Legal
Privacy Policy.
How Chipukeezy Youth Empowerment Foundation collects, uses and protects personal information, plus the rights you have over it under the Data Protection Act, 2019.
CYEF works with children and young people, so privacy is not a formality for us. This policy sets out in plain terms what we collect, why we collect it, who we share it with and how you can get it corrected or deleted. If anything here is unclear, ask us and we will explain it.
1Who we are
Chipukeezy Youth Empowerment Foundation ("CYEF", "we", "us", "our") is a Kenyan youth foundation established in 2017 by Vincent Muasya Mutua. We work across Machakos, Nairobi and Mombasa, with our education base at St. Martin De Porres School in Tala, Machakos County.
For the purposes of the Data Protection Act, 2019, CYEF is the data controller for the personal information described in this policy. That means we decide why and how your information is used and we are answerable for it.
| How to reach us | Details |
|---|---|
| info@chipukeezyfoundation.org | |
| Phone and WhatsApp | +254 748 390 908 |
| Where we are based | Tala, Machakos County, Kenya |
| Privacy questions | Email us with "Privacy" in the subject line |
Our registration and governance documents are available to partners and donors on request. See Reports and documents.
2Scope of this policy
This policy covers personal information we collect through chipukeezyfoundation.org and through the everyday running of our programs. That includes enquiry and contact forms, merchandise order enquiries, donation enquiries, volunteer and partnership applications, newsletter sign-ups and information collected automatically when you browse the site.
It also covers information we hold about learners, players, creatives, volunteers, staff and partners taking part in our programs, to the extent we handle it centrally. Day-to-day handling inside schools and clubs is additionally governed by our internal safeguarding procedures. See our Safeguarding statement.
This policy does not apply to websites or services run by other organizations, even where we link to them.
3Information we collect
We only collect what we actually need. Depending on how you interact with us, that may include:
| Category | What it covers |
|---|---|
| Identity and contact | Name, email address, phone number, organization and role, plus the county or country you are writing from. |
| Enquiry content | Anything you write in a message, application or order enquiry, plus our replies to it. |
| Donation and payment | Amount, currency, date, transaction reference and status. Where online card or M-Pesa payments are active, these are handled by our payment provider. We never see or store full card numbers, CVV codes or M-Pesa PINs. |
| Merchandise orders | Item, size, quantity, delivery or collection preference and the address needed to get the item to you. |
| Program participation | For learners, players and creatives: name, age or date of birth, school or club, guardian contact details, attendance and progress notes, plus health or dietary information where that is needed to keep someone safe. |
| Images and recordings | Photographs, video and audio taken at our activities. See section 6. |
| Technical data | IP address, approximate location derived from it, browser and device type, pages visited, referring site and timestamps. |
| Consent records | A record of the cookie and communication choices you have made, so we can honor them. |
Sensitive personal data. Health information and information about children, is treated as sensitive under the Data Protection Act, 2019. We collect it only where it is genuinely necessary for safety or program delivery, we limit who can see it and we do not use it for marketing under any circumstances.
4How we collect it
- Directly from you when you fill in a form, email us, message us on WhatsApp, place an order, apply to volunteer or speak to our team at an event.
- Automatically as you use the website, through cookies and server logs. See section 8.
- From a parent, guardian, school or club when a young person joins one of our programs.
- From partners and providers, such as our payment provider confirming whether a transaction succeeded or a partner organization running a joint activity.
- From public sources such as an organization's own website, where we are checking the details of a prospective partner.
5Why we use it and our legal basis
The Data Protection Act, 2019 requires us to have a lawful basis for every use of your information. Ours are set out below.
| What we do | Lawful basis |
|---|---|
| Reply to enquiries about programs, partnerships, media or donations | Legitimate interest in running the foundation and answering people who contact us |
| Process and confirm merchandise orders and donations | Performance of a contract and legal obligation for financial records |
| Enrol and support young people in programs | Consent from a parent or guardian and our legitimate interest in delivering the program |
| Keep participants safe, including first aid and emergency contact | Protection of vital interests and legal obligation under child protection duties |
| Send updates to people who asked for them | Consent, which you can withdraw at any time |
| Report to funders and publish impact figures | Legitimate interest in accountability, using aggregated or anonymized data wherever possible |
| Keep accounting, tax and audit records | Legal obligation |
| Understand how the site is used and improve it | Consent, through optional analytics cookies |
| Prevent fraud and misuse and defend legal claims | Legitimate interest and legal obligation |
Where we rely on legitimate interest, we have weighed that interest against your rights. You can object at any time. See section 14.
6Photography, film and stories
Telling the story of our work matters, but never at the cost of a young person's dignity or safety. Our practice is as follows.
- We seek consent before photographing or filming an identifiable participant. For anyone under 18 that consent comes from a parent or guardian and we also ask the young person themselves.
- Consent is specific. We explain where an image may appear, such as this website, our Instagram accounts, printed material or a funder report.
- We do not publish a child's full name alongside their image and we do not publish school details, home area or contact information with it.
- We do not use images in a way that portrays a young person as helpless or that trades on distress.
- Consent can be withdrawn. Email us and we will remove the image from our website and our own channels. We will also ask partners to stop using it, though we cannot guarantee removal from material already printed or from copies others have made.
If you have seen an image of yourself or your child that you want taken down, email info@chipukeezyfoundation.org and we will act on it promptly.
7Children and program participants
CYEF works with children and vulnerable young people and the Data Protection Act, 2019 gives their information additional protection.
- This website is aimed at adults. We do not knowingly collect personal information directly from a child through the site and the forms are not designed for children to complete.
- Where a child takes part in a program, we collect their information through a parent, guardian, school or club, with consent and with a clear explanation of what it is for.
- Access to participant records is limited to the staff who need it to do their work and to safeguarding leads.
- We never sell information about a child and we never use it for advertising or profiling.
- If you believe a child has given us personal information through this site, contact us and we will delete it.
Safeguarding concerns should be raised through the channels on our Safeguarding page.
8Cookies and similar technologies
Cookies are small files stored by your browser. We use very few and the optional ones stay off until you accept them.
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
| cyef_cookie_consent | Remembers your cookie choices so we do not ask again | Necessary | 12 months |
| cyef_visitor_id | Distinguishes one visitor from another, without identifying you | Optional analytics | 12 months |
| cyef_last_visit | Records the date of your previous visit | Optional analytics | 12 months |
Necessary cookies are required for the site to work and cannot be switched off. Optional analytics cookies are only created after you accept them and refusing them does not reduce what you can do on the site.
You can change your mind whenever you like: . You can also block or delete cookies in your browser settings, though parts of the site may then behave unexpectedly.
9Sharing and disclosure
We do not sell personal information and we do not rent or trade mailing lists. We share information only in these situations:
- Service providers who process information on our behalf under contract, including our email provider, our hosting and content delivery partners and our payment provider. They may only use the information to provide the service to us.
- Program partners such as schools, clubs and partner organizations, where sharing is necessary to run a joint activity. We limit it to what that activity requires.
- Funders and auditors, normally as aggregated or anonymized figures. Where a funder requires participant-level detail, we tell participants before we share it.
- Professional advisers such as accountants, auditors and lawyers, bound by confidentiality.
- Authorities where the law requires it or where there is a child protection or safeguarding duty to report. Safeguarding disclosures do not require your consent.
- A successor organization if CYEF merges or restructures, in which case this policy continues to apply until you are told otherwise.
10Transfers outside Kenya
Some of the providers we rely on, such as email and website infrastructure, store data on servers outside Kenya. Where personal information leaves the country, section 48 of the Data Protection Act, 2019 requires appropriate safeguards.
We satisfy that by using established providers with recognized data protection commitments and contractual protections, by transferring only what is necessary and by confirming that the provider offers protection comparable to Kenyan law. You can ask us which providers are involved and what safeguards apply.
11How long we keep information
We keep personal information only as long as we have a reason to, then delete it or anonymize it.
| Information | Kept for |
|---|---|
| General enquiries with no further contact | Up to 24 months from the last message |
| Donation and merchandise records | 7 years, to meet accounting and tax requirements |
| Program participant records | For the duration of participation, then up to 7 years, reflecting child protection record-keeping duties |
| Volunteer and partnership applications | 24 months if unsuccessful or for the duration of the relationship |
| Newsletter subscriptions | Until you unsubscribe, plus a suppression record so we do not contact you again by mistake |
| Consent and safeguarding records | As long as needed to evidence the consent or manage the concern |
| Website analytics | Up to 14 months, in aggregate |
Where a legal claim or safeguarding matter is live, we keep the relevant records until it is resolved.
12Keeping information secure
- The website is served over an encrypted HTTPS connection.
- Access to enquiry records, participant records and payment references is limited to staff who need it. Accounts are individually assigned.
- Payment card details and M-Pesa PINs never reach our systems. They are handled by the payment provider.
- Staff and volunteers who handle personal information are briefed on their obligations and safeguarding leads receive additional guidance.
- We review who has access when someone changes role or leaves.
No online system can be guaranteed completely secure, but we take reasonable technical and organizational steps to protect personal information against unauthorized access, loss or misuse.
13Data breaches
If personal information in our care is lost or exposed, section 43 of the Data Protection Act, 2019 sets out what must happen.
- We will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of a breach with a real risk of harm.
- We will tell affected people in writing where the breach is likely to affect their rights, explaining what happened and what to do about it.
- We will record every breach, including those we are not required to report, then act on what it teaches us.
14Your rights
Under the Data Protection Act, 2019 you have the right:
- To be informed of how your personal data is being used, which is what this policy is for.
- To access the personal data we hold about you.
- To object to processing of all or part of your personal data.
- To correction of data that is false or misleading.
- To deletion of false or misleading data about you.
In addition, we will honor the following as a matter of practice:
- Withdrawing consent at any time, including consent to photography and to receiving updates. Withdrawing consent does not undo what was lawful beforehand.
- Data portability, providing a copy of information you gave us in a commonly used electronic format.
- Restricting processing while a dispute about accuracy or our lawful basis is resolved.
Some requests have limits. We may need to keep certain records to meet a legal obligation, to manage a safeguarding concern or to defend a legal claim. We will explain it if that applies to you.
15Exercising your rights
Email info@chipukeezyfoundation.org with "Data request" in the subject line and tell us what you want us to do.
- We may ask for proof of identity, so that we do not release someone's information to the wrong person.
- A parent or guardian may make a request on behalf of a child.
- We respond within 30 days. If a request is complex we will tell you and explain the delay.
- There is no charge. We may charge a reasonable fee only where a request is clearly excessive or repetitive.
16Complaints to the Data Commissioner
If you are unhappy with how we have handled your information, tell us first and give us the chance to put it right.
You also have the right to complain to the Office of the Data Protection Commissioner, the independent regulator for data protection in Kenya. You can find their complaint process at odpc.go.ke. Complaining to us first does not remove that right.
17Marketing and updates
We send updates about CYEF's work only to people who have asked for them. Every email includes a way to unsubscribe and we act on it promptly.
We do not sell your details to other organizations for their marketing and we do not send fundraising messages to people who have only asked a program question.
Beware of impersonation. CYEF will never ask you to send money to a personal M-Pesa number or a personal bank account. Official giving instructions come only from info@chipukeezyfoundation.org or +254 748 390 908. If a message claiming to be from CYEF looks wrong, contact us before paying anything.
18Automated decisions
We do not make decisions about you by automated means alone and we do not profile you for advertising. Decisions about program places, sponsorship and partnerships are made by people.
19Third-party links
Our site links to other organizations, including partners and our own social media accounts. Once you follow a link, that organization's privacy policy applies, not ours. We are not responsible for how they handle your information. Read their policy before sharing anything.
20Changes to this policy
We review this policy at least once a year and whenever we change how we handle personal information. The "Last updated" date at the top shows the current version.
Where a change materially affects your rights, we will say so prominently on this page. We will also contact you directly if we hold your details and the change warrants it.
21Contact us
Questions about this policy or about anything we hold on you:
- Email info@chipukeezyfoundation.org
- Call or WhatsApp +254 748 390 908
- Or use the form on our Contact page
See also our Terms and Conditions, our Safeguarding statement and our Policies overview.