Privacy Policy

Nyoka Mashinani Initiative (“we”, “us”, “our”) is a community organisation based in Baringo County, Kenya. This policy explains what personal information we collect through this website and our field activities, why we collect it, and the rights you have over it. It is written to comply with the Kenya Data Protection Act, 2019 (DPA).

1. Information we collect

• Contact form submissions — your name, email address and the content of your message, so that we can reply to you.
• Newsletter signup — your email address, if you choose to receive our field notes.
• Programme records — with consent, photographs and first names of participants at our school and community activities.
• Basic usage data — our hosting provider may log anonymous request data (such as browser type and pages visited) for security and performance purposes. We do not use advertising trackers.

2. Why we collect it (purpose & lawful basis)

We process personal data only where we have a lawful basis under the DPA: your consent (newsletter, photographs), our legitimate interests (replying to enquiries, keeping the website secure), or public interest / vital interests where a snakebite emergency makes it necessary to share information with medical responders.

3. Where your data goes

Website enquiries and newsletter signups are stored in a private Google Sheets workspace operated by our authorised administrators. We never sell, rent or trade personal data. We share personal data only with medical services in an emergency, or where the law requires it.

4. Photographs of children

We photograph children only with the informed consent of a parent, guardian or head teacher, and we never publish a child’s full name, school or home location alongside their image. If you would like a photograph of your child removed from this website, contact us and we will action it promptly.

5. How long we keep data

Enquiries are kept for up to 24 months after our last contact; newsletter subscriptions are kept until you unsubscribe; programme consent records are kept for the duration of the relevant project plus one year.

6. Your rights under the DPA

• Request a copy of the personal data we hold about you;
• Ask us to correct or delete your data;
• Withdraw consent at any time (for example, unsubscribe from the newsletter);
• Lodge a complaint with the Office of the Data Protection Commissioner (Kenya).

To exercise any right, email us using the address on our contact page. We respond within 30 days.

7. Security

Access to our data stores is restricted to authorised staff, protected by strong authentication, and reviewed regularly. Despite our best efforts, no system is perfectly secure; if a breach ever affects your rights, we will notify you and the regulator as the law requires.

8. Changes to this policy

If we change this policy we will update the date above and, for significant changes, announce it on our website. Continued use of the website after a change means you accept the updated policy.