Privacy Policy

1. Who We Are

MwalimuCare Foundation ("we," "our," or "the Foundation") is a legally registered non-profit organization in Kenya dedicated to supporting public school teachers through holistic wellness programmes. We are the data controller for all personal data collected through this website, our contact form, and our programmes.

This Privacy Policy explains how we collect, use, store, and protect your personal information in compliance with the Kenya Data Protection Act, 2019 (No. 24 of 2019) ("DPA"), its General Regulations 2021, and Article 31 of the Constitution of Kenya, 2010 — which guarantees every person the right to privacy.

This policy applies to anyone who visits our website at www.mwalimucarefoundation.org, submits our contact or donation forms, or participates in our programmes.

2. What Personal Data We Collect

We collect only the minimum data necessary for the specific purpose it is needed — a principle called data minimization under the DPA.

2.1 Contact form

• Full name (first and last)
• Email address
• Phone number (optional)
• Organization or school name (optional)
• Your role (e.g. teacher, education officer)
• Subject and message content
• Enquiry type (e.g. general, partnership, volunteering)

2.2 Donation form

• Full name and email address
• Phone number (for M-Pesa processing)
• Donation amount and frequency
• Payment reference number (generated by Paystack — we do not store full card details)

2.3 Program participation

• Contact information and school details
• Employment information (teaching level, subject, years of service)
• Programme registration and attendance records
• Feedback and evaluation responses
• Information shared during counselling sessions (see Section 5 below)

2.4 Automatically collected data

When you visit our website, our hosting and analytics provider (Vercel Analytics) may collect anonymized technical data including:

• Browser type and version
• Operating system and device type
• Anonymized IP address (not linked to your identity)
• Pages visited and time spent on each page
• Date and time of visit
• Referring website or source

Vercel Analytics is a privacy-first, cookie-free analytics tool. No personally identifiable information is stored in our analytics data.

3. Our Lawful Basis for Processing

Under Section 30 of the Kenya Data Protection Act, 2019, we must have a lawful reason before processing any personal data. We rely on the following bases:

Where we rely on consent as our lawful basis, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of any processing carried out before you withdrew it.

4. How We Use Your Information

• To respond to your enquiries and deliver our programmes and services
• To coordinate counselling sessions, workshops, and retreat logistics
• To process your donations securely via Paystack
• To send you service-related communications (e.g. session reminders, receipts)
• To conduct programme impact evaluations and improve our services
• To meet our legal and regulatory obligations under Kenyan law
• To maintain records required for financial audits and donor reporting (using anonymized data where possible)

We will never use your personal data for unsolicited marketing, profiling, or sale to third parties.

6. Who We Share Your Data With

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

6.1 Service providers

• Paystack — our payment processor. Paystack processes donation transactions on our behalf and is subject to its own privacy policy and PCI-DSS compliance standards. We receive only a transaction reference — never your full card details.
• Google (Gmail/Workspace) — we use Gmail to receive and respond to contact form submissions. Google processes email data on our behalf under its data processing terms.
• Vercel Analytics — our website analytics provider. Vercel is cookie-free and processes only anonymized data.
• Nodemailer / SMTP — used to send automated email confirmations. Email content is transmitted over TLS-encrypted connections.

6.2 Qualified counselling professionals

Licensed counsellors and coaches engaged by the Foundation operate under signed confidentiality agreements and are bound by their professional ethical codes.

6.3 Legal requirement

We may disclose data when required by a valid court order, statute, or regulatory authority under Kenyan law. We will notify you of any such disclosure where permitted by law.

6.4 Aggregate anonymized data

We may share aggregated, anonymized data with funders, government partners, or the public for programme reporting purposes. This data cannot be used to identify any individual.

7. International Data Transfers

Some of our service providers (including Google and Paystack) may process data outside Kenya. Where this occurs, we ensure that appropriate safeguards are in place in accordance with Section 49 of the Kenya Data Protection Act, including:

• Transfers only to countries with adequate data protection laws, or
• Contractual clauses that require the recipient to protect your data to the same standard required under Kenyan law

8. How Long We Keep Your Data

We retain personal data only as long as necessary for the purpose it was collected, or as required by law:

After the retention period expires, data is securely deleted or anonymized so it can no longer identify you.

9. How We Protect Your Data

• All data transmitted to and from our website is protected by SSL/TLS encryption (HTTPS)
• Donation payments are processed by Paystack using PCI-DSS compliant infrastructure — we never store card numbers on our servers
• Access to personal data is restricted to authorized Foundation staff and counsellors on a need-to-know basis
• Our servers and databases are hosted on secure, access-controlled infrastructure
• We conduct regular security reviews and staff data protection training

While we take all reasonable measures to protect your data, no internet transmission is completely secure. If you believe your data has been compromised, please contact us immediately at mwalimucarefoundation@gmail.com.

10. Your Rights Under Kenyan Law

Under the Kenya Data Protection Act, 2019 (Sections 26–34), you have the following rights regarding your personal data:

To exercise any of these rights, contact our Data Protection Officer at:

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

11. Cookies and Tracking

Our website uses Vercel Analytics, a cookie-free, privacy-first analytics tool. Vercel does not set any tracking cookies and does not collect any personally identifiable information. No consent banner is required for our analytics because no cookies or personal data are involved.

If we introduce any additional cookies in future, we will update this policy and display an appropriate consent mechanism as required by the DPA.

12. Children's Privacy

Our website and services are directed at adult teachers and education professionals. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us immediately and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in Kenyan law. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website or services after changes are posted constitutes your acceptance of the updated policy.