Kelfon Foundation

Legal

Privacy Policy

Last updated: 18 September 2026

Kelfon Foundation (“Kelfon,” “we,” “us,” or “our”) is a youth-centered non-profit based in Nairobi, Kenya. This Privacy Policy explains how we collect, use, store, share, and protect personal information when you visit our website, contact us, volunteer, donate, partner with us, or otherwise engage with our programmes.

We are committed to handling personal data lawfully, fairly, and transparently, in line with the Constitution of Kenya, the Data Protection Act, 2019, the Data Protection (General) Regulations, 2021, and — where it applies — other laws such as the Children Act, 2022. Because we work with children and young people, we apply extra care to any information that could identify a child.

1. Who is responsible for your data

For personal data processed through this website and related enquiries, Kelfon Foundation is the data controller.

Programmes currently operate through FEBA Academy and community safe spaces. We do not yet operate a dedicated Youth Empowerment Center.

2. The information we collect

We may collect:

Information you give us. Name, email address, phone number, organisation, role, message content, donation or partnership interest, volunteer skills, and any files or details you choose to send.

Technical information. IP address, browser type, device information, pages visited, referring URL, and approximate location derived from IP. This site may use strictly necessary cookies or similar storage to keep the site working. We do not currently run advertising cookies.

Programme and community information. If you take part in a programme, we may keep attendance, scholarship or mentorship records, safeguarding notes, and (only with appropriate consent) photographs or stories. We will not publish identifiable photos of programme participants on this website until we have real programme photography and the required consents.

Children’s data. We do not knowingly collect personal data from children through this public website contact form. Programme data about children is collected through parents, guardians, schools, or authorised caregivers, with a lawful basis and, where required, consent.

Please do not send us sensitive information (health details, identity numbers, bank passwords, or a child’s full identifying story) through the public form unless we have asked you to do so through a secure channel.

3. Why we use personal information

We use personal information to:

  • Respond to enquiries, partnership requests, and volunteer offers
  • Provide, improve, and evaluate education, sports, and mentorship programmes
  • Process donations, grants, and sponsorships when those channels go live
  • Keep people safe, including safeguarding children and young people
  • Meet legal, accounting, audit, and reporting duties
  • Send updates you have asked for (you can opt out at any time)
  • Protect the organisation against fraud, abuse, or security incidents
  • Understand, in aggregate, how the website is used

Our lawful bases may include consent, performance of a contract or steps before a contract, compliance with a legal obligation, and legitimate interests that do not override your rights — for example, answering a donor enquiry or keeping basic security logs.

4. Sharing information

We do not sell personal information. We share it only when needed:

  • With service providers who host email, the website, or (later) payments, under appropriate agreements
  • With schools, mentors, or partners involved in a specific programme, and only as far as that programme requires
  • With professional advisers (legal, accounting) under confidentiality
  • When the law, a court, or a regulator requires us to do so
  • To protect a child or another person from serious harm
  • If we restructure the organisation, with successor entities bound by this policy

Online donation tools (M-Pesa, bank, or card processors) will have their own privacy notices once those details are published on the Get Involved page. We will not ask you to send Paybill or card secrets by email.

5. International transfers

Our website may be hosted on infrastructure outside Kenya (including cloud providers). Where personal data leaves Kenya, we will take steps required by Kenyan law, such as using providers with adequate safeguards or contractual protections.

6. How long we keep information

We keep personal data only as long as needed for the purpose it was collected, including legal retention for finance and safeguarding. Website enquiries that do not become an ongoing relationship are typically reviewed within 24 months. Safeguarding records may be kept longer where the law or a child’s safety requires it.

7. Security

We use reasonable technical and organisational measures to protect personal data. No method of transmission over the internet is completely secure. Please use kelfonfoundation@gmail.com for official correspondence, and tell us promptly if you think your information has been misused.

8. Your rights

Subject to the Data Protection Act, 2019, you may have the right to: be informed; access your data; object to processing; correction; deletion; restriction; data portability; and not to be subject to automated decision-making that significantly affects you. We do not use automated decision-making on this website.

To exercise these rights, email kelfonfoundation@gmail.com with enough detail for us to find your information. We may need to verify your identity. You may also complain to the Office of the Data Protection Commissioner (ODPC) in Kenya if you are not satisfied with our response.

9. Cookies and similar technologies

We may use essential cookies or local storage so the site functions (for example, to remember a form state). Analytics, if added later, will be described here and, where required, will only run with consent. You can control cookies in your browser settings.

10. Photographs and stories

Images currently shown on this website are generic, representative stock photographs. They do not depict specific Kelfon programme participants. When we publish real programme photos, we will obtain appropriate consent (including from a parent or guardian for children) and will not share a child’s full name, school, or home address alongside an identifying image unless we have a clear reason and consent to do so.

11. Third-party links

Our site may link to schools, partners, or social networks. Their privacy practices are their own. Official Kelfon social accounts will be linked here once they are confirmed.

12. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date will change when we do. Material changes will be highlighted on this page.

13. Contact

Questions about privacy, data, or this policy: kelfonfoundation@gmail.com or +254 113 272 461. Postal correspondence may be directed to Kelfon Foundation, Nairobi, Kenya, via the same email until a public street address is published.