Jenga AfriHub is committed to protecting your personal information. This policy explains what data we collect when you use our website or contact us, why we collect it, and what rights you have under the Kenya Data Protection Act 2019 (the "Act") and other applicable data protection laws.
1. Who We Are
Jenga AfriHub is a registered non-governmental organisation in Kenya (Reg. No. JA/NGO/2019/0471), with our principal office at Nairobi, Kenya. We are the data controller for all personal data processed through this website and our programme activities.
Questions about this policy or your personal data may be directed to our Data Protection contact listed in Section 11.
2. What Data We Collect
We collect personal data only when you actively provide it to us. This includes:
| Source | Data collected |
|---|---|
| Contact form | Name, email address, phone number (optional), subject, message |
| Newsletter subscription | Email address |
| Volunteer application | Name, email, phone, location, volunteer role preference, availability, skills summary |
| Partner enquiry | Name, organisation, job title, email, phone, organisation type, partnership interest, message |
| Donation form | Name, email, phone (M-Pesa only), donation amount and frequency. Payment processing is handled by the relevant payment provider; we do not store card numbers or full M-Pesa credentials. |
| School / outreach request | Contact name, school or organisation name, email, phone, request details |
| Resource downloads | No account required. We do not collect personal data for PDF downloads. |
| Website analytics | Aggregated, anonymised usage data via Google Analytics 4 (see Section 7). |
We do not collect special-category data (such as health, ethnicity, or political opinion) through our website. If you share sensitive information voluntarily in a free-text field, we treat it with additional care and do not use it for any purpose beyond responding to your enquiry.
3. How We Use Your Data
- To respond to enquiries and messages sent via the contact form.
- To send our newsletter to subscribers who have opted in.
- To process and acknowledge volunteer applications and follow up with suitable candidates.
- To review and respond to partnership and school outreach requests.
- To process charitable donations and issue acknowledgements.
- To improve our website based on aggregated, anonymised analytics.
- To comply with our legal obligations, including under the Kenya NGO Co-ordination Act and the Kenya Data Protection Act 2019.
We do not use your data for automated decision-making or profiling, and we do not sell, rent, or trade personal data to any third party.
4. Legal Basis for Processing
Under the Kenya Data Protection Act 2019, we process personal data on the following lawful grounds:
| Activity | Lawful basis |
|---|---|
| Responding to enquiries | Legitimate interest / performance of a pre-contractual relationship |
| Newsletter | Consent (you can withdraw at any time) |
| Volunteer and partner processing | Consent / legitimate interest |
| Donation processing | Performance of a transaction |
| Legal compliance | Legal obligation |
| Analytics | Legitimate interest (data is anonymised and aggregated) |
5. Sharing Your Data
We share personal data only where necessary:
- With payment processors (e.g., Safaricom M-Pesa, Stripe) solely to complete donation transactions.
- With email service providers used to send newsletters and automated responses.
- With Google LLC for anonymised website analytics via Google Analytics 4.
- With our board of directors and staff on a need-to-know basis for programme operations.
- With regulatory bodies (e.g., NGO Co-ordination Board, Kenya Revenue Authority) when required by law.
All third-party service providers are required to process data in accordance with applicable data protection law and are not permitted to use it for their own purposes.
6. How Long We Keep Data
| Data type | Retention period |
|---|---|
| Contact form enquiries | 2 years from last correspondence |
| Newsletter subscriptions | Until you unsubscribe, then deleted within 30 days |
| Volunteer applications (unsuccessful) | 12 months from application date |
| Volunteer applications (active/accepted) | Duration of engagement + 2 years |
| Donation records | 7 years (Kenya tax and financial audit requirements) |
| Partner enquiries | 3 years from last contact |
| Analytics data | 14 months (Google Analytics 4 default, then automatically deleted) |
When retention periods expire, data is securely deleted or anonymised. If you request deletion before expiry, we will comply unless we are required to retain it by law.
7. Cookies & Analytics
Our website uses Google Analytics 4 (GA4) to understand how visitors use the site. GA4 is configured with IP anonymisation enabled. We collect no personal identifiers through analytics; all data is aggregated.
GA4 sets cookies on your device. You may opt out of Google Analytics tracking at any time by installing the Google Analytics opt-out browser add-on.
We do not currently use advertising, tracking, or third-party social media cookies beyond those described above. We do not use cookies for personalisation or cross-site tracking.
8. Your Rights
Under the Kenya Data Protection Act 2019, you have the following rights regarding your personal data:
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — ask us to correct inaccurate or incomplete data.
- Right to erasure — request deletion of your data where there is no lawful reason to retain it.
- Right to restrict processing — ask us to limit how we use your data in certain circumstances.
- Right to data portability — receive your data in a structured, commonly-used format.
- Right to object — object to processing based on legitimate interests.
- Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
To exercise any of these rights, contact us using the details in Section 11. We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya at odpc.go.ke.
9. Children's Privacy
Our website is not directed at children under the age of 18. We do not knowingly collect personal data directly from minors. Programme activities that involve young people are conducted in accordance with our Safeguarding Policy, which requires parental or guardian consent for participants under 18. If you believe we have inadvertently collected data from a minor without appropriate consent, please contact us immediately so we can delete it.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website after changes are posted constitutes acceptance of the revised policy.
11. Contact Us
For questions, requests, or complaints about this Privacy Policy or the handling of your personal data, please contact:
Data Protection Contact — Jenga AfriHub
+254 707 805 667
Teso North Sub County, Kenya
You may also use our contact form to reach us regarding data protection matters.