Privacy Policy

1. Introduction

New Dawn Media Services ("we", "us" or "our"), the operator of NGOs Eastern Africa Directory available at https://ngoseadirectory.org (the "Website"), is committed to protecting the privacy and security of the personal data of every person who interacts with us. We are a data controller within the meaning of the Data Protection Act, 2019 (No. 24 of 2019) of the Laws of Kenya (the "Act").

This Privacy Policy explains the personal data we collect, how and why we collect it, how we use and share it, how long we keep it, and the rights available to you as a data subject. It applies to all visitors, registered users, NGOs, businesses and other organisations that access the Website or use our services.

By accessing or using the Website, or by submitting your personal data to us, you acknowledge that you have read and understood this Privacy Policy. Where the Act requires your consent, we will seek your clear and unambiguous consent before processing your personal data.

2. Who We Are

For the purposes of the Act, the data controller responsible for your personal data is New Dawn Media Services, the operator of NGOs Eastern Africa Directory.

Our registered office, contact details and the contact details of our Data Protection Officer are set out in the "Contact Us" section below.

3. Definitions and Interpretation

Key terms used in this Privacy Policy have the meanings given to them under the Act, including:

• Personal Data: any information relating to an identified or identifiable natural person.
• Processing: any operation performed on personal data, such as collection, storage, use, disclosure, transfer or deletion.
• Data Subject: an identified or identifiable natural person to whom personal data relates.
• Sensitive Personal Data: personal data revealing race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details including names of children, parents or spouse, sex or sexual orientation.
• Data Controller: a person who, alone or jointly with others, determines the purpose and means of processing personal data.
• Data Processor: a person who processes personal data on behalf of a data controller.
• ODPC: the Office of the Data Protection Commissioner established under the Act.

4. Personal Data We Collect

We may collect the following categories of personal data:

• Identity and contact data: name, email address, telephone number, postal address and organisation name.
• Organisation data: the name, mission, registration details, address, contact person and other details of an NGO or business submitted for listing in the directory.
• Account data: login credentials and profile information where you create an account with us.
• Transaction and payment data: details of the services you request or purchase from us and related billing information.
• Communications data: the content of messages, enquiries, comments or feedback that you send to us.
• Technical and usage data: IP address, browser type and version, device type, operating system, pages visited and the time spent on the Website.
• Marketing data: your preferences in receiving marketing communications from us.

We do not intentionally collect Sensitive Personal Data. If you provide us with Sensitive Personal Data, you consent to us processing it for the purposes described in this Privacy Policy.

5. How We Collect Your Personal Data

We collect personal data in the following ways:

• Directly from you, when you complete a form, create an account, submit an NGO or organisation listing, subscribe to our newsletter, order the directory ebook, or contact us by email, telephone or through the Website.
• Automatically, when you visit the Website, through cookies, server logs and similar technologies.
• From third parties, such as partners and service providers that help us verify listings or operate the Website, where they are lawfully permitted to share the data with us.

6. Lawful Basis for Processing

We only process your personal data where we have a lawful basis to do so, as required by section 30 of the Act. The lawful bases we rely on include:

• Consent: where you have given us clear, specific and unambiguous consent to process your personal data for one or more specified purposes, such as receiving marketing communications.
• Performance of a contract: where processing is necessary to provide you with a service you have requested, such as listing your organisation in the directory.
• Compliance with a legal obligation: where processing is necessary to comply with a legal requirement to which we are subject.
• Protection of your vital interests: or those of another person.
• Public interest: where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
• Legitimate interests: where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your fundamental rights and freedoms.

7. How We Use Your Personal Data

We process your personal data for the following purposes:

• To provide, operate, maintain and improve the Website and our services.
• To create and manage your account and to verify your identity.
• To publish, manage and verify NGO and business listings in the directory.
• To process orders, payments and requests for the directory ebook and other services.
• To respond to your enquiries and to provide customer support.
• To send you administrative messages, service updates and information about your account.
• To send you newsletters, promotional materials and other marketing communications where you have consented, or where otherwise permitted by law.
• To monitor usage, analyse trends and improve the usability and security of the Website.
• To detect, prevent and investigate fraud, abuse and other unlawful activity.
• To comply with applicable laws, regulations and lawful requests from public authorities.

8. Sharing and Disclosure of Your Personal Data

We do not sell or rent your personal data. We may share your personal data with:

• Service providers and data processors: such as website hosting providers, email and communication providers, payment processors and analytics tools that process personal data on our behalf and only on our documented instructions.
• Directory users and the public: where you submit an NGO or business listing, the information intended for publication may be displayed to, and accessed by, visitors to the Website.
• Professional advisers: such as lawyers, auditors and insurers, where necessary.
• Regulators and law enforcement: such as the ODPC or other public authorities, where we are required to do so by law or where necessary to protect our rights, property or the safety of our users.
• Successors in title: in connection with a merger, acquisition, restructuring or sale of assets, in which case we will require the recipient to honour this Privacy Policy.

Where we engage a data processor, we enter into a written contract requiring the processor to implement appropriate technical and organisational measures to protect your personal data and to process it only in accordance with our instructions.

9. Cross-Border Transfers

Some of our service providers may store or process personal data outside Kenya. Where we transfer personal data outside Kenya, we do so in accordance with sections 48 to 50 of the Act. This means we will only transfer your personal data where the recipient country has an adequate level of data protection, where appropriate safeguards are in place, where you have given your consent, or where the transfer is otherwise permitted by the Act.

10. Data Retention

We retain personal data only for as long as it is necessary to fulfil the purposes for which it was collected, to comply with legal, tax and accounting obligations, to resolve disputes and to enforce our agreements. When personal data is no longer needed, we securely delete it or anonymise it. The retention period may vary depending on the nature of the data and the purpose of processing.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include, where appropriate, encryption, access controls, staff training and secure hosting. While we take reasonable steps to protect your personal data, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

12. Your Rights as a Data Subject

Subject to the Act, you have the following rights in relation to your personal data:

• Right to be informed: to be informed of the use to which your personal data is to be put.
• Right of access: to request access to a copy of the personal data we hold about you.
• Right to rectification: to request the correction, updating or completion of inaccurate or incomplete personal data.
• Right to erasure: to request the deletion or destruction of personal data where we no longer have a lawful reason to keep it.
• Right to object: to object to the processing of your personal data, including for direct marketing purposes.
• Right to restriction of processing: to request that we restrict the processing of your personal data in certain circumstances.
• Right to data portability: to receive your personal data in a structured, commonly used and machine-readable format, and to transmit it to another data controller where technically feasible.
• Right not to be subject to automated decision-making: including profiling, where the decision has a legal or similarly significant effect on you.
• Right to withdraw consent: to withdraw any consent you have given at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please contact us using the details in the "Contact Us" section below. We will respond within the timelines set out in the Act and may need to verify your identity before actioning your request.

13. Cookies and Similar Technologies

The Website uses cookies and similar technologies to ensure it functions properly, to remember your preferences and to help us understand how the Website is used. You can control or disable cookies through your browser settings, although disabling some cookies may affect the functionality of the Website. Where required by law, we will obtain your consent before using non-essential cookies.

14. Children's Personal Data

The Website and our services are intended for adults and organisations. We do not knowingly collect personal data from children. Under the Act, a child is a person under the age of eighteen (18) years. Where we become aware that we have collected personal data from a child without the required parental or guardian consent, we will take steps to delete it as soon as reasonably practicable. If you believe that a child has provided personal data to us, please contact us.

15. Marketing Communications

Where you have provided your consent, or where we are otherwise permitted to do so, we may send you newsletters, updates and information about our services. You can opt out of receiving marketing communications at any time by following the unsubscribe instructions in our emails or by contacting us directly. Even after you opt out of marketing, you may continue to receive non-promotional communications, such as service updates and account-related notices.

16. Third-Party Links

The Website may contain links to third-party websites, plugins and applications that are not operated by us. We are not responsible for the privacy practices or the content of those third parties. We encourage you to read the privacy policies of any third-party website you visit.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal and regulatory requirements. When we make material changes, we will post the updated Privacy Policy on the Website and update the "Last Updated" date at the top of this page. We encourage you to review this Privacy Policy periodically.

18. How to Lodge a Complaint

If you believe that we have not complied with the Act in the way we have handled your personal data, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC). We would appreciate the opportunity to address your concerns first, so please contact us using the details below before escalating your complaint.