Privacy Policy

1. Introduction

Caritas of Hope Foundation ("we", "us", "the Foundation") is committed to protecting the privacy and personal data of everyone who interacts with our website, programmes, and services. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over it.

This policy is written to comply with Kenya's Data Protection Act, 2019, and the regulations issued under it by the Office of the Data Protection Commissioner (ODPC).

2. Who We Are

Caritas of Hope Foundation is a Kenya-registered non-governmental organisation based in Nairobi, working across health, education, humanitarian aid, inclusivity, and environmental sustainability. Contact details for privacy-related questions are listed in Section 10 below and on our Contact page.

3. What Personal Data We Collect

We collect personal data when you interact with our website and services, including:

• Contact enquiries: your name, email address, phone number, organisation (if given), and the content of your message.
• Donations: your name, email, phone number, donation amount, payment method, and a payment reference (such as an M-Pesa confirmation code or card transaction reference). We do not store your full card number — card payments are processed directly by our payment partners (see Section 6).
• Volunteer, internship, and job applications: your name, email, phone number, age (for volunteer applications), location, education, work experience, motivation statement, and your CV/résumé file if you upload one.
• Event registrations: your name, email, phone number, number of attendees, and any notes you provide (e.g. dietary or accessibility needs).
• Newsletter sign-up: your name, email address, and stated interests.
• Technical data: your IP address and submission timestamps, collected automatically for basic security purposes such as preventing spam and abuse of our forms.

4. How We Use Your Data

We use personal data only for the purposes for which it was collected, including to:

• Respond to enquiries and provide the information or assistance requested;
• Process, verify, and issue receipts for donations;
• Review and manage volunteer, internship, and job applications;
• Register and coordinate attendance at events;
• Send newsletters or programme updates, but only to people who have separately opted in to receive them;
• Maintain the security and proper functioning of our website;
• Meet legal, regulatory, and reporting obligations.

5. Legal Basis for Processing

We process personal data on the basis of: your consent (given at the point of submitting a form on our website); the performance of a contract or arrangement with you (for example, coordinating your volunteer placement); and our legitimate interests in operating and securing our website and services, balanced against your rights and freedoms.

Where consent is the basis for processing, you may withdraw that consent at any time by contacting us, without affecting the lawfulness of processing carried out before withdrawal.

6. Third-Party Service Providers

We share limited personal data with trusted third parties strictly as needed to provide our services, including:

• Payment processors (PayPal, Flutterwave, and/or Pesapal) to process card and mobile-money donations. These providers have their own privacy policies governing how they handle your payment details.
• Email delivery services used to send confirmation emails, receipts, and newsletters.

We do not sell personal data to third parties for marketing purposes.

7. Data Retention

We retain personal data only for as long as necessary for the purpose it was collected, or as required by law (for example, financial records related to donations may be retained for accounting and audit purposes). Unsuccessful volunteer, internship, and job applications are retained for a reasonable period to allow for follow-up on future opportunities, after which they are deleted or anonymised.

8. Your Rights

Under the Data Protection Act, 2019, you have the right to:

• Be informed of how your data is being used;
• Access the personal data we hold about you;
• Request correction of inaccurate or outdated data;
• Request deletion of your data, subject to any legal retention obligations;
• Object to or restrict certain processing of your data;
• Withdraw consent at any time, where processing is based on consent;
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your data has been mishandled.

To exercise any of these rights, please contact us using the details in Section 10.

9. Children's Privacy

Our volunteer programme has a minimum age requirement. We do not knowingly collect personal data from children below the applicable minimum age without appropriate parental or guardian involvement. If you believe a child has provided us with personal data inappropriately, please contact us so we can address it.

10. Data Security

We apply reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including secure password storage, access controls for our administrative systems, and server-side verification of payments. No system can be guaranteed completely secure, but we work to keep your data safe.

11. Cookies

Our website uses only essential cookies required for core functionality, such as keeping an administrator signed in. We do not currently use third-party advertising or tracking cookies. If this changes, we will update this policy accordingly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Each version is dated and archived, and any form on our website that asks for your consent will record which version of this policy was in effect at the time. We encourage you to review this page periodically.

13. Contact Us

If you have questions about this Privacy Policy or how we handle your personal data, please get in touch using the details on our Contact page.

Looking for the notice specifically for volunteer, internship, or job applicants? See our Applicant Privacy Notice.

Want to exercise your data rights directly? Use our Data Protection Request form.