so — a signed authority, a power of attorney, or proof that you are the parent or guardian of a child.

Please do not send a copy of your passport or identity card unless we ask for it. We will ask only where we cannot verify your identity from the record itself, and we will tell you why.

How we verify identity

We need to be sure we are not disclosing one guest's data to another. Where the request comes from the email address or telephone number on the booking, we may treat that as sufficient. Where it does not, we may ask for a booking reference, the dates of stay, the name on the reservation, and the last four digits of the payment reference. We will not ask for more than is necessary, and we will not use the verification data for any other purpose.

Timelines

We acknowledge a request within five working days and respond in full within thirty days. If the request is complex or we have received several from the same person, we may extend by a further thirty days, and we will tell you before the first period expires, with the reason. If we need information from you to proceed, the clock pauses until you provide it.

Fees

Requests are free. We may charge a reasonable fee where a request is manifestly unfounded or excessive — for example, repeated requests for the same data within a short period — or refuse to act, but we will explain the decision and tell you how to complain. We do not charge for the first copy of your data.

What happens next

For an access request, we send a copy of the data and a note of the purposes, recipients and retention. For a correction, we update the record and tell anyone who received it where that is possible. For a deletion, we delete what we can and explain what we must keep and why. For an objection, we stop the processing while we assess it, then confirm the outcome. For portability, we send a machine-readable file or transfer it directly where that is technically feasible.

If we cannot do what you ask, we will tell you within the same thirty days, explain the legal reason, and set out your options, including how to complain to a supervisory authority. We keep a record of requests and outcomes so that we can show we handled them consistently.

If something has gone wrong with your data, we would rather hear about it directly first. A complaint to us is not a precondition to complaining to a regulator, but it is usually the fastest way to fix the problem.

Complaining to us

Write to the address in section 33 with the subject "Data protection complaint", or ask the front desk for the manager. Tell us what happened, when, and what you would like us to do. We will acknowledge within five working days, investigate, and respond within thirty days. If the investigation takes longer, we will tell you why and give you a date. We will not treat a complaint as an inconvenience; it is evidence of something we need to fix.

If the complaint concerns a member of staff, we will handle it through the manager and, where appropriate, through our disciplinary process. We will not tell you the outcome of a disciplinary process, but we will tell you what we have done about the data.

Complaining to a regulator

You can complain to the supervisory authority in the country where you live, where you work, or where you believe the infringement happened. The main authorities are:

• Uganda: the Personal Data Protection Office, under the National Information Technology Authority — Uganda (NITA-U). The office publishes its complaint channels at nitau.go.ug; complaints can also be made through the Ministry of Justice and Constitutional Affairs where the matter falls under the Data Protection and Privacy Act, 2019.
• United Kingdom: the Information Commissioner's Office (ICO), ico.org.uk.
• European Economic Area: the data protection authority in the country where you live or work, or where the processing took place. A list is published by the European Data Protection Board.
• Kenya: the Office of the Data Protection Commissioner (ODPC), odpc.go.ke.
• California: the California Privacy Protection Agency (CPPA) and the California Attorney General.

We will cooperate with any regulator that investigates a complaint, and we will not retaliate against anyone who raises a concern in good faith.

Class actions and compensation

Nothing in this policy limits a right you may have to seek compensation through a court or tribunal for damage caused by unlawful processing. In Uganda, the Data Protection and Privacy Act, 2019 provides for remedies through the courts; in the EEA and the UK, the GDPR provides for compensation and for representation by a not-for-profit body. We would still prefer the chance to put things right first.

Our website includes a concierge chat. During front-desk hours it is answered by people. Outside those hours, and sometimes as a first responder during busy periods, an automated assistant suggests an answer. This section explains what the assistant is, what it does with your message, and what it does not do.

How it works

The assistant runs on our own server. It is not a connection to a large external artificial-intelligence provider, and your messages are not sent to a third-party model for training or inference. When you send a message, the assistant does three things in order:

1. It checks a set of fixed facts — room rates, check-in and check-out times, the address, the telephone numbers, directions — and answers directly where the question matches.
2. It searches a knowledge base that the hotel staff maintain: policies, services, accessibility information and the answers to the fifty most common questions. Each entry has a source and a review date.
3. If neither produces a confident answer, it searches the same knowledge base using a relevance ranking technique called BM25, which compares the words in your question with the words in each entry. It answers only if the match clears a confidence threshold; otherwise it says it does not know and offers to pass the question to the desk.

When the assistant cannot answer, the question is logged — without your name or telephone number where possible — so that staff can see what guests are asking and add a proper answer. The log is reviewed weekly, and the knowledge base is updated from it. That is how the assistant improves: through curated content, not through guessing.

What the assistant does not do

• It does not decide whether you may book, what rate you pay, whether a cancellation is accepted, or whether you may stay. Those decisions are made by people under the booking terms.
• It does not make automated decisions that produce legal or similarly significant effects.
• It does not profile you for advertising, and it does not share your conversation with advertisers or analytics providers.
• It does not ask for card details, passwords or identity documents, and it will never ask you to send money to an account.
• It does not answer medical, legal or safety-critical questions with authority. It will direct you to a person.

Your messages and photographs

Messages are stored on our server with the thread, the name and the telephone number you provided, and the time. Photographs are stored with the message; up to three per message, five megabytes each, JPEG, PNG or WebP. Staff can see the thread. The assistant reads the current message and the recent context in order to answer, and that processing happens on our own infrastructure.

Please do not send identity documents, card images or anything you would not want a hotel employee to see. If you send something sensitive by mistake, tell the desk and we will delete it.

Human review and escalation

You can ask for a person at any time, and the assistant will hand the thread to the desk. Outside hours, it offers to take a message and an email address so that the desk can reply when it opens. Every thread can be reviewed by the concierge manager for quality and for training. If you want a thread deleted, ask, and we will delete it unless we need it for a booking dispute or a legal obligation.

Accuracy and limitation

The assistant is deliberately conservative. It would rather say "I am not sure, let me pass this to the desk" than invent an answer. It can still be wrong, particularly about availability, prices in a currency that has just moved, or a policy that has recently changed. A statement by the assistant is not a contractual promise; the confirmation email and the booking terms are. If an answer matters to your booking, ask the desk to confirm it in writing.

We do not build behavioural profiles of our guests, and we do not buy audience data to target advertising at people who have stayed with us. This section explains what we do instead, and what you can do to limit it further.

What we do

We may use aggregate information — how many people visited a page, which country they came from at a country level, which campaign produced clicks — to decide where to spend our marketing budget. That information is not used to make decisions about an individual. If you allow marketing cookies, an advertising platform may record that your browser saw or clicked an advertisement and later visited our site, so that we can measure whether the campaign worked. That is measurement, not a profile of your interests, and we do not upload guest lists or booking data to an advertising platform for matching.

What we do not do

• We do not sell personal data, and we do not share it for cross-context behavioural advertising.
• We do not use sensitive data — health, religion, dietary needs — for advertising.
• We do not use "lookalike" audiences built from guest email addresses.
• We do not track you across other websites with our own code.
• We do not use dark patterns to obtain consent: rejecting is as easy as accepting, and the banner does not nag.

Global Privacy Control and Do Not Track

Where your browser sends Global Privacy Control, we treat it as an opt-out of sale and sharing and as a request to keep analytics and marketing cookies off by default. We honour it on every page load. Do Not Track is not treated as a decision on its own because there is no common standard, but you can use the banner or the footer link to make a choice that we will respect.

Advertising platforms

If you allow marketing cookies, Google and Meta may set their own identifiers. Those companies are independent controllers for their own processing, and their privacy notices apply. You can manage advertising personalisation in your Google account and in your Meta account settings. Blocking those cookies does not stop you seeing advertising; it stops the platform from using your visit to our site to personalise it.

Email measurement

Marketing email may contain a small image that records an open event and links that record a click. This helps us see whether a newsletter is useful. It does not tell us what you do after you leave the email unless you have allowed analytics cookies on the site. You can block remote images in your mail client, and you can unsubscribe at any time.

This section adds information for visitors from particular jurisdictions. It does not replace the rest of the policy; it supplements it. Where a local law gives you a stronger right than the rest of this document, the local law wins.

Uganda

The Uganda Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021 apply. The controller is Jinna Suites Hotel, at the address in section 33. We process personal data in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and accountability. Registration with the Personal Data Protection Office, where required for a data collector, controller or processor of our category, is maintained, and the registration number is available on request. You can complain to the Personal Data Protection Office as described in section 27.

European Economic Area and the United Kingdom

Where the GDPR or the UK GDPR applies, we act as controller for the processing described in this policy, and as processor for an organiser's attendee list as explained in section 17. Our lawful bases are set out in section 19. Where we rely on consent, you may withdraw it at any time. Where we rely on legitimate interests, you may object. We do not carry out automated decision-making within the meaning of Article 22. International transfers rely on the mechanisms in section 22. If you are in the EEA or the UK, you have the right to lodge a complaint with your local supervisory authority. We have not appointed an EU or UK representative because we do not target goods or services at those markets in a way that triggers the requirement; if that changes, we will appoint one and update this policy.

Kenya

The Data Protection Act, 2019 applies to guests located in Kenya. We process personal data in accordance with the principles in section 25 of that Act, and we honour the rights in Part VI, including the right to be informed, to access, to object, to correction and to deletion. Where we transfer data outside Kenya, we rely on an appropriate safeguard under section 48 of the Act, including contractual clauses or consent where permitted. Complaints may be made to the Office of the Data Protection Commissioner.

California

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to know what personal information we collect, use, disclose and retain; the right to delete; the right to correct; the right to opt out of sale or sharing; the right to limit the use of sensitive personal information; and the right not to be discriminated against for exercising a right. We do not sell personal information, and we do not share it for cross-context behavioural advertising. The categories we collect are listed in section 3, the sources are you and your browser, the purposes are in section 19, and the retention periods are in section 23. We do not use or disclose sensitive personal information beyond the purposes permitted by the CPRA without consent. To exercise a right, use the contact details in section 33 or the Cookie settings link; an authorised agent may act for you with written authority. We will verify your request using the information described in section 26.

Other jurisdictions

If you are in a country with its own data-protection law — for example, South Africa, Nigeria, Rwanda, Tanzania or the United Arab Emirates — we will apply the local requirements to the extent they apply to our processing. If you are unsure which rights you have, ask us and we will explain what we can do.

A personal data breach is a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Examples include a compromised staff account, a misdirected email containing a guest list, a stolen laptop, a database exposed by a misconfiguration, or a ransomware attack.

Detection and response

Anyone who becomes aware of a suspected breach must report it immediately to the general manager and to the person responsible for the website. We contain the incident first — change credentials, isolate the system, block the address — then assess what data was involved, who was affected, and what harm could follow. We keep a written record of the incident, the timeline, the decisions and the remedial action, whether or not the incident turns out to be notifiable.

Notification to the authority

Where the law requires it, we notify the supervisory authority without undue delay and, where feasible, within seventy-two hours of becoming aware, unless the breach is unlikely to result in a risk to rights and freedoms. The notification describes the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed. Where we cannot provide all the detail at once, we provide it in phases and explain the delay.

Notification to individuals

Where a breach is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay. The message will describe what happened in plain language, what data was involved, what we have done, what you can do to protect yourself, and how to contact us. We will not hide behind legal language, and we will not wait for a regulator to tell us to warn you.

Processors

A processor must notify us without undue delay after becoming aware of a breach. Our agreements require it, and we will not accept a processor's request to delay notification to protect its reputation. We remain accountable to you for the processor's handling of the data.

Learning from incidents

After an incident we review what happened, update the risk register, change the controls that failed, and brief the staff. Where the incident reveals a gap in this policy, we update the policy and note the change in the version history.

This policy is a living document. We review it at least once a year and whenever we change a service, a processor, a retention period or a legal basis. The effective date at the top of the page tells you which version you are reading, and the version history at the end records what changed.

Material changes

Where a change materially affects how we use your data or the rights you have, we will do more than update the date. We will display a notice on the site for at least thirty days, and where we hold an email address for you and the change is significant, we will send a short message explaining it. If the change relies on consent, we will ask for consent again rather than assume that the old choice covers the new purpose.

No retroactive basis

We will not use a new purpose to justify processing that happened before the change, unless we have a separate lawful basis for the earlier processing. Consent obtained for one purpose is not stretched to cover another.

Archived versions

We keep previous versions of this policy so that you can see what applied at the time of your stay. To request a copy of an earlier version, contact us with the approximate date you need. We keep archived versions for seven years.

If you do not agree

If you do not agree with a change, you can stop using the site and ask us to delete the data we hold about you, subject to the retention obligations in section 23. A change to this policy does not affect the terms of a booking you have already made; those terms are governed by the terms of service in force when you booked.

We would rather answer a question than receive a complaint, and we would rather receive a complaint than have you give up. Use whichever channel suits you.

• Data protection and privacy: info@jinnasuites.com — please put "Data protection" in the subject line.
• Reservations: reservations@jinnasuites.com — for bookings, changes and arrival questions.
• Telephone: +256 705 732 344 or +256 779 485 974 — the desk answers between 10:00 and 16:00 East Africa Time, every day.
• Post: Jinna Suites Hotel, Bukerere Road, Misindye, Mukono, Uganda.
• In person: ask for the duty manager at the front desk.
• Website: https://jinnasuites.com/

We aim to acknowledge a privacy request within five working days and to answer it within thirty days. If you are writing about a booking rather than a privacy matter, the reservations team will usually be faster, and they will pass anything that needs the privacy lead to the right person.

Languages

You can write to us in English, Luganda or Swahili. We will reply in the language you used where we can, and in English where we cannot. If you need this policy in another language, ask and we will provide a translation; if there is a conflict between a translation and the English text, the English text governs.

Who handles your request

The general manager is responsible for data protection at the hotel, supported by the person who administers the website and the front-office supervisor. Requests are logged, assigned and reviewed. Where a request involves a legal question, our advisers are consulted, but the decision remains ours.

Postal address for formal notices

Formal notices under the Data Protection and Privacy Act, 2019 should be sent to the general manager at the postal address above, marked "Confidential — Data Protection". Email is acceptable for a first contact and will be treated as received on the next working day.

Controller

The organisation that decides why and how personal data is processed. Jinna Suites Hotel is the controller for the processing described in this policy, except where we process an organiser's attendee list on their instructions.

Processor

A company that processes personal data on the controller's instructions. Our hosting provider, email relay and payment providers act as processors for the parts of the service they supply.

Personal data

Any information relating to an identified or identifiable individual. A name, a telephone number, a booking reference, an IP address and a photograph can all be personal data.

Processing

Anything done to personal data: collecting, recording, storing, retrieving, using, disclosing, combining, restricting, erasing or destroying it.

Special category data

Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, health, sex life or sexual orientation. Section 15 explains how we handle the small amount we receive.

Legitimate interests

A lawful basis that allows processing where the controller has a genuine interest that is not overridden by the individual's rights. We use it for security, fraud prevention and service improvement, and you can object.

Consent

A freely given, specific, informed and unambiguous indication of agreement, given by a clear affirmative action. It can be withdrawn at any time.

Subject access request (SAR)

A request from an individual for a copy of their personal data and information about how it is used.

Retention period

The length of time a record is kept before it is deleted or anonymised. Section 23 lists ours.

Pseudonymisation

Replacing identifying details with a key so that the data cannot be attributed to a person without additional information held separately. Analytics identifiers are pseudonymous.

Standard contractual clauses (SCCs)

Model clauses approved by a regulator for transfers of personal data to a country without an adequacy decision.

Supervisory authority

The regulator that oversees data protection in a country. Section 27 lists the ones most relevant to our guests.

Global Privacy Control (GPC)

A browser signal that communicates an opt-out of sale or sharing. We honour it as described in sections 11 and 29.

BM25

A relevance-ranking method used by the concierge assistant to compare the words in a question with the words in the knowledge base. It ranks text; it does not generate it.

This appendix is a one-page summary for staff and for anyone who needs the essentials without reading the whole document. It does not replace the sections it summarises.

Version history

Document control

• Owner: General Manager, Jinna Suites Hotel.
• Reviewed by: website administrator and front-office supervisor.
• Next scheduled review: October 2027, or earlier if a service, processor or law changes.
• Approval: management; this document is not legal advice and should be reviewed by a Ugandan data-protection lawyer before it is relied on in a dispute.

If any part of this policy is unclear, please ask. A policy that nobody can understand does not protect anyone.