Privacy Policy

Effective date: 11th September 2026

  1. Purpose and Scope

This Privacy Policy sets out the principles and procedures governing the collection, use, processing, storage, disclosure and protection of personal data by Kingfisher Limited trading as Mzima House (“Hotel”, “we”, “us” or “our”), in connection with its website, online reservations, guest services, communications and related hotel operations in Zanzibar. Please read this Privacy Policy carefully. It contains important information about the processing of your personal data and the rights recognised by applicable laws and regulations.

  1. Data Controller and Contact

The Hotel is the data controller for personal data processed for its own hotel, reservation, guest-service and business purposes. The Hotel’s details are:


Legal Name: KINGFISHER LIMITED

Trading Name: MZIMA HOUSE

Physical Address: CHWAKA BAY ZANZIBAR

Telephone: +255 787 325 673

Email: info@mzimazanzibar.com

Website: www.mzimazanzibar.com


Where the hotel is required to appoint a data Protection Officer(“DPO), the DPO or designated privacy contact may be reached through the above privacy email address.

  1. Personal Data We Collect

Depending on the nature of the guest’s interaction with the Hotel, we may collect:


  • Identification and contact information, including name, nationality, address, telephone number and email address.

  • Reservation and stay information, including booking dates, room preferences, number of guests, special requests and guest communications

  • Identification or travel-document information where required by law or reasonably necessary for hotel, immigration, security or regulatory purposes

  • Payment and billing information, including transaction details and payment status (full card security information will not ordinarily be retained after it is no longer required)

  • Website and technical information, including IP address, browser/device information, pages visited, cookies and similar technologies

  • Information voluntarily provided concerning accessibility, dietary, health or other special requirements where necessary to provide requested services

  • CCTV images and security information where cameras are lawfully operated for safety, security and incident-management purposes.

  1. Purposes and Lawful Basis of Processing

The Hotel shall process personal data only for lawful, specific and legitimate purposes and shall use data in a manner consistent with the purpose for which it was collected. Depending on the circumstances, processing may be based on consent, performance of a contract, compliance with a legal obligation, protection of vital interests, legitimate operational interests, or another lawful basis recognised by applicable law.


  • Processing and administering reservations, check-in/check-out and hotel services.

  • Communicating booking confirmations, changes, service information and responding to enquiries or complaints.

  • Processing payments, accounting, invoicing, fraud prevention and financial record keeping.

  • Meeting applicable immigration, tourism, tax, security, regulatory and other legal obligations.

  • Protecting guests, employees, visitors and Hotel property and investigating incidents or suspected unlawful activity.

  • Improving website performance, guest experience and Hotel services.

  • Sending marketing communications where legally permitted and, where required, with appropriate consent.

  1. Consent and Marketing

Where processing is based on consent, consent shall be obtained in a manner capable of being demonstrated and may be withdrawn subject to lawful exceptions. Withdrawal of consent shall not affect processing lawfully undertaken before withdrawal or processing based on another lawful basis.


Commercial electronic communications shall identify the sender and purpose and provide an effective opt-out mechanism as required by applicable law. Guests may unsubscribe from marketing communications at any time by using the unsubscribe facility or contacting the Hotel at info@mzimazanzibar.com. Essential service communications, including booking and safety notices, are not marketing communications and may continue where necessary.

Where processing is based on consent, consent shall be obtained in a manner capable of being demonstrated and may be withdrawn subject to lawful exceptions. Withdrawal of consent shall not affect processing lawfully undertaken before withdrawal or processing based on another lawful basis.


Commercial electronic communications shall identify the sender and purpose and provide an effective opt-out mechanism as required by applicable law. Guests may unsubscribe from marketing communications at any time by using the unsubscribe facility or contacting the Hotel at info@mzimazanzibar.com. Essential service communications, including booking and safety notices, are not marketing communications and may continue where necessary.

  1. Disclosure to Third Parties

The Hotel may disclose personal data only where reasonably necessary for legitimate Hotel operations, provision of requested services, compliance with law, protection of persons or property, or establishment or defence of legal claims.


Recipients may include authorised employees, reservation and booking platforms, payment processors, banks, IT/cloud providers, transport or excursion providers, professional advisers, insurers, auditors, government authorities, law enforcement agencies and courts.


Where a third-party processes data on behalf of the Hotel, the Hotel shall take reasonable steps to ensure appropriate confidentiality, security and data-processing obligations are in place.

Where processing is based on consent, consent shall be obtained in a manner capable of being demonstrated and may be withdrawn subject to lawful exceptions. Withdrawal of consent shall not affect processing lawfully undertaken before withdrawal or processing based on another lawful basis.


Commercial electronic communications shall identify the sender and purpose and provide an effective opt-out mechanism as required by applicable law. Guests may unsubscribe from marketing communications at any time by using the unsubscribe facility or contacting the Hotel at info@mzimazanzibar.com. Essential service communications, including booking and safety notices, are not marketing communications and may continue where necessary.

  1. International Data Transfers

Because the Hotel may use international reservation platforms, cloud services, payment systems and technology providers, personal data may be processed outside Zanzibar or Tanzania. Where an international transfer is made, the Hotel shall take reasonable measures to ensure that the transfer is lawful and that appropriate safeguards are applied in accordance with applicable data protection requirements.

  1. Data Security

The Hotel shall implement reasonable technical and organisational safeguards appropriate to the nature of the personal data and the risks involved. Measures may include access controls, authentication, secure networks, confidentiality obligations, restricted access to guest records, physical security, secure disposal and appropriate backup procedures. No electronic system or internet transmission can be guaranteed to be completely secure.

  1. Retention of Personal Data

Personal data shall be retained only for as long as reasonably necessary for the purpose for which it was collected, including contractual, operational, accounting, tax, regulatory, security and legal purposes. Different categories may be retained for different periods. When data is no longer required, the Hotel shall take reasonable steps to securely delete, destroy or anonymise it, subject to any mandatory legal retention requirement.

  1. Guest and Data Subject Rights

Subject to applicable law and lawful limitations, a data subject may have the right to request access to personal data held about them, correction of inaccurate or incomplete information, deletion where legally applicable, restriction or objection to certain processing, withdrawal of consent where consent is the basis of processing, and objection to direct marketing. Requests should be sent to info@mzimazanzibar.com. The Hotel may take reasonable steps to verify identity before acting on a request.

  1. Cookies and Website Technologies

The Hotel website may use essential cookies required for functionality, security and reservations, together with analytics or marketing cookies where applicable. Where required by law, non-essential cookies shall be activated only after appropriate consent. Users may manage cookies through available website controls or their browser settings. Third-party websites linked from the Hotel website are governed by their own privacy policies.

  1. Children’s Data

Where children accompany guests, the Hotel may process information concerning them where necessary for reservations, accommodation, safety, emergency response or legal and regulatory requirements. The Hotel shall take reasonable measures to protect children’s information and shall not knowingly collect unnecessary children’s data.

  1. CCTV, Security and Photographs

CCTV may be used in appropriate public and operational areas for security, safety, crime prevention and incident investigation. Cameras shall not ordinarily be placed in areas where guests have a reasonable expectation of privacy. Promotional photographs or videos involving identifiable guests shall be handled on an appropriate lawful basis and, where required, with consent.

  1. Complaints and Regulatory Rights

A guest who considers that the Hotel has improperly processed personal data should first contact the Hotel using the privacy contact details above. The Hotel shall investigate and respond within a reasonable period. Where applicable, a data subject may also lodge a complaint with the Personal Data Protection Commission or another competent authority.

  1. Electronic Transactions and Website Use

The Hotel recognises the legal validity of electronic transactions and records under applicable law. Information displayed for online bookings shall, where applicable, identify the Hotel, provide contact details, describe the relevant services and applicable charges, and provide appropriate opportunities for the user to review and correct transaction details before submission. This Policy should be read together with the Hotel’s Booking Terms and Conditions.

  1. Changes to This Policy

The Hotel may amend this Policy to reflect changes in law, regulatory requirements, technology or its operations. The current version shall be published on the Hotel website and identified by its effective or last-updated date. Material changes shall be communicated where reasonably appropriate.

  1. Governing Law

This Policy shall be interpreted in accordance with the Laws of Zanzibar and the Laws of the United Republic of Tanzania where applicable. Nothing in this Policy shall exclude or restrict a mandatory right or protection available to a data subject under applicable law.

  1. Acknowledgement

By using the Hotel website or submitting personal data through the Hotel’s online channels, you acknowledge that you have read this Policy. Where consent is legally required, the Hotel shall obtain the relevant consent through an appropriate mechanism.