The Vineyard Christian Community Based Organization (“Vineyard,” “we,” “us”) processes personal data to serve children and families in Mathare and to run our organisation responsibly. This Data Protection Policy sets out the principles and practices we follow, guided by Kenya’s Data Protection Act, 2019 and related guidance. It complements our public Privacy Policy. It is an organisational summary, not legal advice or a certification of ODPC registration status.
1. Purpose and scope
This policy applies to personal data processed by Vineyard through:
- Our public website and online forms
- Vineyard SMS (Student Management System) and related admin tools
- Programme operations (education support, feeding, medical camps, sponsorship administration, volunteering)
- Email, phone, paper, and partner channels used for Vineyard work
It applies to staff, volunteers, directors, contractors, and partners who handle personal data on our behalf.
2. Roles
- Data controller: Vineyard determines why and how personal data is processed for our programmes and website.
- Day-to-day responsibility: Leadership and authorised system users ensure processing stays lawful, necessary, and secure.
- Processors: Hosting, email, and similar providers may process data on our instructions to deliver services.
Contact for data-protection matters: info@vineyardcbo.org (subject: “Data protection”).
3. Categories of data
Depending on the activity, we may process:
- Website and enquiries: names, emails, phone numbers, messages, volunteer interests, newsletter addresses
- Programme records: child and family information needed for education, nutrition, welfare support, and accountability
- Sensitive / special data: where necessary, health-related or protection-related information for care and safeguarding (with heightened care)
- Staff / volunteer operations: account credentials, audit logs, and role permissions for Vineyard SMS
- Technical data: security logs and essential session data
4. Principles we follow
We aim to process personal data in line with these principles:
- Lawfulness, fairness, and transparency — clear purposes; honest communication where practical
- Purpose limitation — collect for specified programme or organisational purposes, not for unrelated use
- Data minimisation — only what is needed for the task
- Accuracy — keep records as accurate and up to date as reasonably possible
- Storage limitation — retain only as long as needed for purpose, law, safeguarding, or accountability
- Integrity and confidentiality — protect against unauthorised access, loss, or misuse
- Accountability — be able to demonstrate responsible handling through access controls, procedures, and review
5. Lawful bases and children’s data
We process data where we have a valid basis under applicable law — for example consent (such as newsletter signup), legitimate organisational interests that do not override individual rights, performance of programme support where appropriate, or legal / safeguarding obligations.
Children’s personal data receives heightened protection. We do not publish identifiable child profiles for public sponsorship browsing. Public communications about children must be privacy-safe and consistent with our Child Safeguarding Policy and guardian authorisation where required.
6. Access control and security
We take reasonable measures, including:
- HTTPS encryption for website traffic
- Login-protected Vineyard SMS with role-based permissions
- Restricted handling of confidential uploads (photos, letters, financial documents)
- CSRF and session protections on forms and admin actions
- Need-to-know access — users should only access data required for their role
Staff and volunteers must not share passwords, leave sensitive screens unlocked, or export child data without authorisation. Suspected incidents must be reported promptly to leadership via info@vineyardcbo.org.
7. Sharing and transfers
We share personal data only when necessary, for example with:
- Service providers who host or support our systems under our instructions
- Trusted programme partners where sharing is required to deliver support (such as sponsorship administration)
- Authorities or protection agencies when required by law or to protect a child’s vital interests
We do not sell personal data. Where data may be processed outside Kenya by a service provider, we expect appropriate contractual and technical safeguards.
8. Retention and disposal
Retention depends on the record type. Enquiry and newsletter data are kept while useful for communication or until unsubscribe / deletion requests are fulfilled. Programme and safeguarding-related records may be kept longer where accountability, care continuity, or legal duty requires. When data is no longer needed, we aim to delete, anonymise, or securely archive it according to internal practice.
9. Individual rights
Subject to the Data Protection Act, 2019 and applicable exceptions, individuals may request access, correction, deletion, or restriction of their personal data, and may object to certain processing. Complaints may be made to the Office of the Data Protection Commissioner (ODPC).
To make a request, email info@vineyardcbo.org with enough detail for us to locate the relevant records. We may need to verify identity before responding. Requests involving children may require engagement with a parent or guardian where appropriate and lawful.
10. Breaches and incidents
If we become aware of a personal-data breach that risks individuals’ rights, we will assess the impact, contain the incident where possible, notify affected people and/or the ODPC when required, and take steps to reduce recurrence. Anyone who discovers a suspected breach should report it immediately to info@vineyardcbo.org.
11. Related documents
- Privacy Policy — public notice for website visitors and form users
- Child Safeguarding Policy — child protection commitments
- Photography & Media Consent Policy — images, video, and stories
- Terms & Conditions — rules for using this website
12. Review
Leadership reviews this policy periodically as systems, programmes, or legal requirements change. The “Last updated” date shows the latest revision of this page.
13. Contact
Data protection enquiries: info@vineyardcbo.org · Contact form · Phone +254 718 329 628 · Mathare, Nairobi, Kenya