Privacy Policy

1. About this Privacy Policy

Thabiti Alliance respects the privacy, dignity and rights of every person whose personal data we handle.

This Privacy Policy explains what personal data we may collect, why we collect it, how we use and protect it, when it may be shared, how long we keep it, and the rights available to individuals whose data we process.

We are committed to handling personal data responsibly and in accordance with Kenyan data-protection law, including the Data Protection Act, 2019, and other applicable requirements.

Some programmes or activities may require more detailed information than is covered here. Where this is necessary, we may provide an additional privacy notice at the point where the information is collected.

2. Our responsibility for personal data

When Thabiti Alliance determines why and how personal data is used for its organisational activities, it acts as a data controller.

We may use trusted service providers to process information on our behalf. Where we do, we will take reasonable steps to ensure that appropriate contractual, technical and organisational safeguards are in place.

There may also be circumstances in which Thabiti Alliance processes information together with, or on behalf of, another organisation. In those situations, responsibility for the information will be determined by the nature of the relationship and applicable law.

Thabiti Alliance will maintain any data-protection registrations, records or regulatory information required as its operations develop.

3. How we approach data protection

Our approach to data protection is straightforward.

We aim to collect only the information we genuinely need, explain why we need it, use it for legitimate purposes, keep it accurate, protect it appropriately and avoid retaining it for longer than necessary.

Personal data should not be collected simply because it might become useful at some point in the future.

Additional care will be taken where information concerns children, vulnerable people or sensitive personal circumstances.

4. Privacy by design and default

Privacy should be considered before personal information is collected, not only after a problem arises.

When developing new programmes, forms, systems, technologies or processes, Thabiti Alliance will consider the privacy risks involved and the safeguards required.

These safeguards may include limiting the amount of information collected, restricting access, using secure systems, anonymising or pseudonymising information, setting appropriate retention periods and preventing unnecessary disclosure.

Where proposed processing is likely to create a high risk to people's rights or freedoms, a Data Protection Impact Assessment will be carried out where required.

5. Personal data we may collect

The information we collect depends on the nature of a person's relationship with Thabiti Alliance.

It may include:

• Name
• Email address
• Telephone number
• Country or general location
• Organisation or professional affiliation
• Correspondence and enquiries
• Information submitted through website forms
• Volunteer or partnership information
• Application, referral or nomination information
• Information required to assess or administer a programme
• Communication preferences
• Records connected with an organisational relationship
• Technical information generated through use of the website
• Other information voluntarily or lawfully provided to us

We will not deliberately collect more personal information than is reasonably necessary for an identified purpose.

6. Sensitive personal data

Some personal information requires a higher level of protection because of its nature.

Depending on our activities, this may include information about health, family circumstances or other categories recognised as sensitive under applicable law.

Sensitive personal data will be processed only where there is a lawful reason to do so and suitable safeguards are in place.

People should not send sensitive information through a general website enquiry unless Thabiti Alliance has specifically requested it and provided an appropriate means of submission.

7. How we receive personal data

We may receive personal data:

• Directly from the individual concerned
• Through our website
• By email or other official communication
• Through programme applications
• Through referrals or nominations
• During organisational activities
• Through a parent, guardian or authorised representative
• From a partner organisation where lawful and appropriate
• From another legitimate source

Where information is obtained from someone other than the individual concerned, we will handle it in accordance with applicable transparency and notification requirements.

8. Why we use personal data

Thabiti Alliance may use personal data to:

• Respond to enquiries
• Communicate with people who contact us
• Assess programme applications, referrals or nominations
• Administer programmes and organisational activities
• Manage relationships with volunteers, partners and professional contacts
• Maintain appropriate organisational records
• Fulfil safeguarding responsibilities
• Prevent, detect or investigate suspected fraud or misuse
• Protect our website, systems and information
• Manage complaints or concerns
• Comply with legal, regulatory, financial or reporting obligations
• Monitor and improve our operations
• Establish, exercise or defend legal rights
• Carry out other lawful activities connected with our work

If we intend to use personal data for a substantially different purpose, we will consider whether further notice or another lawful basis is required before doing so.

9. Lawful basis for processing

Thabiti Alliance will identify an appropriate lawful basis for processing personal data where required.

Depending on the activity, this may include:

• Consent
• Taking steps connected with entering into or performing an agreement
• Fulfilling a legal obligation
• Protecting vital interests
• Carrying out a task recognised under applicable law
• Pursuing legitimate interests that do not override an individual's rights and freedoms
• Another lawful basis recognised under applicable law

We will not rely on consent simply because it is convenient.

Where consent is the appropriate basis, it should be informed and freely given and may be withdrawn in accordance with applicable law.

10. Children and young people

Children's personal data requires particular care.

Where Thabiti Alliance processes information about a child, we will consider the child's rights, safety, dignity and best interests.

Depending on the circumstances, safeguards may include obtaining the involvement or consent of a parent or guardian where required, limiting the amount of information collected, restricting access, protecting identifying details and applying appropriate security measures.

Information intended for children should be explained in language appropriate to the relevant age group.

Thabiti Alliance will not knowingly profile children for direct-marketing purposes.

11. Beneficiaries and vulnerable people

Information concerning beneficiaries and vulnerable people will be handled with particular care.

Access will be limited to people who genuinely require the information for an authorised purpose.

Where a person's identity is not necessary for reporting, monitoring, learning or public communication, Thabiti Alliance may use anonymised, pseudonymised or aggregated information instead.

Protecting dignity is especially important where information concerns poverty, illness, family hardship, disability, safeguarding concerns or other sensitive personal circumstances.

12. Photographs, videos and personal stories

Photographs, videos, recordings, testimonials and personal stories may reveal personal information about an individual.

Thabiti Alliance will use identifiable material only where there is an appropriate lawful basis and any necessary permission has been obtained.

Additional care will be taken where children or vulnerable people are involved.

Receiving assistance from Thabiti Alliance does not, by itself, give the organisation permission to publish a person's photograph, identity, video or personal story.

Where identification is unnecessary, we will consider appropriate ways of protecting the person's identity.

13. Website forms and enquiries

Information submitted through our website will be used primarily to deal with the purpose for which it was provided and for reasonably related administrative purposes.

People should provide only the information requested and avoid including unnecessary sensitive personal information.

If a future form collects detailed programme, safeguarding or sensitive information, additional privacy information may be provided alongside that form.

14. Donors and supporters

If Thabiti Alliance accepts donations or maintains donor relationships, we may process personal information necessary to administer those relationships.

This may include contact details, correspondence, donation records and information required for accounting, financial administration, regulatory compliance or fraud prevention.

Where online payments are introduced, payment credentials should, where practicable, be handled by appropriately selected payment-service providers rather than unnecessarily retained by Thabiti Alliance.

If donation functionality materially changes the way personal data is processed, this Privacy Policy will be updated accordingly.

15. Volunteers, applicants, partners and professional contacts

We may process information relating to prospective or existing volunteers, applicants, professional advisers, service providers and representatives of partner organisations.

This may be necessary to communicate, assess suitability, carry out appropriate checks, manage relationships, maintain records, fulfil safeguarding responsibilities or comply with legal obligations.

Where a particular relationship requires more extensive processing, an additional privacy notice may be provided.

16. Sharing personal data

Thabiti Alliance does not sell personal data.

We may share information where it is lawful and reasonably necessary with:

• Authorised personnel
• Professional advisers
• Technology and hosting providers
• Email and communications providers
• Cloud or data-storage providers
• Programme or implementation partners
• Auditors and other professional service providers
• Payment providers, if introduced
• Regulators
• Courts
• Law-enforcement agencies
• Other competent authorities

We aim to share only the information required for the relevant purpose.

Service providers processing personal data on our behalf will be expected to protect that information appropriately and use it only for authorised purposes.

Where required, appropriate written arrangements will define the responsibilities of the parties involved.

17. International transfers

Because Thabiti Alliance may work with international partners or technology providers, personal information may sometimes be processed outside Kenya.

Any international transfer of personal data will be handled in accordance with the requirements that apply to that transfer.

We will consider the destination, nature of the information, protections available and any safeguards required before transferring personal data internationally.

Particular care will be taken where sensitive information or children's personal data is involved.

18. Data Protection Impact Assessments

Before introducing processing that is likely to present a high risk to privacy or other protected rights, Thabiti Alliance will carry out a Data Protection Impact Assessment where required.

This may be relevant where an activity involves significant processing of children's data, sensitive information, systematic monitoring, profiling or technologies capable of materially affecting people's privacy.

The purpose of the assessment is to identify risks before processing begins and determine how those risks can be reduced or managed.

Where engagement with the Office of the Data Protection Commissioner is legally required, Thabiti Alliance will follow the applicable procedure.

19. Security

Thabiti Alliance will use technical and organisational measures appropriate to the information we hold and the risks involved.

These measures may include access controls, strong authentication, restricted access to sensitive information, secure systems, appropriate backups, confidentiality requirements, secure transfer methods, service-provider controls and procedures for responding to security incidents.

Encryption or pseudonymisation may also be used where suitable.

No organisation can guarantee that an internet-based system will never experience a security incident. Thabiti Alliance will nevertheless take reasonable and proportionate measures to reduce foreseeable risks and respond appropriately when incidents occur.

20. Keeping personal data accurate

We will take reasonable steps to ensure that personal data is accurate and, where necessary, kept up to date.

Anyone who believes that important information we hold about them is inaccurate or has changed should contact us so that the information can be reviewed and corrected where appropriate.

21. How long we keep personal data

Thabiti Alliance does not intend to keep personal data indefinitely.

The appropriate retention period will depend on why the information was collected and whether legal, financial, safeguarding, audit, contractual, operational or dispute-related reasons require it to be retained.

The nature and sensitivity of the information will also be taken into account.

When personal data is no longer required, it will be securely deleted, destroyed, anonymised or otherwise disposed of appropriately.

Thabiti Alliance will maintain and develop internal retention arrangements as its operations grow.

22. Your data-protection rights

Subject to applicable law and any lawful limitations or exceptions, individuals may have rights to:

• Be informed about how their personal data is used
• Obtain access to personal data held about them
• Object to certain forms of processing
• Have inaccurate, false or misleading information corrected
• Request deletion or erasure in appropriate circumstances
• Request restriction of certain processing
• Receive or transfer certain information where data-portability rights apply
• Withdraw consent where consent is the basis for processing

Thabiti Alliance will respect valid data-subject requests in accordance with applicable law.

We may need to verify a person's identity or authority before releasing, changing or deleting personal information.

23. Children's privacy rights

Where permitted or required by law, a child's privacy rights may be exercised by a parent, guardian or another person legally authorised to act on the child's behalf.

Requests involving children's information will be handled with particular attention to the child's rights, safety, dignity and best interests.

24. How to make a privacy request

Anyone wishing to exercise a data-protection right may contact Thabiti Alliance through the official Contact page or another privacy contact channel published by the organisation.

The request should contain enough information for us to understand what is being requested and reasonably verify the identity or authority of the person making it.

We will respond within the timeframe required by applicable law.

We will not ordinarily request more identification information than is reasonably necessary to verify and process the request.

25. Marketing communications

Where Thabiti Alliance sends newsletters, fundraising communications or other direct-marketing messages, it will do so on an appropriate lawful basis.

Recipients will be given a reasonable way to withdraw or change their communication preferences where required.

Choosing not to receive marketing messages does not necessarily prevent Thabiti Alliance from sending essential administrative communications connected with an existing relationship.

Children will not knowingly be profiled for direct-marketing purposes.

26. Cookies and similar technologies

The Thabiti Alliance website may use cookies or similar technologies that are necessary for website operation, security, language preferences or other legitimate technical purposes.

If analytics, advertising or other non-essential tracking technologies are used, Thabiti Alliance will comply with applicable transparency and consent requirements.

Where necessary, additional information will be provided through a cookie notice or consent mechanism.

We will periodically review the technologies used on the website so that the information provided to visitors remains accurate.

27. Automated decision-making

Thabiti Alliance will not make decisions producing significant effects on beneficiaries solely through automated processing without the safeguards required by applicable law.

If significant automated decision-making or profiling is introduced in the future, affected individuals will be provided with the information and protections required by law.

28. Personal-data breaches

Thabiti Alliance will maintain procedures for identifying, reporting, assessing, containing and responding to personal-data breaches.

If a breach occurs, we will assess the nature of the incident, the information involved, the people potentially affected, the possible consequences and the measures required to contain and address it.

Where Thabiti Alliance acts as the data controller and a breach is legally notifiable, the Office of the Data Protection Commissioner will be notified without undue delay and within the statutory timeframe, including within 72 hours of becoming aware of the breach where that requirement applies.

Where affected individuals are legally required to be informed, Thabiti Alliance will communicate with them in accordance with the applicable requirements.

Where Thabiti Alliance acts as a data processor, the relevant data controller will be informed within the applicable statutory or contractual timeframe.

Relevant incidents and the action taken in response may be documented for compliance, accountability and organisational learning.

29. Internal data-protection governance

This public Privacy Policy is supported by internal controls and procedures that will be developed and maintained in proportion to Thabiti Alliance's activities and data-protection risks.

These may include access-control procedures, retention arrangements, data-subject request procedures, breach-response procedures, service-provider controls, confidentiality requirements, training, Data Protection Impact Assessment procedures, safeguarding controls and information-security measures.

Our data-protection arrangements will be reviewed as our programmes, systems, workforce and processing activities develop.

30. Complaints

Anyone who has questions or concerns about the way Thabiti Alliance handles personal data should contact the organisation through its official Contact page or another designated privacy contact channel.

We will consider legitimate privacy concerns and respond in accordance with applicable requirements.

Individuals may also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya if they believe their data-protection rights have been infringed.

31. Changes to this Privacy Policy

Thabiti Alliance may update this Privacy Policy as its programmes, systems, technology, organisational activities, regulatory obligations or data-processing practices develop, or where applicable law changes.

The current version number and effective date will be displayed on this page.

If a change materially affects the way personal data is processed, additional notice will be provided where appropriate or legally required.

Previous versions may be retained for governance, compliance and accountability purposes.

32. Contact

Questions concerning this Privacy Policy, the processing of personal data or the exercise of data-protection rights may be submitted through the official Thabiti Alliance Contact page.

If Thabiti Alliance establishes a dedicated privacy or data-protection contact address, this Policy will be updated accordingly.

Visitors should rely only on contact information published through official Thabiti Alliance channels.