Privacy and Data Protection Policy

We collect only what we need to keep you updated, process your support, and improve this website. We never sell your information. You can ask us what we hold about you, correct it, or have it deleted at any time by emailing concerns@greenleafkenya.org.

1. Who we are

Green Leaf Kenya is a community-based organization registered in Homa Bay County, Kenya (October 2024), located in Kabondo, Rachuonyo East (P.O. Box 79 – 40223, Kadongo). For this website and the personal data described below, Green Leaf Kenya is the data controller under the Data Protection Act, 2019 (Kenya).

2. What we collect, and where

• Newsletter signup: your email address (and name, if you provide it).
• Concept note access: your name and email address, and optionally your organization.
• Volunteer form: your name, contact details, and the information you choose to share about your skills and availability.
• Partnership and general inquiries: your name, email address, and the contents of your message (hello@greenleafkenya.org / partners@greenleafkenya.org).
• Donations: your name, email address, donation amount, and transaction reference, received from our payment providers. We never receive or store your card number, M-Pesa PIN, or bank login. See section 5.
• Website usage: technical and usage data collected through cookies and analytics tools (pages visited, approximate location, device type, and interaction patterns). See section 6 and our Cookie Notice.

We do not knowingly collect personal data from children under 18. This website is intended for adults.

3. Why we collect it (purposes and lawful bases)

• To send you updates you asked for (newsletter, concept note follow-ups) – basis: your consent, which you may withdraw at any time via the unsubscribe link or by emailing us.
• To process, confirm, and receipt donations, and to keep financial records – basis: performance of your request and our legal obligations for financial record-keeping.
• To respond to inquiries and volunteer or partnership interest – basis: your request (legitimate interest).
• To understand how the website is used and improve it – basis: consent (analytics cookies).
• To measure the effectiveness of our Google Ad Grants campaigns – basis: consent (advertising cookies).

4. Who we share it with

We share personal data only with service providers who process it on our behalf, and only as needed:

• Payment processing: Donorbox and, once live, Paystack, together with their underlying payment networks; M-Pesa payments are processed through Safaricom and KCB Bank Kenya (“Lipa na KCB”).
• Email and productivity: Google Workspace (email, forms, storage) and Mailchimp.
• Video: YouTube (Google), for embedded videos on our pages. We use privacy-enhanced embeds that only load and set cookies once you choose to play a video.
• Analytics and site improvement: Google Analytics 4 and Hotjar (see section 6).
• Internal management: Monday.com and Microsoft 365 (record-keeping and coordination). We never sell personal data. We may disclose information if required by law or a competent authority in Kenya.

5. Payments

Card and mobile-money details are entered directly with our payment providers, not on our servers. We receive confirmation of your name, email, amount, and reference so we can thank you and issue a receipt. Donation records are retained as required by Kenyan financial record-keeping obligations.

6. Cookies, analytics, and session recording

This website uses cookies and similar technologies, described in our Cookie Notice. Two disclosures we make prominently:

• Google Analytics 4 collects usage statistics to help us understand what visitors find useful.
• Hotjar may record anonymized interaction patterns (such as scrolling and clicking) to help us improve the site. We configure it to mask typed personal information in forms. You can accept or decline non-essential cookies through the cookie banner, and change your choice at any time.

7. International transfers

Some of our service providers store data outside Kenya (including in the United States and the European Union). Where this happens, we rely on the safeguards permitted under the Data Protection Act, 2019, including your consent and the providers’ contractual and security commitments.

8. How long we keep it

• Newsletter and concept-note contacts: until you unsubscribe or ask us to delete you.
• Inquiries and volunteer expressions of interest: up to 24 months after our last exchange.
• Donation and financial records: for the period required by Kenyan financial record-keeping obligations.
• Analytics data: per the retention settings of the tools, which we set to the shortest practical period.

9. Your rights

Under the Data Protection Act, 2019, you have the right to: be informed about how your data is used; access the data we hold about you; ask us to correct it; ask us to delete it; object to or restrict processing; data portability; and withdraw consent at any time. To exercise any of these, email concerns@greenleafkenya.org – we will respond within a reasonable time and without charge. If you are not satisfied, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya (www.odpc.go.ke).

10. Security

Access to personal data is limited to team members who need it for the purposes above, protected by access controls on our systems. No internet transmission is completely secure, but we take reasonable technical and organizational measures appropriate to our size and the data we hold.

11. Changes to this policy

We will post any changes on this page with an updated date. Significant changes will be highlighted on the website or communicated by email where appropriate.

12. Contact

Green Leaf Kenya
Kabondo, Rachuonyo East, Homa Bay County
P.O. Box 79 – 40223, Kadongo
hello@greenleafkenya.org (general)
concerns@greenleafkenya.org (data protection, legal & compliance)
Phone: +254 705 22 77 19