Privacy Notice

Kitara Foundation (“Kitara”, “we”, “us” or “our”) is a Kenya-registered children’s and youth foundation. Official site: kitarafoundation.org. Contact: info@kitarafoundation.org, Nairobi, Kenya.

For personal data processed through this website and related Kitara services that link to this Notice, Kitara is the data controller. This Notice does not automatically cover every future product or partner system unless that system links to or expressly relies on this Notice.

• Identity and contact: name, email, phone/WhatsApp (where provided), county/location notes you choose to share.
• Community accounts: registration details, password hashes (where used), email verification status, profile bio/county/photo, Google account identifiers and profile photo if you sign in with Google, story/awareness submissions, comments, and giving logs tied to your account.
• Donations and giving: donor name/email where provided, amounts, payment method or M-Pesa confirmation details you log, programme preference, and reconciliation notes.
• Safe Response / safeguarding reports: information you submit (which may include sensitive details about children, risk, location, contacts, or referrals). Access is restricted to authorised staff.
• Contact and support: enquiry messages, ticket replies, and related correspondence.
• Technical and security: IP address, device/browser signals, timestamps, authentication/session cookies, anti-abuse and rate-limit signals, error/security logs.
• Usage: pages viewed and engagement signals (for example story views/likes) needed to operate community features.
• Preferences/consent: cookie choices and similar preference records stored on your device.

Do not overshare. Do not send passwords, bank login credentials, full payment-card numbers, private keys, or unnecessary special-category data through ordinary forms unless Kitara has specifically requested them through an approved secure channel.

• Operate the public website, community portal, donations/giving workflow, and content publishing.
• Verify accounts, prevent abuse, fraud, spam, and unauthorised access.
• Issue receipts, reconcile gifts, and support accountability/transparency reporting.
• Review community stories and comments for accuracy, consent, and safeguarding.
• Triage Safe Response reports and coordinate referrals under safeguarding procedures.
• Respond to contact enquiries and provide support.
• Comply with legal, audit, child-protection, and accounting obligations.
• Improve the site where essential measurement is used; we do not sell personal data.

Submitting a form or joining the community is not blanket consent for unrelated marketing. We do not use your data to train a general public AI model unless a separate lawful basis and clear notice apply.

Depending on the activity and Kenya’s Data Protection Act, 2019 (and related guidance), we may rely on: performance of a contract or steps you request; legitimate interests that are not overridden by your rights (for example securing the platform and preventing abuse); compliance with legal obligations; vital interests or child-protection duties where applicable; and consent where consent is specifically required (including certain cookies or optional communications).

Kitara serves children and youth. Child-sensitive data is processed under strict safeguarding controls, need-to-know access, and never published without verified consent and risk review. Community members must not upload photos or stories of children without appropriate permission. See our Safeguarding Policy and Safe Response.

If you use Google to join or sign in, Google may share your name, email address, and profile photo with Kitara so we can create or authenticate your community account. Your use of Google is also subject to Google’s own terms and privacy policy. You can replace a Google photo with your own upload in Profile settings.

We may share personal data with authorised Kitara personnel and vetted processors that support hosting, databases, email, object storage, authentication, analytics (if approved), and payment reconciliation — only where access is necessary. Typical categories include:

• Website hosting and delivery (for example Vercel).
• Database hosting (for example Neon / PostgreSQL).
• Email delivery (for example Resend) for verification, alerts, and notices.
• Object storage for approved image uploads (for example Amazon S3).
• Identity providers you choose (for example Google OAuth).
• Payment or telecom partners when online payments are enabled, or for reconciling manual M-Pesa gifts you log.

Kitara does not sell personal data as a data-brokerage business. We may disclose information where required by law, court order, or to protect children, users, or the foundation from harm or fraud.

Some processors may handle data outside Kenya. Where required, we assess relevant locations and apply transfer safeguards under applicable law.

We keep personal data only as long as reasonably necessary for the purpose, legal and accounting duties, safeguarding records, dispute prevention, and security. Community accounts remain while active; you may request deletion subject to lawful retention. Safe Response and case records may be retained longer where child-protection, legal, or audit obligations require. Backup copies may expire on a delayed schedule.

We use risk-based technical and organisational measures such as encrypted transport (HTTPS), access controls, authentication, rate limiting, audit logs, and least-privilege staff access. No internet service is absolutely secure. Report vulnerabilities through our Security contact.

Subject to applicable law, you may request to be informed, access your data, request correction, deletion or restriction, object to certain processing, withdraw consent where consent applies, and obtain portability where applicable.

Privacy and deletion requests: see Data deletion & privacy requests or email info@kitarafoundation.org. You may also lodge a complaint with the Office of the Data Protection Commissioner (Kenya) where applicable.

We use essential cookies and similar technologies to keep you signed in, protect the site, and operate community features. Details and choices are in our Cookie & Tracking Notice.

We may update this Notice as our services, vendors, or the law change. The version and effective date above identify the current published Notice.

Kitara Foundation · Nairobi, Kenya · info@kitarafoundation.org