Participant privacy policy Kenya

Ripple Effect Kenya is registered as a Data Controller with the Office of the Data Protection Commissioner, registration nuymber 294-3442-A1C1. It is also registered as an NGO under section 10 of the Non-Governmental Organizations Co-ordination Act in Kenya. Our parent organisation is Ripple Effect International, a charity registered in England and Wales with registration number 299717.

Ripple Effect Kenya and Ripple Effect International act as joint data controllers for the personal data covered by this notice where they jointly decide why and how that data is used. This means both organisations are responsible for ensuring that your personal data is handled lawfully and securely. Although both organisations jointly determine how certain personal data is used, participants should contact Ripple Effect Kenya in the first instance regarding any questions or requests.

We use personal data in accordance with the Kenya Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021. Where Ripple Effect International processes personal data in the United Kingdom, UK data protection law may also apply to that processing.

If you have any questions about this notice or how we process your personal data, please speak to your local extension officer, contact your local Ripple Effect Kenya office, or email dataprotection@rippleeffect.org.

Under Kenyan data protection law, you have rights in relation to your personal data, including:

• the right to be informed about how your personal data is used;
• the right to access personal data held about you;
• the right to correct false, inaccurate, misleading or outdated data;
• the right to ask us to delete personal data where the law allows;
• the right to ask us to restrict the processing of your personal data;
• the right to object to all or part of the processing of your personal data;
• the right to data portability, where this applies;
• the right not to be subject to a decision based solely on automated processing where that decision produces legal or similarly significant effects; and
• the right to withdraw consent where we rely on consent.

We do not use automated decision-making to make decisions that have legal or similarly significant effects on participants. If this changes, we will tell you and explain your rights.

We normally collect information directly from you, but in some cases we may receive limited information from community groups, partner organisations or public authorities where this is relevant to the project and permitted by law.

We collect personal data you provide as part of registration for a project and during your participation in project activities. This may include:

• your title, name and contact details, including postal address, email address, telephone number and mobile number;
• your location and GPS location data where needed for project visits, mapping, monitoring or reporting;
• training registration and attendance records;
• details of correspondence sent to you or received from you;
• survey responses and feedback;
• information about project activities, support provided, and project outcomes; and
• any other information you provide that is relevant to your relationship with Ripple Effect Kenya.

We may also collect sensitive personal data where it is relevant to the project and lawful to do so. This may include:

• property status;
• marital status;
• family details, including names of children, spouses, parents or guardians;
• sex 
• health information where relevant
• disability information
• safeguarding information
• other sensitive information that is relevant to project delivery, safeguarding, monitoring or reporting.

Where we collect sensitive personal data, we will explain why we need it and the lawful basis for using it. Where we rely on consent, you may refuse or withdraw consent, although this may affect activities that depend on that specific information.

We may collect limited information about children or family members where this is relevant to a project, for example for household information, safeguarding, eligibility, monitoring or impact assessment. We will only collect the information that is necessary for the stated purpose.

Where we collect personal data directly from or about a child, we will take appropriate steps to involve a parent, guardian or person with parental responsibility, unless the law allows or requires another approach. We will apply extra care when using children's data, images or stories.

Some personal data is required so that we can register you for a project, contact you, provide project support, carry out training, assess project progress, meet donor and audit requirements, or comply with law. If you do not provide information that is necessary for these purposes, we may not be able to register you for the project or provide the relevant support.

Other information is optional. This may include case studies, photographs, videos, detailed personal stories, testimonials, or sensitive personal data that is not essential for your participation. We will make clear when information is optional and what will happen if you choose not to provide it.

We may ask whether we can collect further information about why you are working with Ripple Effect Kenya, your experiences, and the progress you have made. This may include written stories, photographs, audio recordings or videos.

We will ask for your consent before using identifiable stories, images or videos. We will explain how the material may be used, including whether it may appear in donor reports, publications, social media posts, websites or other communications. You can withdraw consent for future use at any time by contacting us. Refusing consent for photographs or videos will not affect your participation in the project.

The information we keep is stored securely in local Ripple Effect Kenya offices and on secure systems used by Ripple Effect Kenya and Ripple Effect International. Some systems may be hosted on servers located in the European Union, the United Kingdom, or other countries where appropriate safeguards are in place.

We use security measures including access controls, permission-based access, multi-factor authentication, device protection, encryption in transit and at rest where appropriate, and staff confidentiality obligations. We restrict access to people who need the information for their work.

We do not sell, trade or rent your personal data. We may share personal data where this is lawful and necessary with:

• Ripple Effect International, where it supports project management, monitoring, reporting, governance or data protection compliance;
• donors, funders and partners, where this is necessary for project reporting, monitoring, safeguarding, auditing or accountability;
• service providers who process personal data on our behalf, such as secure database, IT, communications, storage, monitoring or evaluation providers;
• professional advisers, auditors, insurers or consultants where needed for governance, finance, audit, risk or legal purposes;
• public authorities, regulators, law enforcement bodies or courts where required by law or necessary to protect rights, safety or the public interest; and
• other organisations where you have consented to the sharing or where another lawful basis applies.

Where we use a data processor, we will put in place a written contract requiring the processor to act only on our instructions, keep personal data confidential and secure, use appropriate safeguards, and return or delete personal data when the processing ends unless the law requires otherwise.

Where donor or funder reporting can be done using anonymised or aggregated statistics, we will use that approach. We will only share identifiable personal data or sensitive personal data with donors, funders or partners where we have a lawful basis to do so and, where required, your consent.

Your personal data may be transferred outside Kenya to secure systems or service providers located in the European Union, the United Kingdom, or other countries. Ripple Effect International is based in the United Kingdom and may access project information where necessary for programme management, governance, monitoring, safeguarding, finance, audit and data protection compliance.

Where personal data is transferred outside Kenya, we will take steps required by Kenyan data protection law. This may include confirming that appropriate safeguards are in place, using written agreements with recipients, applying technical and organisational security measures, and obtaining consent where Kenyan law requires consent, including for certain transfers of sensitive personal data.

If we need to transfer your personal data to another country for a new purpose, we will consider whether the new purpose is compatible with the original purpose. Where it is not compatible, we will seek fresh consent unless another lawful basis applies.

We will keep personal data for no longer than is reasonably necessary for the purpose for which it was collected, including project administration, monitoring, evaluation, donor reporting, audit, safeguarding, legal, financial and accountability requirements.

We keep project participant information for the length of the Ripple Effect strategy period in which you first join a project, plus two more years. Our current strategy runs from 2020 to 2030, so information collected during this period will normally be kept until the end of 2032. We may keep it for longer if the law requires this, or delete it sooner if we no longer need it. At the end of the retention period, we will delete, anonymise or securely archive the data as appropriate. 

We will keep identifiable stories, case studies, images and videos for up to 6 years unless you have agreed to a different period, we need to keep them for a lawful reason, or you ask us to stop using them sooner. You can ask us to stop future use at any time.

We may keep historical information in anonymised form for research, impact analysis, learning and accountability. Anonymised information is no longer linked directly to you.

You can ask us whether we process personal data about you and request access to that personal data. This is sometimes called a subject access request.

To help protect your information, we may ask you to provide reasonable proof of identity before we respond. Please be as clear as possible about the information you are seeking.

We will respond to access requests within the time required by Kenyan law. Under the current Kenyan regulations, access requests should be complied with within 7 days of the request. We will tell you if an exemption applies or if we need further information to identify you or locate the data.

Access requests should be sent to your local Ripple Effect Kenya office or to dataprotection@rippleeffect.org. We will not charge a fee for responding to a request unless the law permits a fee in specific circumstances.

Please contact your local Ripple Effect Kenya office or dataprotection@rippleeffect.org if you want to update your information, ask us to restrict processing, object to processing, ask for deletion, request data portability, or withdraw consent.

We will deal with requests within the time required by Kenyan law. Under the current Kenyan regulations, requests to restrict processing, object to processing, or erase personal data generally require a response within 14 days.

We may need to keep certain information even after a request, for example where this is required for legal, audit, safeguarding, financial, donor accountability, dispute resolution, or record-keeping purposes. If we cannot fully comply with your request, we will explain why.

If you ask us to stop contacting you, we may keep enough information to record and respect that request in the future.

We only process personal data where we have a lawful basis under Kenyan data protection law. Different lawful bases may apply to different activities, as set out below.

We value feedback and you have the right to raise concerns about how we process your personal data. Please contact your local Ripple Effect Kenya office. The Data Protection officer is Titus Sagala or you can email dataprotection@rippleeffect.org.

You also have the right to lodge a complaint or seek advice from the Office of the Data Protection Commissioner in Kenya:

• Email: info@odpc.go.ke
• Postal address: P.O. Box 30920-00100, G.P.O Nairobi
• Telephone: 0796 954 269 / 0752 896 867
• Website: https://www.odpc.go.ke

You may contact us first if you would like us to try to resolve your concern before contacting the Office of the Data Protection Commissioner

We regularly review our privacy practices and this notice. We may make changes from time to time. Any changes made to the online version will be posted on our website and will apply from the time we post them. We will inform participants directly of significant changes where it is appropriate and practical to do so.

This participant privacy notice was last updated in July 2026.