Privacy Policy

Kepa Eco Villa (“Kepa Eco Villa”, “we”, “us”, or “our”) operates a garden-retreat hotel in Nyagatare, Eastern Province, Rwanda, and the website at kepaecovilla.rw (the “Site”). This Privacy Policy explains what personal information we collect when you browse the Site, enquire about a stay, book a room, dine with us, or attend an event on our grounds, and how that information is used, stored, and protected. By using the Site or making a reservation with us, you acknowledge that you have read this Policy.

We collect information in three ways: information you give us directly, information generated automatically as you use the Site, and information passed to us by third parties who help us operate (for example, our payment processor).

• Identity details: full name, title, and government-issued ID or passport number where required for guest registration.
• Contact details: email address, phone number, and WhatsApp number.
• Stay details: check-in/check-out dates, room category, number of guests, and special requests.
• Technical details: IP address, browser type, device information, and pages visited on the Site.

When you reserve a room or table through the Site, our front desk, or WhatsApp, we collect the information needed to hold and honour that reservation: guest name(s), contact details, arrival and departure dates, room category, number of adults, and any special requests (dietary needs, accessibility requirements, or occasion notes). This information is stored against your reservation record and shared internally with front-desk and housekeeping staff so your stay can be properly prepared.

Room and event payments made through the Site are processed via Mobile Money (MTN Mobile Money or Airtel Money) through our licensed payment processing partner. We never see or store your full mobile money PIN or authentication codes — these are entered directly with your mobile network operator. We retain a record of the transaction reference, amount, phone number used, and payment status to confirm your booking, issue receipts, and handle refunds or disputes.

The Site uses a small number of strictly necessary cookies to keep you signed in to your account, keep items in your booking cart as you browse rooms, and remember your cookie preference. We do not use third-party advertising cookies. You can control or delete cookies through your browser settings; disabling strictly necessary cookies may prevent booking and account features from working correctly.

We use privacy-conscious analytics to understand, in aggregate, how visitors use the Site — for example, which pages are viewed and which browser or device is used — so we can keep the booking experience fast and reliable. Analytics data is used in aggregate and is not used to build advertising profiles of individual visitors or sold to third parties.

When you reach us through a contact or enquiry form on the Site, we collect the name, contact details, and message content you provide so a member of our team can respond to your enquiry. Enquiry submissions are kept only for as long as needed to resolve your request and for a reasonable period afterward for quality and record-keeping purposes.

Many guests reach us via WhatsApp for booking questions, arrival coordination, or guest support. Messages exchanged with our team on WhatsApp are subject to WhatsApp’s own privacy practices and end-to-end encryption in addition to this Policy. We keep a record of these conversations for as long as needed to support your stay and to maintain service quality, and we will never ask you for your mobile money PIN or one-time passcode over WhatsApp.

We use the email address you provide to send booking confirmations, payment receipts, pre-arrival information, and responses to enquiries. With your consent, we may occasionally send updates about Kepa Eco Villa (seasonal offers, new experiences). You can opt out of non-essential emails at any time by contacting us using the details below; we will still send transactional messages tied to an active reservation.

• To create, confirm, modify, and manage your reservations at the villa or restaurant.
• To process payments, issue receipts, and handle refunds through our payment partner.
• To communicate with you about your stay, an enquiry, or an event booking.
• To meet guest-registration and tax obligations under Rwandan law.
• To improve the Site, our rooms, and our service based on aggregate usage and guest feedback.
• To detect, investigate, and prevent fraud, abuse, or misuse of our booking system.

We do not sell your personal information. We share it only where necessary to run the villa:

• With our payment processing partner and mobile network operators, solely to process and confirm Mobile Money payments.
• With Supabase (our database and authentication provider) and other hosting/infrastructure providers who store data on our behalf under contractual confidentiality obligations.
• With Rwandan authorities where required for guest registration, tax, or immigration reporting, or where legally compelled (for example, in response to a valid court order).
• With professional advisors (accountants, legal counsel) where necessary and under confidentiality.

We keep booking and payment records for as long as needed to fulfil your stay, satisfy Rwandan tax and accounting record-keeping requirements (generally several years after a transaction), and resolve any disputes. Contact-form and marketing data is kept only for as long as it remains relevant, or until you ask us to delete it, whichever comes first. When information is no longer needed, we delete or anonymise it.

Under Rwanda’s Law N°058/2021 relating to the protection of personal data and privacy, you have the right to:

• Access the personal information we hold about you.
• Ask us to correct inaccurate or incomplete information.
• Ask us to delete your information, subject to our legal record-keeping obligations.
• Object to, or ask us to restrict, certain uses of your information.
• Withdraw consent for marketing communications at any time.

To exercise any of these rights, contact us using the details in Contact Information below. You may also lodge a complaint with Rwanda’s National Cyber Security Authority (NCSA), the supervisory authority for data protection in Rwanda.

We use reasonable technical and organisational measures to protect your information, including encrypted connections (HTTPS) across the Site, access controls on our booking and guest-management systems, and reliance on PCI-conscious, regulated payment partners for Mobile Money processing rather than storing payment credentials ourselves. No system is completely secure, but we work to keep guest data safeguarded and limit access to staff who need it to serve you.

The Site and our booking system are intended for use by adults arranging a stay. We do not knowingly collect personal information directly from children. Where children stay with a parent or guardian, we collect only the basic details (such as name and age) needed for room allocation and guest registration, provided by the accompanying adult.

Kepa Eco Villa welcomes guests from around the world. If you access the Site or book a stay from outside Rwanda, your information will be transferred to and processed in Rwanda, where our systems and hosting infrastructure operate, and may be processed by service providers located in other countries (such as our cloud hosting and payment-processing partners). We take steps to ensure such providers offer an appropriate level of protection for your information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will update the “Last updated” date at the top of this page. Material changes will be highlighted on the Site. We encourage you to review this Policy periodically.

If you have questions about this Privacy Policy or how we handle your information, please contact us at kepaecovilla@gmail.com or +250 781 422 458, or write to us at Kinihira Village, Barija Cell, Nyagatare Sector, Nyagatare District, Eastern Province, Rwanda.