Privacy Statement

Last Updated: June 2024. This privacy statement explains how Caritas Nairobi collects, uses, and protects your personal data in accordance with the Kenya Data Protection Act 2019.

About Caritas Nairobi

Caritas Nairobi is the social development arm of the Catholic Archdiocese of Nairobi, dedicated to fostering integral human development for over 40 years. Serving more than 200,000 direct beneficiaries across the region, we implement Four Core Programmes tailored to eliminate dimensions of poverty and vulnerability while uplifting community dignity.

Our Data Management Commitment

To effectively serve our beneficiaries, donors, and partners across our core programs, Caritas Nairobi collects and processes essential personal data. We are firmly committed to ensuring that all personal information is managed with the highest standards of confidentiality, security, and respect.

In strict alignment with the Kenya Data Protection Act 2019, our data management practices ensure that:

Lawful Purpose: Data is collected solely to implement, evaluate, and report on our humanitarian and development initiatives.
Absolute Security: Robust technical and administrative safeguards protect your information from unauthorized access, loss, or misuse.
Respect & Dignity: Reflecting our core values, data processing is handled transparently, honoring individual privacy rights and maintaining absolute accountability to our communities and partners.

When and Why We Collect Your Data

When do we collect data?

Direct Interaction: When you donate, register for a program, apply for a job/volunteer position, or contact us through our website.
Program Delivery: When we assess eligibility for aid or monitor the progress of our humanitarian support.
Automated Collection: When you visit our website, we use technical tools to ensure our digital platforms remain secure and functional.

Why do we collect data?

To Provide Aid: To verify eligibility and ensure that resources reach the intended beneficiaries effectively.
To Manage Support: To process financial contributions, issue tax receipts, and communicate with our partners.
To Ensure Compliance: To meet legal obligations, including financial reporting and regulatory requirements.
To Improve Services: To analyze program impact and enhance the user experience on our digital platforms.
To update our records about you.
To handle queries and complaints.

Information We Collect

4.1 Donors & Supporters

Individuals or entities contributing funds or resources to our initiatives.

Full Name: To identify and acknowledge your contributions.
Contact Information: Email address, phone number, and physical/mailing address to send receipts and updates.
Payment/Transaction History: Details of donations made, processed through secure third-party gateways.
Donation Preferences: Information regarding your preferred programs or communication frequency.

4.2 Program Beneficiaries

Individuals receiving aid, medical, nutritional, or support services.

Identification Details: National ID number or Passport details, used to verify eligibility for specific aid programs.
Demographic Information: Age, gender, and household composition.
Socioeconomic Indicators: Data points required to assess vulnerability and determine the level of support needed.
Service-Specific Data: Health, nutritional, or social status information required to deliver specific humanitarian services effectively.

4.3 Website Visitors

Users browsing our online platforms and digital portals.

Technical Metadata: IP address, browser type, device information, and operating system.
Usage Statistics: Data on how you interact with our site, including pages visited and time spent, collected via cookies or analytics tools.

4.4 Employees & Volunteers

Individuals engaged in service, employment, or internship roles with the organization.

Professional Details: Employment history, curriculum vitae, qualifications, and certifications.
Administrative Information: Bank account details for payroll/stipend processing, KRA PIN, and NHIF/NSSF details.
Emergency Contact: Next-of-kin names and contact information for use in emergency situations.

Data Collection Sources and Sensitive Data

Sources of Data

Directly from You: Information provided voluntarily via physical forms, digital registration, donation portals, or direct communication.
Automated Collection: Data captured through website forms, website analytics, cookies, and network logs when you interact with our digital infrastructure.
Third-Party Sources: In certain program contexts, we may receive information from verified partners or government agencies to ensure aid reaches those most in need.

Sensitive Personal Data

We acknowledge that some of the information we process may fall under the category of "sensitive personal data" as defined by the Kenya Data Protection Act (2019). This may include data related to health status, religious or philosophical beliefs, and other socio-economic indicators necessary for our humanitarian work. We handle this data with enhanced security measures, ensuring:

Explicit Consent: Where required, we obtain clear and informed consent before processing sensitive data.
Strict Access Control: Access to sensitive records is restricted to specific, authorized personnel who require the information to perform their duties.
Purpose Limitation: Sensitive data is never used for secondary purposes outside of the specific program or service for which it was collected.

Data Transfer

In certain instances, particularly when utilizing global cloud services or third-party platforms, your personal data may be stored or processed in locations outside of Kenya. In such cases, we ensure that the transfer complies with the requirements set forth in the Kenya Data Protection Act (2019). We take appropriate technical and organizational measures to ensure that your data is afforded the same level of protection as required under Kenyan law, regardless of where it is processed.

Data Retention

We retain personal data only for the duration necessary to fulfill the purposes for which it was collected, or to meet our legal, tax, and statutory record-keeping obligations. When the data is no longer required for these purposes, it is securely destroyed, deleted, or anonymized to prevent unauthorized recovery.

Marketing Communications

Caritas Nairobi will only contact you for marketing purposes where you have provided us with your consent to do so. We may market our services through post, telephone, text message, and any other digital methods that may become available in the future. Consent will be sought before any such marketing communications commence. You may withdraw your consent at any time by contacting us as detailed in the Contact Information section.

Data Security Protocols

We implement physical, technical, and organizational measures to prevent unauthorized access, alteration, or disclosure of data, including:

Encryption of sensitive digital records.
Access controls limiting data availability to authorized personnel only.
Regular security audits of our digital infrastructure.

Legal Basis for Personal Data Processing

Caritas Nairobi processes personal data in accordance with the Constitution of Kenya (Article 31), which guarantees the right to privacy, and the Kenya Data Protection Act (2019). We rely on the following legal bases for processing your information:

Consent: You have given clear consent for us to process your personal data for specific purposes.
Contractual Necessity: Processing is necessary for the performance of a contract or agreement with you (e.g., employment contracts or service agreements).
Legal Obligation: Processing is necessary for compliance with a legal obligation to which Caritas Nairobi is subject.
Vital Interests: Processing is necessary to protect your vital interests or those of another person (e.g., in medical or humanitarian emergencies).
Public Interest: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in our organization.
Legitimate Interests: Processing is necessary for the purposes of our legitimate interests, provided these are not overridden by your fundamental rights and freedoms.

Upholding Your Rights as a Data Subject

Caritas Nairobi views the right to privacy, as enshrined in Article 31 of the Constitution of Kenya, as a fundamental aspect of human dignity. We are dedicated to ensuring that you are empowered to exercise control over your personal information. To support this, we have established the following commitments:

Right to be Informed: We are committed to complete transparency. We provide clear, concise, and accessible information regarding why and how we process your data at the point of collection.
Right to Access: We facilitate your right to know what personal data we hold about you. You may request a copy of your records, and we will provide them in a clear, understandable format.
Right to Correction: We recognize that accurate data is vital. If your information is inaccurate or incomplete, we provide straightforward procedures for you to request that we update or correct it.
Right to Deletion: We respect your right to request the erasure of your personal data. Where legally permissible and consistent with our statutory record-keeping obligations, we will remove your information from our active systems.
Right to Object and Withdraw Consent: Your choices matter. You have the right to object to the processing of your data for specific purposes and to withdraw your consent at any time, especially regarding non-essential communications.
Right to Data Portability: We support your autonomy. Should you request it, we will provide your data in a structured, machine-readable format to facilitate its transfer to another entity, where technically feasible.

Updates to this Policy

Caritas Nairobi reserves the right to modify this policy to reflect changes in legal requirements or operational practices. Any material updates will be posted on our official website.

Contact Information

For privacy-related inquiries, data access requests, or complaints regarding how Caritas Nairobi processes your personal data, please contact our Data Protection Office:

Organization: Caritas Nairobi

Email: info@caritasnairobi.org | admin@caritasnairobi.org

Physical Address: Cardinal Otunga Plaza, Cardinal Otunga Road, P.O. Box 41353-00100, Nairobi, Kenya

Phone: +254 20 4950000 | +254 720 361 855