Privacy Policy

Effective Date: 1 August 2026
Last Updated: 1 August 2026

Sustainable Initiatives Development Enhancement in Communities (SIDEC) (“SIDEC”, “we”, “us”, or “our”) respects your privacy and is committed to protecting the personal information entrusted to us.

This Privacy Policy explains how we collect, use, store, protect, and disclose personal information when you visit or interact with our website, https://sidec-ke.org, communicate with us, subscribe to our communications, or use services and features made available through our website.

SIDEC is a community-focused organisation operating in Laikipia County, Kenya. We seek to handle personal information responsibly and in accordance with applicable data protection and privacy laws, including the Kenya Data Protection Act, 2019, applicable regulations and, where applicable, the European Union General Data Protection Regulation (EU) 2016/679 (GDPR).

1. Who We Are

Sustainable Initiatives Development Enhancement in Communities (SIDEC)
Laikipia County, Kenya

Email: info@sidec-ke.org
Website: https://sidec-ke.org

For privacy and data protection enquiries, you may contact us using the details above.

Where SIDEC appoints a Data Protection Officer or other designated privacy representative, the relevant contact details will be published or made available through this Privacy Policy.

2. Personal Information We Collect

The information we collect depends on how you interact with our website and services.

2.1 Information You Provide Directly

When you contact SIDEC, subscribe to our communications, participate in activities, or use forms on our website, we may collect information such as:

• Full name
• Email address
• Telephone or mobile number
• Organisation or affiliation, where provided
• Location or general geographical information, where relevant
• The content of enquiries, messages or correspondence
• Information voluntarily provided through forms
• Information provided when registering interest in SIDEC programmes or activities

We only seek information that is reasonably necessary for the purpose for which it is collected.

2.2 Newsletter and Email Subscriptions

If you subscribe to SIDEC’s newsletter, mailing list or other communications, we may collect your name and email address and use this information to send you:

• News and updates
• Programme information
• Community development updates
• Events and opportunities
• Reports and publications
• Other communications for which you have subscribed or otherwise provided an appropriate lawful basis

You may unsubscribe from marketing or newsletter communications at any time using the unsubscribe mechanism provided in the communication or by contacting us directly.

2.3 Information Collected Automatically

When you visit our website, certain technical information may be collected automatically, including:

• IP address
• Browser type and version
• Device type
• Operating system
• Approximate geographical information
• Pages visited
• Time spent on pages
• Referring website or source
• General website usage information
• Technical information necessary for website security and operation

Where possible, analytics information will be configured and used in a manner that minimises the collection of personally identifiable information.

3. Cookies and Similar Technologies

Our website may use cookies and similar technologies.

Cookies are small files stored on your device that help websites function, remember preferences, understand usage, and improve user experience.

SIDEC may use:

Essential Cookies

These cookies are necessary for the website to function correctly and may support features such as security, page functionality, session management and basic website operation.

Analytics Cookies

We may use analytics services, including Google Analytics or similar services, to understand how visitors use our website and to improve its content, functionality and performance.

Where applicable under law, non-essential analytics cookies will only be activated after obtaining the appropriate user consent.

Future Cookies and Technologies

As the website develops, additional services may be introduced, including social media integrations, donation systems, recruitment platforms, event registration systems or other third-party services. Where these technologies process personal information or use non-essential cookies, we will update this Privacy Policy and implement appropriate consent and privacy controls where required.

You may also control or delete cookies through your browser settings. Disabling certain cookies may affect the functionality of parts of the website.

4. How We Use Personal Information

SIDEC may process personal information for purposes including:

• Responding to enquiries and requests
• Communicating with individuals who contact us
• Managing newsletter and mailing-list subscriptions
• Providing information about SIDEC programmes and activities
• Coordinating community engagement
• Managing partnerships and stakeholder relationships
• Improving our website, programmes and communications
• Understanding website usage and performance
• Maintaining website security
• Preventing fraud, abuse and unauthorised access
• Complying with applicable legal and regulatory obligations
• Managing donations and payments when such functionality becomes available
• Managing volunteer, employment or programme applications when such functionality becomes available
• Maintaining appropriate organisational records
• Protecting the rights, safety and legitimate interests of SIDEC, our stakeholders and website users

We will not use personal information for purposes that are incompatible with the purpose for which it was originally collected unless permitted by applicable law or we obtain appropriate consent.

5. Lawful Basis for Processing

Depending on the circumstances, SIDEC may rely on one or more lawful bases for processing personal information, including:

Consent

Where required, we will request your consent before processing personal information for a specified purpose. You may withdraw consent at any time, although withdrawal does not affect processing that occurred before withdrawal.

Legitimate Interests

We may process information where necessary for legitimate organisational interests, provided those interests do not override the rights and freedoms of the individual.

Examples may include website security, administration, communications, organisational management and improving our services.

Performance of a Contract

Where appropriate, we may process information necessary to enter into or perform an agreement with you.

Legal Obligations

We may process information where necessary to comply with applicable laws, regulations, legal processes or lawful requests from competent authorities.

Public Interest or Other Lawful Grounds

Where applicable, SIDEC may rely on another lawful basis recognised under the Kenya Data Protection Act or GDPR.

6. Newsletter and Direct Communications

Where SIDEC sends newsletters, updates or promotional communications based on consent, individuals will be given a clear opportunity to withdraw that consent.

You may unsubscribe at any time.

We will not sell or rent your personal information to third parties for their own direct marketing purposes.

7. Sharing Personal Information

SIDEC does not sell personal information.

We may share personal information where reasonably necessary with:

• Website hosting providers
• Website developers and technical service providers
• Email and newsletter service providers
• Analytics providers
• Payment service providers, where applicable
• Recruitment or application platforms, where applicable
• Professional advisers
• Government, regulatory or law-enforcement authorities where legally required
• Other service providers acting on our behalf

Where third parties process personal information on behalf of SIDEC, we will seek to ensure that appropriate contractual, technical and organisational safeguards are in place.

We will only disclose personal information for legitimate and specified purposes and will seek to limit disclosure to information reasonably necessary for those purposes.

8. International Data Transfers

Some service providers used by SIDEC may process or store information outside Kenya or outside the European Economic Area.

Where personal information is transferred internationally, SIDEC will take reasonable steps to ensure that the transfer is carried out in accordance with applicable data protection requirements.

This may include relying on:

• An adequacy decision;
• Appropriate contractual safeguards;
• Appropriate technical and organisational measures;
• The individual’s consent where legally appropriate; or
• Another lawful transfer mechanism recognised under applicable law.

Under Kenya’s Data Protection Act, personal data should not be transferred outside Kenya unless appropriate safeguards or consent are present.

9. Data Retention

SIDEC will retain personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Retention periods may depend on:

• The purpose for which the information was collected;
• Legal and regulatory requirements;
• Accounting and financial obligations;
• Dispute resolution;
• Organisational requirements;
• Security and fraud prevention requirements.

When personal information is no longer required, SIDEC will take reasonable steps to securely delete, anonymise or otherwise dispose of it.

10. Data Security

SIDEC takes reasonable technical and organisational measures to protect personal information against:

• Unauthorised access;
• Unauthorised disclosure;
• Accidental loss;
• Destruction;
• Alteration;
• Misuse; and
• Other unlawful processing.

Security measures may include access controls, secure hosting, encryption where appropriate, authentication controls, backups, software updates, monitoring and other reasonable safeguards.

However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

11. Data Breaches

If SIDEC becomes aware of a personal data breach that requires notification under applicable law, we will take reasonable steps to contain, investigate and remediate the incident.

Where required by law, SIDEC will notify the relevant regulatory authority and affected individuals within the applicable statutory timeframe.

The Kenya Data Protection framework provides for notification of certain personal data breaches to the Office of the Data Protection Commissioner, including the applicable 72-hour reporting requirement.

12. Your Data Protection Rights

Depending on the applicable law and circumstances, you may have rights including:

• The right to be informed about how your personal information is used;
• The right to access personal information we hold about you;
• The right to request correction of inaccurate or incomplete information;
• The right to object to certain processing;
• The right to request deletion of personal information where applicable;
• The right to restrict certain processing;
• The right to withdraw consent where processing is based on consent;
• The right to data portability where applicable;
• The right to complain to an appropriate data protection authority; and
• Rights relating to automated decision-making and profiling where applicable.

Under Kenya’s Data Protection Act, data subjects have statutory rights including the right to be informed, access their personal data, object to processing, request correction and request deletion of false or misleading data.

Under the GDPR, individuals may also have rights including restriction, portability, erasure and objection, subject to applicable conditions and exemptions.

13. How to Exercise Your Rights

To exercise your privacy rights or request information about the personal information SIDEC holds about you, contact:

Email: info@sidec-ke.org

Please include sufficient information to allow us to understand and respond to your request.

We may need to verify your identity before fulfilling certain requests in order to protect personal information from unauthorised disclosure.

Where GDPR applies, requests will generally be handled without undue delay and, subject to applicable exceptions, within one month.

14. Children’s Privacy

SIDEC recognises the importance of protecting children’s personal information.

Our website is not intended to knowingly collect personal information from children without appropriate consent, authorisation or another lawful basis.

Where SIDEC conducts programmes involving children or young people, any personal information collected as part of those activities will be handled in accordance with applicable child-protection and data-protection requirements.

Where required, appropriate consent from a parent, guardian or other authorised person will be obtained.

15. Future Donations and Payments

SIDEC may introduce online donation, payment or fundraising functionality in the future.

Where payment functionality is introduced, payments may be processed through third-party payment providers.

SIDEC will not unnecessarily store full payment-card information where payment processing can be securely handled by an authorised payment service provider.

Before such functionality becomes operational, this Privacy Policy may be updated to identify relevant payment providers, processing purposes, data categories and applicable safeguards.

16. Future Recruitment and Applications

SIDEC may introduce recruitment, volunteer and programme application functionality in the future.

Where applicants submit information such as:

• Names;
• Contact information;
• Curriculum vitae;
• Qualifications;
• Employment history;
• References; or
• Other application information,

such information will be processed for legitimate recruitment, volunteer-management or programme-selection purposes and in accordance with applicable data protection requirements.

Where a third-party recruitment platform is used, applicants will be informed where appropriate that their information may be processed through that platform.

17. Social Media and Third-Party Platforms

SIDEC may use social media platforms and third-party services to communicate with communities, partners and members of the public.

Future website integrations may include platforms such as Facebook, Instagram, LinkedIn, YouTube, WhatsApp or other services.

Third-party platforms operate under their own privacy policies and terms. SIDEC does not control how those platforms process information once information is submitted directly to them or collected through their services.

Where social media plugins, embedded content or tracking technologies are introduced, SIDEC will take reasonable steps to provide appropriate notice and, where required, obtain consent before activating non-essential tracking technologies.

18. Third-Party Websites

Our website may contain links to websites operated by third parties.

These websites are not controlled by SIDEC and may have their own privacy policies and terms.

We encourage users to review the privacy policies of third-party websites before providing them with personal information.

SIDEC is not responsible for the privacy practices, security or content of external websites.

19. Google Analytics and Website Analytics

SIDEC may use Google Analytics or another analytics service to understand how visitors interact with our website.

Analytics information may include information such as pages visited, approximate location, device information, browser information, traffic sources and interaction data.

Analytics information is used to:

• Understand website usage;
• Improve website content;
• Improve user experience;
• Monitor website performance; and
• Inform SIDEC’s communication and outreach activities.

Where required by applicable law, SIDEC will obtain consent before using non-essential analytics cookies or similar tracking technologies.

20. Privacy by Design and Data Minimisation

SIDEC seeks to incorporate privacy and data protection principles into the design and operation of its website and services.

We aim to:

• Collect only information reasonably necessary for a stated purpose;
• Provide clear information about how personal information is used;
• Limit access to personal information;
• Retain information only for as long as necessary;
• Apply appropriate security safeguards; and
• Review privacy and security practices as our services develop.

These principles reflect both the Kenya Data Protection Act and GDPR approaches to data minimisation, purpose limitation, storage limitation, security and accountability.

21. Changes to This Privacy Policy

SIDEC may update this Privacy Policy from time to time to reflect:

• Changes in our activities;
• New website functionality;
• Changes to third-party services;
• Changes in applicable laws;
• Changes in data protection practices; or
• Improvements to our privacy practices.

When significant changes are made, we will update the “Last Updated” date at the beginning of this policy and, where appropriate, provide additional notice.

22. Complaints

If you have concerns about how SIDEC has handled your personal information, we encourage you to contact us first so that we can investigate and attempt to resolve your concern.

Email: info@sidec-ke.org

If you are located in Kenya and believe your data protection rights have been violated, you may also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC). The ODPC provides mechanisms for data subjects to file complaints concerning the handling of personal information.

Individuals to whom the GDPR applies may also have the right to lodge a complaint with their relevant European data protection supervisory authority.

23. Contact Us

For questions, requests or concerns regarding this Privacy Policy or the way SIDEC handles personal information, please contact:

Sustainable Initiatives Development Enhancement in Communities (SIDEC)
Laikipia County, Kenya

Email: info@sidec-ke.org
Website: https://sidec-ke.org

Last Updated: 1 August 2026