Last updated
Who we are
The Kenya Association for Breastfeeding (KAB) is a registered society in Kenya (registration number SOC 75122). KAB is the data controller for the personal data described in this policy.
For any question about your data, email hello@breastfeedingke.org.
What we collect
- Membership application (form on our website): your name, email, phone number, county and town, training and qualification details, an optional certificate link, where you work, and whether you agree to be listed on our website.
- Payment confirmation: your phone number or member number, the M-Pesa transaction code, the amount, the date and what the payment was for. We do not collect M-Pesa PINs or card details.
- Prenatal class sign-up: the name, phone number and email of the person booking, the expected due month, the chosen class date and the payment code.
- Contact form: your name, email, and the message you send.
- Emails you send to KAB and our replies.
We do not ask for health records, and we do not collect personal data from children.
Why we use it
- To review membership applications and keep the member register.
- To send welcome emails, renewal reminders, payment receipts and class confirmations.
- To answer questions sent through the website or by email.
- To show the names and towns of active members who agreed to be listed.
- To meet our legal and reporting duties as a registered society.
Our lawful basis
Under section 30 of the Data Protection Act, 2019, we rely on your consent (given on each form), on the need to manage your membership or booking with us, and on our legitimate interest in running the association. You can withdraw consent at any time; this does not affect anything we did before you withdrew it.
Who handles the data for us
We use trusted service providers who process data only on our instructions:
- Google (Sheets and Apps Script, on KAB's own Google account) to keep the member register. Our website forms send your answers straight there.
- Zoho Mail for KAB's email accounts, such as hello@breastfeedingke.org.
- Resend to send automatic emails such as confirmations, receipts and reminders.
- Our website host, which runs this website.
Some of these providers store data outside Kenya. Where that happens we rely on the safeguards set out in sections 48 to 50 of the Data Protection Act, 2019, and use providers that apply recognised security and data protection standards. We never sell your data.
How long we keep it
- Member records: while you are a member and for two years after membership ends, unless the law requires longer.
- Payment records: as long as needed for our accounts and audits.
- Contact messages and class bookings: up to 12 months.
After these periods we delete the data or make it anonymous.
How we protect it
Only committee members who need the data can open the member register. Accounts are protected by passwords and, where available, two-step sign-in. The website uses an encrypted connection (HTTPS).
Your rights
Under section 26 of the Data Protection Act, 2019, you have the right to:
- be told how your data is used;
- see the personal data we hold about you;
- object to its use;
- have wrong or misleading data corrected;
- have false or misleading data deleted.
To use any of these rights, email hello@breastfeedingke.org. We reply within 14 days.
Complaints
If you are unhappy with how we handle your data, please contact us first at hello@breastfeedingke.org. You can also complain to the Office of the Data Protection Commissioner (odpc.go.ke).
Changes to this policy
We may update this policy. The date at the top shows the latest version.