Legal
How we handle the personal information you share with us, and the cookies this website uses.
Last updated 28 October 2026
Swahili Coast Villas is a villa and spa property in Kiwengwa, on the east coast of Zanzibar, Tanzania. We run this website and decide how the personal information described here is used, which makes us the data controller under Tanzania's Personal Data Protection Act, 2022 (Cap. 44 R.E. 2023).
You can reach us at [email protected] or +255 651 535231.
It covers this website and the enquiries we receive through it. It does not cover booking sites, travel agents or other companies you may use to book a stay, since they handle your information under their own policies.
When you send us the contact form we collect your first name, last name, phone number, email address and your message. The form also records your IP address and browser details, which we use to filter spam and investigate misuse.
We also receive what you choose to tell us by email, phone or WhatsApp, and our hosting keeps standard server records such as IP address, the page requested and the time of the request.
We use your information to answer your enquiry and arrange your stay, to keep records of bookings and guest requests, to keep the website secure and free of spam, and to meet our legal, tax and accounting duties.
We do not sell your information. We do not use it for automated decision making or profiling.
Under the PDPA we need a lawful basis each time we use personal data. We rely on your consent when you send an enquiry and ask us to reply, on the contract when you book with us, on our legal obligations for records we must keep, and on our legitimate interests for security, spam filtering and replying to enquiries.
A cookie is a small text file that a website stores in your browser. Some last for one visit, others stay for a set period.
The banner offers three choices: accept all, deny, or pick categories yourself. Nothing that needs consent runs until you choose, so tracking scripts stay off until you allow them.
Cookie choices. Our consent banner, provided by Elementor, stores one cookie called cookiez-user-consent. It records which categories you allowed and when, so the banner does not appear on every page. It expires after 180 days.
Staff sign in. If you log in to the WordPress dashboard, WordPress sets session cookies (wordpress_logged_in_*) and our security plugin Wordfence sets an authentication cookie. These are for staff only and are never set for ordinary visitors.
Security. Our firewall may set a short lived cookie to tell real visitors apart from automated traffic.
No analytics cookies. No advertising or remarketing cookies. No social media pixels. No cross site tracking. If we add any of these later we will ask for consent first and update this page.
The typefaces on this site are served by Google Fonts, so your browser requests the font files from Google and Google receives your IP address and browser details as part of that request. We do not send Google anything else about you.
You can reopen our banner and change what you allow at any time. Use the link below.
Our website host and the team that maintains the site (SimplyIT), our email provider, Google for fonts, and our security provider Wordfence. We share only what is needed for them to provide that service. We do not sell or rent personal information to anyone.
Our website and email are hosted on servers outside Tanzania, and some of the companies listed above are based in the European Union and the United States. Where information is transferred outside Tanzania we rely on your consent or on the safeguards those providers have in place.
Website enquiries are kept for up to 24 months from your last contact and then deleted. Booking and guest records are kept for as long as tax and accounting rules require. Server logs are kept for short periods and then overwritten.
You can ask to see the personal information we hold about you, ask us to correct it, ask us to delete it, object to how we use it, or withdraw consent you gave earlier. Email [email protected] and we will reply within 30 days.
If you are not satisfied with our answer you can complain to the Personal Data Protection Commission in Tanzania. If you are in the European Union or the United Kingdom you also have the rights set out in the GDPR, including access, correction, erasure, restriction, portability and objection.
Access to your information is limited to the people who need it. The site uses an encrypted connection, a firewall, and software we keep updated. No system is completely secure, and if a breach ever affects you we will tell you and the Commission as the law requires.
This website is for adults arranging a stay. We do not knowingly collect information from anyone under 18 through the site.
Our Instagram and Facebook pages, and any booking partners, have their own privacy and cookie policies. This policy does not cover them.
If we change how we handle personal information we will update this page and the date at the top.
Swahili Coast Villas, Kiwengwa, Zanzibar, Tanzania. Email [email protected] or call +255 651 535231.
