Last updated: 25 October 2026
This Privacy Policy explains how Here Goes Kenya (“we”, “us”, “our”) collects, uses, shares and protects your personal data when you use heregoeskenya.com (the “Site”). We process personal data in line with the Kenya Data Protection Act, 2019 and, where it applies to you, the EU and UK General Data Protection Regulation (GDPR).
The data controller for the Site is Here Goes Kenya, based in Kenya.
For anything about your personal data, contact us at hello@heregoeskenya.com with the subject “Privacy”.
What: IP address, approximate location derived from the IP address, browser and device type, pages viewed, referring page, date and time, and on-site search terms.
Why: to deliver and secure the Site, show listings near you, prevent abuse, and understand how the Site is used. Basis: our legitimate interests in running and securing the Site; consent for analytics and advertising cookies.
Our listing pages record visit statistics inside our own database (for example views, referrers and country). We keep these statistics for 90 days.
What: username, email address, password (stored only in hashed form), profile details you add (name, photo, short bio, social links), and your activity such as saved collections, follows and notifications. If you sign in with Google, we receive your name, email address and profile photo from Google.
Why: to create and secure your account and provide the features you ask for. Basis: performance of our contract with you.
We verify email addresses before an account becomes active.
What: the business or place details you submit (name, description, photos, address and map location, contact details, opening hours, prices), and, if you claim an existing listing, proof of ownership or authority such as a business registration certificate, licence or authorisation letter, plus your contact details.
Why: to publish listings and to confirm that only the rightful owner can manage a listing. Basis: performance of our contract with you and our legitimate interest in keeping listings accurate and preventing fraud.
Listing details are public. Ownership documents are visible only to us and are never published. Please black out anything unrelated to the claim, such as ID numbers, before you upload.
What: reviews, ratings, timeline posts and replies, images you attach, collections you create, and direct messages (including one attached image or video per message).
Why: to provide the community features. Basis: performance of our contract with you.
We do not currently charge for anything on the Site, so we do not collect payment details. If we introduce paid plans or promotions, we will collect the information needed to take payment and issue receipts, such as your name, email, billing details and order history, and payments will be handled by a payment provider such as Stripe, which will receive your card or mobile money details directly. We will update this Policy before we start, and keep financial records for as long as tax and accounting law requires.
What: your name, email address, subject, message, and anything else you write. The form includes a consent box.
Why: to reply to your enquiry. Basis: your consent. We do not use contact form details for marketing. We keep enquiries for up to 24 months.
What: your email address.
Why: to send travel updates and news about the Site. Basis: your consent, which you can withdraw at any time using the unsubscribe link in every email. Subscriber lists are handled by our email service provider, Brevo.
Where comments are enabled, we collect the name, email address, website (optional), comment text, IP address and browser user agent. Comments are checked by the Akismet spam filter. Your email address may be hashed and checked against Gravatar to display a profile picture. Comments are kept until you ask us to remove them.
We use Cloudflare Turnstile, Google reCAPTCHA and security tools to detect bots and block attacks. These services process your IP address and information about your browser and how you interact with the form.
We use cookies and similar technologies for essential functions (login, security, remembering your cookie choices), for analytics, and for advertising. You can accept, reject or customise non-essential cookies using the banner, and change your mind at any time with the “Consent Preferences” button on the Site. Details of the cookies we use are in our Cookie Policy.
Analytics and advertising cookies and scripts are used only if you consent to them.
We share personal data only with service providers acting on our behalf, with other users where you choose to make something public or send a message, where the law requires, and as described below. Providers act on our instructions or under their own privacy terms, as noted.
| Provider | What they do | Data involved |
|---|---|---|
| Google (Analytics and Tag Manager, Search Console) | Site analytics and search performance | Online identifiers, device and usage data, approximate location |
| Google AdSense | Showing and measuring advertising | Cookie IDs, IP address, browsing data (only with your consent) |
| Ahrefs Analytics | Privacy-focused traffic analytics | Page views, referrers, device and browser data |
| Google Maps, Places and Sign-In | Maps, address search, ratings and reviews from Google, and optional Google login | IP address, search text, location queries, account basics if you sign in with Google |
| Google Translate (GTranslate) | Automatic translation of pages | Page content and your language choice, IP address |
| Cloudflare Turnstile, Google reCAPTCHA, Akismet | Spam and bot protection | IP address, browser and interaction data, comment content |
| Brevo | Newsletter delivery | Email address, subscription status, email engagement |
| Email delivery service (SMTP) | Sending system emails (verification and notifications) | Recipient email address and email content |
| Jetpack / Automattic | Backups, activity log and site tools | Site data, which includes account and content data |
| Chajio Cloud | Hosting and storing the Site | All Site data |
| IP geolocation providers | Estimating your region from your IP address | IP address |
| YouTube | Embedded videos | IP address and cookies when you play or load a video |
Some pages show tours and activities from Viator and link to partners such as Booking.com and GetYourGuide. We may earn a commission on bookings made through these links (see our Disclaimer). When you click through or interact with a partner widget, that partner receives data such as your IP address and the page you came from, and handles any booking under its own privacy policy. We are not a party to bookings made on partner sites and do not receive your booking or payment details.
We may disclose personal data to courts, regulators or law enforcement when the law requires, to protect our rights, users or the public, or to investigate fraud or abuse. If we merge with, or are acquired by, another business, your data may be transferred as part of that transaction, and we will tell you if your data would become subject to a materially different privacy policy.
Many of the providers above (including Google, Brevo, Cloudflare and Automattic) process data outside Kenya, including in the United States and the European Union. Where we transfer personal data abroad, we do so under the conditions of the Kenya Data Protection Act, 2019, relying on appropriate safeguards such as contractual protections, adequacy of the destination, or your consent where required.
| Data | Retention |
|---|---|
| Account and profile | Until you delete your account, then removed within 30 days (some data may remain in backups for up to 90 days) |
| Public listings, reviews and posts | Until you remove them or delete your account |
| Ownership claim documents | Until the claim is decided, then up to 12 months for dispute and fraud prevention |
| Direct messages | 365 days |
| In-app notifications | 30 days |
| On-site visit statistics | 90 days |
| Contact form enquiries | Up to 24 months |
| Newsletter subscription | Until you unsubscribe |
| Comments | Until you ask for removal |
| Security logs | Up to 12 months |
After these periods we delete or anonymise the data, unless the law requires us to keep it longer.
We send marketing email only if you have subscribed. We show advertising through Google AdSense. Advertising partners may set cookies to show relevant ads and measure their performance, but only if you accept advertising cookies. This Policy does not cover advertisers’ own use of cookies, so please read their policies.
We protect your data with measures including encrypted connections (HTTPS), hashed passwords, access controls, bot and attack protection, and regular backups. No system is completely secure, so please use a strong, unique password and keep it private. If a breach is likely to put your rights at risk, we will notify the ODPC and affected users within the time the law requires (72 hours for the ODPC under the Data Protection Act).
Under the Kenya Data Protection Act, 2019 you have the right to:
If you are in the EU or UK, you also have the rights set out in the GDPR, including restriction of processing.
To use any of these rights, email hello@heregoeskenya.com. We may ask you to confirm your identity first. We will respond promptly and within the time the law requires. We may refuse or limit a request where the law allows, for example when we must keep records, and we will explain why.
You can edit or delete most of your information, or delete your account, in your dashboard.
If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Office of the Data Protection Commissioner of Kenya (www.odpc.go.ke), or, if you are in the EU or UK, to your local data protection authority.
The Site is not directed at children. You must be at least 18 to create an account or list a business. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
The Site links to websites we do not control, including tour operators, accommodation and booking sites, social networks and embedded content. Their privacy practices are their own, and we encourage you to read their policies.
We may update this Policy to reflect changes in our practices or the law. We will change the “Last updated” date above and, for significant changes, notify registered users by email or on the Site.
Here Goes Kenya
Email: hello@heregoeskenya.com