Privacy Policy

Effective Date: 17 MAR 2026

Last Updated: 16 MAR 2026

1. Introduction

Elimisha Watoto foundation (‘’Elimisha.’’ ‘’We’’ ‘’Our’’, or ‘’Us’’) Is committee to protecting the privacy, dignity and personal data of beneficiaries, parents, partners, donors, staff, volunteers and website users.

As an organization working primarily with learners, we recognize or heightened duty of care in collecting, processing, storing and protecting personal data responsibly lawfully and securely.

This Privacy Policy explains how we collect, uses store, disclose, transfer and protect personal data in compliance with the Kenya Data Protection Act (2019) and applicable regulations issued by the office of Data Protection Commissioner (ODPC).

2. Scope of This Policy

This Policy applies to:

  • Beneficiaries (Students)
  • Parents and Guardians
  • Donors and Sponsors
  • Volunteers and Partners
  • Staff and consultants
  • Visitors to our website
  • Individuals interacting with Elimisha through digital and physical platforms

3. Information We Collect

We collect personal data that is necessary, relevant and proportionate for our lawful activities, including program implementation, scholarship administration, safeguarding, reporting communication and website administration.

The categories of Personal data we may collect include:

A. Personal Identification Information

  • Full names;
  • National ID, Passport number or Birth certificate where applicable;
  • Date of Birth;
  • Gender;
  • Contact Information (Phone, Email, Address)

B. Educational Information

  • Academic transcript, examination results and performance records;
  • School enrolment and attendance details;
  • Institutional placement course information.

C. Financial Information

  • Fee structure and invoices;
  • Payment records;
  • Sponsorship and scholarship information;
  • Financial background information

D. Vulnerability & Welfare Data

  • Household composition and background information;
  • Health- related information, – (Where relevant, safeguarding or accommodation needs;)
  • Social economic background;
  • Safeguarding notes.

E. Media Content (With Consent)

  • Photographs;
  • Video recording;
  • Hand written notes
  • Testimonials; and
  • Case studies

F. Website Usage Data

  • IP address
  • Browser Type
  • Device and usage information
  • Page visited; and
  • Cookie and related technologies (where applicable)

We collect only data that is necessary, relevant, and proportionate.

4. Lawful Basis for Processing

We process personal data only where there is lawful basis for doing so. Depending on the nature of data and purpose of processing, we may rely on one on more of the following lawful bases:

  • The data subject’s consent
  • Performance of a contract or steps taken at the request of the data subject prior entering into a contract
  • Compliance with a legal or regulatory obligation.
  • Legitimate interests pursued by Elimisha, provided that such interests are not overridden by the rights and freedoms of data subject.
  • Protection of the vital interests of the data subject or another person (especially in safeguarding matters)

5. How We Use Personal Data

We use personal data strictly for:

  • Scholarship administration and beneficiary support;
  • Academic monitoring and reporting.
  • Mentorship and psychological support;
  • Beneficiary eligibility assessment and verification
  • Supporter reporting accountability and impact measurements;
  • Program evaluation and organizational learning and;
  • Communication and stakeholders

We do not sell personal data.

6. Child Safeguarding & Protection of Minors’ Data

Elimisha works directly with children and young people. We apply enhanced safeguards to all minors’ data.

A. Parental/Guardian Consent

Written consent is required before collecting or processing a minor’s personal data.

B. Limited Use

Children’s data is used solely for program delivery, safeguarding and reporting.

We do not process data for commercia marketing purposes.

C. Media Protection

Photographs, video, stories, testimonials and similar content featuring children will only be used where appropriate consent has been obtained and where such use does not compromise the child’s dignity, privacy, safety and best interests. Where consent is not granted, identifying features will be removed, obscured or omitted.

D. Safeguarding Integration

Any safeguarding concern identified during data collection, assessment, monitoring and engagement will be handled in accordance with Elimisha’s Child Protection Policy, Safeguarding procedures and applicable law. In all cases, child protection considerations take priority over publicity, documentation or communication objectives.

7. Data Sharing & Disclosure

We may share personal data only where such sharing is lawful, necessary and proportionate for the relevant purpose. Depending on the circumstances, personal data may be shared with:

  • Accredited schools and institutions
  • Partner universities (Local and international)
  • Donor and sponsors (In summary or anonymized form)
  • Regulatory authorities where required by law.
  • Service providers assisting with data management (Under strict confidentiality agreements)

We do not share personal data without lawful justification.

8. Cross-Border Data Transfers

Where personal data must be transferred outside Kenya, including in connection with international institution scholarship partners, donors or service providers, Elimisha shall ensure that such transfer is carried out in accordance with applicable data protection law.

Where required we will ensure that appropriate safeguards are in place, including lawful transfer mechanisms data sharing controls, confidentiality obligation and reasonable security protections.

9. Data Retention

We retain personal data only for a long as is reasonably necessary for the purpose for which it was collected including for:

  • Program administration and beneficiary support.
  • Legal and regulatory compliance;
  • Reporting and audit obligations;
  • Safeguarding and accountability requirements; and
  • Institutional record- keeping
  • Retention periods my vary depending on the nature of data and purpose of processing. Once personal data is no longer required, it will be securely deleted, destroyed, anonymized or archived in accordance with application law and internal retention practices. Data will be stored for only for as long as necessary.

10. Data Security Measures

We implement reasonable technical and organizational measures to protect data against loss, misuse, unauthorized access, alteration, disclosure or distraction

  • Password- protected systems and databases
  • Restricted Staff access
  • Confidentiality obligations for staff and relevant service providers
  • Secure physical and electric document storage
  • Encrypted digital records where applicable
  • Internal procedures for handling and safeguarding sensitive information

Access to sensitive personal data is limited to authorized personal who may access sensitive information or legitimate purposes.

11. Data Subject Rights

Under the Kenya Data Protection Act 2019 individuals have the rights to

  • Be informed about the use of data
  • Access their personal data
  • Request correction of inaccurate or incomplete personal data
  • Object to certain types of processing
  • Request the deletion where legally permissible
  • Request withdrawal where consent is available
  • Lodge a complaint with the office of the data protection commissioner requests relating to personal data may be submitted through our official contact details provided data may be submitted though our official contact details provided in this Policy. We may take responsible steps to verify the identity of the person making the request before acting on it.

12. Data Breach Response

In the event of personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, Elimisha will take appropriate action in accordance with applicable law, including;

  • Containing and assessing the breach
  • Affected individuals will be notified where required by law
  • The breach will be reported to the Office of Data Protection Commissioner within legally prescribed timelines
  • Corrective measures will be implemented immediately.

13. Cookies & Website Analytics

Our website may use cookies and similar technologies to support website functionality, improve user experience and analyze website traffic.

For more information on how cookies are used and how users may manage their preferences, please refer to our cookie policy.

14. Organizational Accountability

Elimisha Watoto Foundation maintains:

  • Internal data protection procedures;
  • Structed consent documentation;
  • Beneficiary database with controlled access;
  • Safeguarding reporting and escalation mechanism; and
  • Periodic compliance monitoring and review practice.

Privacy, dignity and safeguarding are integral to our institutional integrity and operational responsibilities.

15. Policy Updates

We my mend or update the Privacy policy from time to reflect changes in law, regulatory requirements operational needs, technology or organization practice.

The update version will be posted on our website with revised “Last Updated” date.

16. Contact Information

For questions, concerns or data access requests, please contact:

Elimisha Watoto Foundation
Email: info@elimishawatoto.org
Phone: +254753343152
Website: www.elimishawatoto.org

Elimisha Watoto Foundation
Well -rounded education for an empowered generation.