Privacy Policy.
How we process and protect your data in accordance with the Data Protection Act 2019.
Introduction
Background
In the current world, information has increasingly become a critical resource that has to be managed carefully. Generally, much of today’s information consists of personal and sensitive data relating to persons. As a result, the transformative developments in the current economy are presenting major concerns for privacy in the way information is processed; including data collection, handling, storage, sharing and destruction. On a daily basis, vast amounts of data are collected, transmitted and stored by ever growing computing and communication technologies.
On this premise, Article 31 of the Constitution of Kenya dictates that every person has a right to privacy. To further give effect to this Article, the Data Protection Act 2019 was passed in November 2019 to govern the collection and processing of personal data.
The Network for Adolescent and Youth of Africa (NAYA) is committed to processing data in accordance with the law, while still ensuring that all information of Stakeholders in its position is handles with utmost care and confidentiality. It is therefore apparent for NAYA to have a Data Protection policy to ensure responsible, purposeful, secure, transparent and time-bound processing of data subjects’ personal data. The fundamental principles of this policy have been largely informed by the DPA and, to the acceptable and constitutional degrees, International Laws on Data Protection and Privacy.
Purpose of the policy
This policy is intended to mainly ensure that NAYA complies with the DPA in the processing of data.
The objectives of the policy are:
- To provide guidance on how NAYA will process data;
- To protect the rights of prospective employees, partners, beneficiaries, clients, and suppliers;
- Safeguard NAYA from any risks of data breaches.
Scope of the policy
This Policy is intended to provide minimum standards with respect to the protection of personal data that we collect, process and store and will cover the use of personal data about all individuals, including consumers, employees, customers, stakeholders and other third parties, that deal with NAYA.
Every employee of NAYA has a duty to maintain the confidentiality and trust of the data subjects that share their personal data with the Company. Compliance with the Policy is mandatory and any breach of this Policy and related policies and procedures shall result in disciplinary action.
These conditions apply to all NAYAs’ activities in relation to information, recommendations, research interventions, documents and services. Please refer to the disclaimer on our website.
Definitions
| Consent | The Express, freely given and unequivocal indication of the data subject's wishes by a statement or by a clear affirmative action, signifying agreement to the processing of personal data relating to them. |
|---|---|
| Data | Information which is processed by equipment, recorded for processing, forms part of a filing system, or held by a public entity. |
| Data Controller | A natural or legal person, public authority, agency or other body which determines the purpose and means of processing of personal data. |
| Data Processor | A natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller. |
| Data Subject | An identified or identifiable natural person who is the subject of personal data |
| Data Transfer | All acts that make personal data accessible to third parties outside of NAYA on paper, via electronic means, on internet or through other means. |
| Personal data | Any information relating to an identified or identifiable natural person. |
| Personal data breach | A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. |
| Processing | Any operation or sets of operations which is performed on personal data whether or not by automated means. |
| Sensitive personal data | Data revealing race, health status, ethnic social origin, conscience, belief, genetic/biometric data, property details, marital/family status, sex or sexual orientation. |
| Third Party | A natural or legal person, public authority, agency or other body, other than the data subject, data controller, data processor or authorized persons. |
Data Protection Principles
Any data processing by NAYA shall be based on:
1.1. Privacy principle
In any data processing, NAYA shall endeavour to protect the privacy of the data subject, by anonymising where possible and, in consistency with the purpose for which the data is being processed, hiding the identity of the data subject.
1.2. Legality and legitimacy principle
Collection of personal data shall be only for legal and legitimate reasons, for which NAYA shall explain the specific purpose to the data subject.
1.3. Purpose limitation principle
Utilization of any data collected from a data subject shall be limited to the purpose for which it was collected. Employees and agents of NAYA shall not process data for a new and/or different purpose that is not compatible with the original purpose.
1.4. Data minimisation principle
An employee/ agent of NAYA will ensure that they collect only personal data that is adequate, proportional and relevant for the legitimate purpose of collection.
Rights of a Data Subject
At all times in the processing of data, NAYA shall respect the rights of a data subject under the DPA, which include:
- Right to be informed on the purpose for collection of their personal data and how their personal data will be processed;
- Right to access a copy of their personal data in NAYA’s possession.
- Right to withdraw their consent at any time without reason.
- Right to rectification: the right to correct inaccurate personal data;
- Right to erasure (right to be forgotten).
- Right to restrict processing.
- Right to data transfer to a third party.
- Right to object to direct marketing.
- Right to be notified of a personal data breach.
- Right to complain to the Data Commissioner.
Data Collection & Impact
3. Data Collection
When collecting personal data from the data subject, NAYA shall inform the data subject of the specific purposes for processing, third-party transfers, data subject rights, and controller details.
4. Data Protection Impact Assessments
NAYA shall conduct periodic Data Protection Impact Assessments to ensure compliance with the DPA, especially when using new technology or systematic profiling that results in a high risk to rights and freedoms.
Retention and Disposal
5. Data Retention
Data shall not be stored in a form that allows data subjects to be identified for longer than needed for its legitimate purposes. Retention purposes include legal, contractual, accounting, reporting requirements, or prospect of litigation.
A designated employee or agent of NAYA shall ensure that personal data is destroyed, deleted or anonymised where such data is no longer needed.
Transfers to Third Parties
6. Transfer of Personal Data
NAYA may only transfer personal data to third parties on condition that the third party affords a level of data protection comparable to this Policy. Risks are mitigated by stripping identifiable information and ensuring legitimate bases (consent, law, contractual obligations) exist.
7. Data Transfer Records & Agreements
NAYA shall keep full records reflecting all phases of the data management cycle. NAYA shall require all third parties to comply with this Policy through an agreement or MOU.
Data Breach
NAYA’s staff and volunteers shall notify the administrators as soon as possible upon becoming aware of a personal data breach. If a personal data breach is likely to result in personal injury or harm, the data controller will communicate the breach to the data subject and take mitigating measures without undue delay.
Roles, Review, and Children
10. Roles and Responsibilities
All staff, volunteers, and agents must read, understand, and comply with this policy, report breaches, and ensure third parties are aware of these contents.
14. Collection of Personal Data on Children
NAYA recognizes that processing children’s data carries inherent risks. As minors lack the legal capacity to provide informed consent, NAYA has implemented robust safeguards to ensure children’s privacy and data security.
Contact Us
If you have any questions after reading our privacy statement, wish to view the personal data we have filed, or if you wish to rectify data or have data deleted, please contact us:
Data Protection Officer (DPO)
Email: daniel.odeke@nayakenya.org
