Privacy Policy

Last updated: November 3, 2026

The Tom Nthiwa Foundation ("we", "us") is committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have. It applies to our website, donation platform, volunteer applications, and any related services.

1. Data We Collect

We collect only what we need to operate the Foundation. This may include:

  • Contact details — name, email address, phone number (when you contact us or sign up for updates).
  • Donation data — amount, currency, and transaction reference. We do not store full card numbers; payment details are handled by our payment processor.
  • Volunteer data — information you provide in applications, including skills and availability.
  • Technical data — IP address, browser type, device type, and pages visited, collected via cookies and analytics.
  • Communications — messages you send us via email, contact forms, or social media.

2. How We Use Your Data

  • Process donations and issue receipts;
  • Respond to enquiries and provide requested information;
  • Manage volunteer applications and coordination;
  • Send updates and newsletters (only with your consent);
  • Improve our website and services through aggregated analytics;
  • Comply with legal, tax, and regulatory obligations;
  • Prevent fraud and secure our systems.

3. Legal Bases for Processing

Where required by law (including the Kenya Data Protection Act, 2019 and the EU/UK GDPR), we rely on one or more of the following legal bases:

  • Consent — for marketing emails and non-essential cookies;
  • Contract — to process donations and volunteer agreements;
  • Legal obligation — to keep financial records;
  • Legitimate interests — to operate and secure our services.

4. Sharing Your Data

We do not sell your personal data. We may share it with trusted service providers who help us operate, including:

  • Payment processors (e.g., Stripe, M-Pesa, PayPal);
  • Email and communications providers;
  • Website hosting and analytics providers;
  • Professional advisers (legal, accounting);
  • Authorities, where required by law.

All processors are bound by contracts requiring them to protect your data and to use it only for the purposes we specify.

5. International Transfers

Some of our service providers are based outside Kenya. Where we transfer data internationally, we ensure appropriate safeguards (such as standard contractual clauses) are in place.

6. Data Retention

We retain personal data only as long as necessary: donation records for as long as required by tax law (typically 7 years), volunteer data for the duration of engagement plus a reasonable period, and marketing data until you unsubscribe. Analytics data is retained in aggregated form.

7. Your Rights

Subject to applicable law, you have the right to:

  • Access the personal data we hold about you;
  • Request correction of inaccurate data;
  • Request deletion of your data;
  • Object to or restrict processing;
  • Request a portable copy of your data;
  • Withdraw consent at any time (for consent-based processing);
  • Lodge a complaint with your local data protection authority.

To exercise any of these rights, email info@tnf-ke.org. We will respond within 30 days.

8. Security

We use industry-standard measures — including TLS encryption, access controls, and regular backups — to protect your data. No system is perfectly secure; if you suspect any issue, please contact us immediately.

9. Children's Privacy

Our Services are not directed at children under 18. We do not knowingly collect personal data from children except as part of a supervised program with verified parental consent.

10. Cookies

We use cookies and similar technologies. See our Cookie Policy for details and how to manage your preferences.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be posted here with a revised "Last updated" date.

12. Contact

Data Controller: Tom Nthiwa Foundation, Kenya.
Email: info@tnf-ke.org