Who we are
Harambee is operated by [Legal company name] (“Harambee”, “we”, “us”). We are the data controller for the personal data described here, and are registered with the Office of the Data Protection Commissioner (ODPC) of Kenya under number [ODPC registration no.]. This policy explains how we handle your personal data under the Kenya Data Protection Act, 2019.
What we collect
The data we collect depends on how you use Harambee:
- Account details: your name, email address, phone number and password.
- Campaign details: the title, story, photos and videos you upload, and the beneficiary’s details where relevant.
- Verification details: ID documents and proof such as invoices, which organisers may be asked to provide.
- Payment details: M-Pesa number, card or bank details, and donation amounts. Card details are handled by our payment partners.
- Usage data: device type, browser, IP address, pages visited and approximate location.
- Messages: what you send to our support team.
How we use your data
We use personal data to:
- create and manage your account and campaigns;
- process donations and send payouts;
- verify identities and review campaigns to prevent fraud;
- send receipts, updates and service messages;
- improve the platform and fix problems; and
- meet our legal obligations.
We rely on your consent, the need to deliver our service to you, our legal obligations, and our legitimate interest in keeping the platform safe. Where we rely on consent, you can withdraw it at any time.
What is public and what is private
Because campaigns are meant to be shared, some information is public by design.
Organisers can see the names of donors who did not give anonymously. Only Harambee sees anonymous donors’ details, and only where needed for fraud checks or the law.
Sending data outside Kenya
Some of our providers, such as cloud hosts, may store data outside Kenya. When we transfer personal data abroad, we make sure there are appropriate safeguards in place as required by the Data Protection Act, or we ask for your consent where required.
How long we keep your data
We keep personal data only as long as we need it. Account and campaign data is kept while your account is active. Financial and verification records are kept for [X] years after a campaign ends to meet legal and audit requirements. After that, we delete or anonymise the data.
Keeping your data safe
We use encryption in transit, access controls and staff training to protect your data, and we limit who can see sensitive documents. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the Data Commissioner within the time the law requires.
Your rights
Under the Data Protection Act, you have the right to:
To use any of these rights, email privacy@harambee.co.ke. We may need to confirm your identity first, and will reply within the time allowed by law. Some data, such as financial records, we must keep even after you ask us to delete your account.
If you are unhappy with how we have handled your data, you can complain to the Office of the Data Protection Commissioner of Kenya.
Children
Harambee is for people aged 18 and over. We do not knowingly collect data from children through accounts. Where a campaign is about a child, we ask the organiser to have the permission of a parent or guardian and to share only what is needed.
Changes to this policy
We may update this policy from time to time. If we make an important change, we will tell you by email or on the platform before it takes effect. The date at the top shows when it was last updated.
Contact us
Questions about your privacy? Contact our Data Protection Officer, [DPO name], at privacy@harambee.co.ke. Our registered address is [Registered address, Nairobi, Kenya]. You can also read our Terms of Service.