Privacy Policy

Endo Wellness Accommodation ("we", "us", or "our") is a boutique hotel based in Kampala, Uganda, operating in partnership with the Pan African Holistic Endometriosis Wellness Organisation (PAHEWO). We are committed to protecting your personal data and handling it responsibly in accordance with the EU General Data Protection Regulation (GDPR), the Uganda Data Protection and Privacy Act 2019, and other applicable privacy laws. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have over it. It applies to all visitors to our website, guests, and anyone who contacts us or submits a booking inquiry or donation pledge.

We collect personal data only when you voluntarily provide it to us. This includes: • Booking inquiries: full name, email address, phone number, arrival and departure dates, number of guests, and any additional information you choose to share. • Donation pledges: full name, email address, donation amount, and payment preference. • Contact form submissions: name, email, and your message. • Automatically collected data: IP address, browser type, pages visited, and time spent on the site (via server logs and, where consented, analytics cookies). We do not collect sensitive personal data (such as health information) unless you voluntarily share it in the context of a specific inquiry.

We use your personal data to: • Respond to and process your booking inquiries and reservation requests. • Process and acknowledge donation pledges and follow up to complete the gift securely. • Communicate with you about your stay, including confirmations and pre-arrival information. • Improve our website and services using aggregated, anonymised analytics data. • Comply with our legal obligations under Ugandan and applicable international law. We will never sell your personal data to third parties. We will never use your data for unsolicited marketing without your explicit consent.

Under the GDPR, we process your personal data on the following legal bases: • Contractual necessity: processing required to respond to your booking inquiry or fulfil a service you have requested. • Legitimate interests: improving our website, preventing fraud, and ensuring the security of our systems. • Legal obligation: complying with Ugandan law and applicable international regulations. • Consent: where you have explicitly agreed to optional cookies or marketing communications. You may withdraw consent at any time.

Our website uses the following types of cookies: • Essential cookies: required for the website to function correctly (session management, CSRF protection). These cannot be disabled. • Analytics cookies (optional, consent required): help us understand how visitors use the site so we can improve it. These are only activated if you click "Accept All" in the cookie notice. You can manage your cookie preferences at any time by clicking "Decline" in the cookie notice or clearing your browser's local storage. Declining analytics cookies does not affect your ability to use the website.

We may share your data with the following trusted third parties, solely to deliver our services: • Email service providers: to send booking confirmations and inquiry responses (data is not stored beyond transmission). • Hosting and infrastructure providers: servers on which the website and its data are stored, subject to appropriate data processing agreements. • PAHEWO: where a donation pledge is made, basic details (name and amount) are shared with PAHEWO to acknowledge your contribution. All third-party providers are contractually bound to process your data only as instructed by us and in accordance with applicable privacy law. We do not transfer personal data outside Uganda or the European Economic Area without appropriate safeguards in place.

We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected: • Booking inquiry data is retained for 24 months after your inquiry date to allow for follow-up and to improve our services. • Donation pledge records are retained for 7 years to comply with financial and audit obligations. • Contact form messages are retained for 12 months. • Server log data is automatically deleted after 90 days. After the applicable retention period, your data is securely deleted or anonymised.

Under the GDPR and the Uganda Data Protection and Privacy Act, you have the following rights: • Right of access: you may request a copy of the personal data we hold about you. • Right to rectification: you may ask us to correct inaccurate or incomplete data. • Right to erasure: you may request that we delete your personal data, subject to legal obligations. • Right to restriction: you may ask us to limit how we process your data in certain circumstances. • Right to data portability: you may request your data in a structured, machine-readable format. • Right to object: you may object to processing based on legitimate interests. • Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. To exercise any of these rights, please contact us using the details below. We will respond within 30 days.

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us: Endo Wellness Accommodation Entebbe, Uganda Email: info@pahewo.org