Legal
Privacy notice
Last reviewed:
This explains what happens to your personal data when you use this site, donate to us, or contact us. We collect as little as we can get away with, and we do not sell or rent your data to anyone.
What we collect
| Data | Why | Basis | Kept for |
|---|---|---|---|
| Donor name, email, phone | Receipt and donor communication | Consent / contract | 7 years (accounting) |
| Payment references | Accounting and reconciliation | Legal obligation | 7 years (accounting) |
| M-Pesa phone number | Sending the payment prompt | Consent | Duration of the donation + 7 years |
| Newsletter email | Programme updates | Consent | Until you unsubscribe |
| Contact form message | Responding to your enquiry | Consent | 24 months |
| Volunteer application | Recruitment and safeguarding | Consent | 12 months, then deleted unless you are placed |
| Website analytics | Understanding how the site is used | Consent | 14 months |
| Participant data | Delivering programmes and keeping children safe | Consent | See the safeguarding policy |
We do not collect postal addresses, dates of birth, or ID numbers. We do not need them for an e-receipt, and not collecting them reduces the risk of holding data we have no use for.
Children’s data
We work with children aged 9 and over. Data about them is collected only for the purpose of running the programme they are in, and only with recorded consent.
Participant records are held separately from any fundraising data. We never use a child’s information to ask anyone for money. Consent given by a child is treated as expiring when she reaches adulthood, and photographs are governed by the consent tiers described in the safeguarding policy.
Who we share it with
We name our processors rather than describing them as “secure services”. Each one sees only what it needs to do its job:
- Supabase — Database and file storage. Holds donor records, contact enquiries and programme content. (Supabase (US/EU regions). See transfers below)
- Stripe (payment processing) — Card payments. Processes your card details. (United States)
- Safaricom / Airtel (M-Pesa Daraja) — M-Pesa payments. Receives your phone number and the payment instruction. (Kenya)
- Vercel — Website hosting. Receives request logs including IP addresses. (United States / Europe)
We do not sell or share your data for anyone else’s marketing.
International transfers
Awaiting sign-off, not yet published
Some of our processors are hosted outside Kenya i.e in the United States and Europe. We will confirm the exact regions our data sits in and state them here plainly, rather than relying on a general assurance.
This matters particularly for European donors, and “we use secure services” is not an acceptable answer.
Your rights
You can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong;
- delete your data, where we are not required to keep it;
- stop using your data for a purpose you agreed to;
- withdraw consent, at any time and without giving a reason.
Email or use the contact form. We respond within 30 days.
We do not sell or share your data for anyone else’s marketing, so there is nothing to opt out of.
How to reach our data protection contact
Awaiting sign-off, not yet published
A dedicated data protection address has not yet been set up. Until it is, please use the contact page and ask for the data protection lead. A named, monitored address will be published here once it exists.
Complaints
If you are unhappy with how we have handled your data, tell us first and we will try to fix it. If you would rather go straight to the regulator, that is your right and we will not obstruct it. Kenya’s data protection regulator is the Office of the Data Protection Commissioner.