1. Introduction

Amani Home is committed to the protection of personal data, particularly sensitive information about individuals and families we serve. This Data Protection Policy outlines our approach to data collection, processing, storage, and security in compliance with international standards and applicable regulations.

2. Scope and Applicability

This policy applies to all personal data processed by Amani Home, including data from:

• Website users and visitors
• Donors and supporters
• Program participants and beneficiaries
• Volunteers and staff members
• Partner organizations

3. Data Protection Principles

We adhere to the following data protection principles:

• Lawfulness: Data is processed only for legitimate purposes with appropriate legal basis
• Fairness: Processing is transparent and fair to individuals
• Transparency: Individuals are informed about how their data is used
• Purpose Limitation: Data is used only for the purposes it was collected
• Data Minimization: Only necessary data is collected
• Accuracy: Data is accurate, complete, and kept up to date
• Storage Limitation: Data is not kept longer than necessary
• Integrity and Confidentiality: Data is protected against unauthorized access and loss

4. Types of Data We Process

Personal Identifiers

• Name, address, email, phone number
• Date of birth
• National ID or passport information

Special Category Data

When necessary for program purposes, we may process sensitive information including:

• Refugee or asylum status
• Health information related to program support
• Information about experiences of trauma or persecution

Note: We process special category data only with explicit consent and robust security measures in place.

Operational Data

• Program participation information
• Educational and training records
• Donation and transaction history

5. Legal Basis for Processing

We process personal data under one or more of the following legal bases:

• Explicit consent of the individual
• Fulfillment of our humanitarian and charitable mission
• Compliance with legal obligations
• Protection of vital interests
• Legitimate interests of Amani Home or third parties

6. Data Security Measures

Technical Safeguards

• Encryption of data in transit and at rest
• Secure password requirements and multi-factor authentication
• Regular security updates and patches
• Firewalls and intrusion detection systems
• Regular security audits and vulnerability assessments

Organizational Safeguards

• Data Protection Officer oversight
• Staff training on data protection principles
• Confidentiality agreements with all staff and partners
• Access controls limiting data to authorized personnel
• Incident response procedures

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected or as required by law:

• Website users: Until account closure or 3 years of inactivity
• Donors: For the duration of the relationship plus 7 years for tax compliance
• Program participants: For duration of program participation plus 3 years
• Staff: Duration of employment plus 7 years

8. Your Rights

Right of Access

You have the right to request what personal data we hold about you.

Right to Rectification

You can request correction of inaccurate or incomplete data.

Right to Erasure

You can request deletion of your data, subject to legal retention requirements.

Right to Restrict Processing

You can request we limit how we use your data.

Right to Data Portability

You can request your data in a structured, machine-readable format.

Right to Object

You can object to processing for certain purposes.

To exercise any of these rights, please contact our Data Protection Officer.

9. International Data Transfers

If we transfer data to countries outside Kenya, we ensure appropriate safeguards including:

• Standard contractual clauses with international partners
• Verification of adequate data protection in receiving countries
• Explicit consent from individuals where required

10. Third-Party Data Sharing

We only share data with third parties when:

• You have given explicit consent
• Necessary to fulfill our charitable mission
• Required by law
• Service providers have signed data protection agreements

11. Data Breach Response

In the event of a data breach, we will:

• Notify affected individuals within 72 hours
• Inform relevant regulatory authorities
• Document the breach and our response
• Implement corrective measures

12. Children's Data Protection

We do not knowingly collect data from children under 13. If we become aware of such collection, we will delete it immediately. For older children and youth in our programs, we ensure:

• Parental consent where appropriate
• Special protections for sensitive information
• Age-appropriate communication about data use

13. Data Protection Officer

Our Data Protection Officer oversees compliance with this policy and can be reached at:

Email: privacy@amanihome.org
Phone: +254 722 54809

14. Policy Updates

This policy is reviewed annually and updated as necessary. We will notify you of material changes via email or website notice.

15. Contact for Data Protection Questions

Amani Home - Data Protection
Email: privacy@amanihome.org
Phone: +254 722 54809
Address: Nairobi, Kenya