Privacy Policy

01Who we are

KenGen Tours is operated by Kenya Electricity Generating Company PLC ("KenGen", "we", "us"), KenGen Pension Plaza II, Kolobot Road, Parklands, P.O. Box 47936-00100, Nairobi, Kenya. KenGen is the data controller for the personal data described in this policy.

We are committed to protecting your privacy, as guaranteed by Article 31 of the Constitution of Kenya, 2010, and to handling personal data lawfully, fairly and transparently under the Data Protection Act, 2019 (the "Act") and the Data Protection (General) Regulations, 2021.

This policy applies to visitors to this website, people who book or enquire about a tour, members of a visiting group, and KenGen staff who use the admin portal. It should be read with our Terms and Conditions and Cookie Policy.

02Personal data we collect

When you book a tour

• Contact details of the person booking: full name, email address, phone number and nationality.
• Identification: national ID number, or passport number for foreign nationals, used to verify the identity of the person responsible for the group.
• Institution details: the institution's name and type, and the application letter you upload (which may itself contain names, signatures, stamps and contact details of institution officials).
• Visit details: the site, date and time, the number of adults and children in the group, and any notes you add, such as accessibility needs.
• Booking records: a booking reference, its status and history (for example, when it was recommended, approved, declined, rescheduled or cancelled, and any reason recorded).

We record only the number of children in a group, never their names or other details. Please do not include sensitive personal data (such as health information) in notes unless it is needed for us to support a Visitor safely, and only with that Visitor's consent.

When you visit a facility

Our security officers may check identification and record attendance at the gate, and some facilities are covered by CCTV for safety and security. These records are handled under KenGen's site security procedures.

When you contact us

The content of your messages and our replies, and the contact details you use.

When you use the website

• Technical data such as your IP address, browser and device type, and the date and time of requests, recorded in server and security logs.
• Security signals collected by Google reCAPTCHA (through Firebase App Check) to tell people apart from automated abuse.
• Usage data about the pages you visit, collected by Google Analytics only if you accept analytics cookies.

Admin portal users (KenGen staff)

Name, work email, phone number, role, assigned stations and region, sign-in times, and an audit log of the actions taken in the portal (for example, approving a booking or exporting a report).

03How we use it, and our lawful bases

Section 30 of the Act requires a lawful basis for every use of personal data. We use your data only for the purposes below:

We do not use your personal data for marketing, we do not send you promotional messages, and we do not sell or rent your data to anyone.

04Automated checks and decisions

When you upload an application letter, the website sends it to an artificial-intelligence service (Google Gemini) which checks whether a letterhead, logo, stamp and signature are visible, and tells you if something appears to be missing. The service is used only to perform this check.

This check does not decide your booking. Every booking is reviewed, recommended and approved or declined by KenGen staff. Under section 35 of the Act you have the right not to be subject to a decision based solely on automated processing that significantly affects you; if you believe the automated check has affected you unfairly, contact us and a member of staff will review your letter.

05Who we share it with

Your personal data is accessed only by people who need it, on a need-to-know basis:

• KenGen staff who manage bookings for the site you chose (recommenders, approvers and station staff), security officers at the facility, and authorised administrators.
• Service providers who process data on our behalf under written contracts that require them to protect it and use it only on our instructions:
  • Google (Firebase and Google Cloud): website hosting, database, file storage, authentication and App Check / reCAPTCHA;
  • Brevo (Sendinblue SAS): sending booking emails;
  • Google (Gemini API): the automated application-letter check;
  • Google Analytics: website statistics, only with your consent.
• Public authorities, such as law-enforcement, security or regulatory bodies, where the law requires or permits it, or where necessary to protect life, safety or critical infrastructure.
• Professional advisers and auditors, including the Auditor-General, under duties of confidentiality.

Where a visit involves another body (for example, Kenya Wildlife Service for entry to Hell's Gate National Park), you deal with that body directly and its own privacy policy applies; we do not send them your booking details unless you ask us to or the law requires it.

06Transfers outside Kenya

Some of our service providers store or process data on servers outside Kenya (for example, in the European Union or the United States). Where this happens, we transfer data only in line with sections 48 to 50 of the Act and the Regulations: to providers that give appropriate safeguards for the security and protection of the data, such as contractual data-protection commitments and recognised security certifications, and only to the extent necessary for the purposes above. You can contact us for more information about these safeguards.

07How long we keep it

We keep personal data only for as long as is reasonably necessary for the purposes it was collected for, or as long as the law requires, in line with KenGen's records-retention schedule. In practice:

• booking records are kept while a booking is active and afterwards for as long as needed for security, reporting, audit and the handling of any queries or claims about the visit;
• identification numbers and application letters are kept no longer than needed for those purposes;
• server and security logs are kept for a limited period for security monitoring;
• admin audit logs are kept for accountability for as long as required by our internal-control obligations.

When data is no longer needed, we delete it, or anonymise it so that it can no longer identify you (for example, to keep visitor statistics).

08How we protect it

We take appropriate technical and organisational measures to protect personal data, including:

• encryption of data in transit (HTTPS) and at rest on our hosting provider's infrastructure;
• role-based access, so that staff see only the bookings for the stations and regions they manage;
• sign-in for staff accounts, server-side permission checks, and audit logging of admin actions;
• rate limiting and bot protection on public forms;
• contracts with service providers requiring them to protect the data they process for us.

No system is completely secure. If a personal data breach occurs that is likely to result in a real risk of harm, we will notify the Data Protection Commissioner within 72 hours of becoming aware of it, and inform the people affected where required, as section 43 of the Act provides.

09Your rights

Under section 26 and related provisions of the Act, you have the right to:

• be informed of how your personal data is used (which is what this policy is for);
• access the personal data we hold about you and obtain a copy;
• have inaccurate or misleading data corrected;
• have data deleted where it is no longer needed or was processed unlawfully;
• object to, or ask us to restrict, processing, including processing based on our legitimate interests;
• receive data you provided in a structured, machine-readable format and have it transmitted to another controller (data portability);
• withdraw consent at any time, where we rely on consent, without affecting processing already carried out;
• not be subject to a decision based solely on automated processing (see section 4);
• lodge a complaint with the Data Protection Commissioner.

To exercise any of these rights, contact us using the details below. We may ask you to verify your identity before acting on a request, and we will respond within the time limits set by the Act and the Regulations. Requests are free of charge, unless they are manifestly unfounded or excessive. Some rights are limited, for example where we must keep data to meet a legal obligation or for security reasons; if so, we will explain why.

10If you book for others

If you give us information about other people, such as officials named in an application letter or Visitors with particular needs, please make sure they know you are sharing it and point them to this policy. Group leaders should not send us more information about group members than we ask for.

11Children

The website is not directed at children, and bookings must be made by an adult. We record only the number of children in a visiting group, never their names or other details. If you believe a child has given us personal data, contact us and we will delete it. Any processing of children's data is carried out in line with section 33 of the Act and with the consent of a parent or guardian.

12Cookies

We use strictly necessary cookies and similar technologies to make the website work and keep it secure. With your consent, we also use analytics cookies to understand how the website is used. We do not use advertising cookies. Our Cookie Policy lists them in detail. You can change your choice at any time: Cookie settings.

13Changes to this policy

We may update this policy when our services, our providers or the law change. The date at the top shows when it was last updated. If a change materially affects how we use your data, we will take reasonable steps to tell you, and if we change how we use cookies we will ask for your consent again.

14Contact us and complaints

For any question or request about your personal data, contact KenGen's Data Protection Officer:

If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.