This policy explains why and how we verify guest identity ("Know Your Customer", KYC), and how we protect that information.
Why we verify identity
- Legal requirement: accommodation providers in Kenya must keep a register of guests and may be required to make it available to lawful authorities.
- Safety: to protect guests, staff and neighbours, and to prevent fraud and misuse of our units.
- Tax: KRA PINs (optional for individuals, required for corporate invoices) allow us to issue compliant tax invoices.
Accepted documents
- Kenyan National ID card (including Maisha Namba / Huduma Namba-linked IDs)
- Passport (any nationality)
- Alien ID / Foreigner Certificate issued by the Department of Immigration
- Kenyan Driving Licence (smart DL)
What we collect
Full name as on the document, date of birth, nationality, document type and number, a photo of the document (front, and back where applicable), optionally a selfie to match the document, and optionally a KRA PIN. For foreign guests and for passports, Alien IDs and driving licences, we also record the document's expiry date.
Selfie (biometric data). A facial image used to confirm identity is sensitive personal data under the Data Protection Act, 2019. The selfie is optional and we process it only with your separate, explicit consent. You can withdraw that consent at any time under Account → ID verification; the selfie is then deleted. Declining does not affect your booking.
Children. Guests under 18 may stay only with a parent or guardian. They are recorded in the guest register with that adult. We do not ask children to create accounts or submit KYC.
How we verify
A trained staff member reviews your submission (pending → under review → verified or rejected). If rejected, we tell you why so you can resubmit. We may in future use a licensed verification service that checks details against the Integrated Population Registration System (IPRS); we will update this policy before doing so.
How we protect it
- ID numbers and dates of birth are encrypted with AES-256. Document images are encrypted and stored outside the public website.
- Only authorised managers can view documents, and every view is logged.
- Images are re-processed on upload to remove hidden metadata such as GPS location.
- Document images are deleted 12 months after your last stay. The statutory guest-register entry is retained as required by law; the ID number and phone in it are anonymised 36 months after departure.
At check-in
Please bring the original document you verified with. Every adult staying must be recorded in the guest register.
Questions? Contact our Data Protection Officer at mevajhomes@gmail.com.