Privacy Policy.

1Scope of this policy

This policy covers personal information collected through chipukeezyfoundation.org, including contact and enquiry forms, merchandise order enquiries, newsletter or campaign sign-ups, donation-related enquiries and general browsing data such as cookies. It does not cover information collected offline during program delivery (for example, at school or club sessions), which is instead governed by our internal safeguarding and data-handling procedures — see our Safeguarding statement.

2Information we collect

We collect information in the following ways:

• Information you provide directly: name, email address, phone number, organisation, area of interest and any message content submitted through the Contact, Get Involved or Merchandise enquiry forms.
• Payment-related enquiries: when online card or M-Pesa STK Push payments are active, limited transaction details (amount, reference and status) may be processed by our payment provider to confirm a donation or order. CYEF does not store full card numbers or M-Pesa PINs at any time.
• Cookies and technical data: IP address, browser type, device type, pages visited and referring site, collected automatically as described in Section 4.
• Communications: records of email, WhatsApp or phone correspondence you have with CYEF, kept to respond to and follow up on your enquiry.

3How we use information

We use personal information to:

• Respond to enquiries about programs, partnerships, volunteering, media or donations.
• Process and confirm merchandise orders and donation-related payments.
• Coordinate program participation, event logistics and partner due diligence.
• Send updates about CYEF's work to people who have opted in and stop when asked.
• Understand how the website is used, in aggregate, to improve content and navigation.
• Meet legal, accounting, safeguarding and reporting obligations.

We do not sell, rent or trade personal information to third parties for their own marketing purposes.

4Cookies & similar technologies

A small consent cookie remembers each visitor's privacy choice. Optional analytics cookies are only created if you accept them through the cookie banner or the Cookie settings control available on every page.

You can change or withdraw your cookie choice at any time; declining analytics cookies does not affect your ability to browse the site, submit enquiries or make a donation.

5Children & program participants

Photos, names or stories of program participants that appear on this site are used only with appropriate consent from the participant, parent or guardian and are handled in line with our child protection commitments. If you believe a young person's information has been shared inappropriately, please contact us immediately using the details in Section 13.

6Legal basis & compliance

CYEF processes personal information in line with the principles of Kenya's Data Protection Act, 2019 and applicable regulations issued by the Office of the Data Protection Commissioner (ODPC). Our legal basis for processing typically includes: your consent (for example, opting into updates or analytics cookies), performance of a request you have made (responding to an enquiry, processing an order) and our legitimate interest in operating and improving the website responsibly.

7Sharing & third parties

We share personal information only where necessary, with:

• Payment processors (such as M-Pesa or a card payment gateway) when you make a donation or merchandise payment, solely to complete the transaction.
• Hosting and security providers (our web hosting provider and Cloudflare, our content delivery and security network) who process technical data to keep the site online and secure.
• Email and communication tools used to respond to enquiries.
• Authorities, where disclosure is required by law or necessary to protect the safety of a child or young person.

Each third party is only given the information needed to perform its function and is expected to handle it securely.

8Data retention

We keep enquiry and communication records for as long as needed to respond to your request, maintain accurate donor and partner records and meet legal or accounting obligations, after which they are deleted or anonymised. Analytics cookie data is retained for a maximum of 180 days.

9Data security

This website is served over an encrypted (HTTPS) connection. Access to enquiry records and payment references is limited to CYEF staff who need it to do their work. While no online system can be guaranteed completely secure, we take reasonable technical and organisational steps to protect personal information against unauthorised access, loss or misuse.

10Your rights

Subject to applicable law, you may ask us to:

• Confirm what personal information we hold about you and provide a copy of it.
• Correct inaccurate or incomplete information.
• Delete personal information we no longer need or have no lawful basis to keep.
• Withdraw consent to analytics cookies or opt-out of update communications at any time.
• Object to certain processing, where applicable.

To exercise any of these rights, contact us using the details in Section 13. If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner, Kenya.

11International transfers

Some service providers we rely on for hosting, security and content delivery may process data outside Kenya. Where this happens, we rely on providers that maintain recognised security and data-protection standards for the information they process on our behalf.

12Changes to this policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page shows when it was last revised. Material changes will be reflected here before they take effect.

13Contact us

For questions about this policy or to make a data request, contact CYEF at: