2.1 Legal Basis and Regulatory Framework

• The Data Protection Act 2019 (Kenya) - our primary regulatory framework.
• The Computer Misuse and Cybercrimes Act 2018 (Kenya).
• The Consumer Protection Act 2012 (Kenya).
• Applicable guidelines issued by the Office of the Data Protection Commissioner (ODPC) of Kenya.
• Our lawful bases for processing personal data include: (a) contractual necessity; (b) compliance with a legal obligation; (c) legitimate interests pursued by us or by Organizations; and (d) consent, where specifically obtained.

2.2 Data We Collect from Organizations and Administrators

• Account registration data: full name, organization name, email address, telephone number, and role.
• Billing and payment data: transaction references, M-Pesa paybill records, and bank transfer confirmations.
• Usage and activity logs: login timestamps, IP addresses, feature usage, and session duration.
• Communications: emails, support requests, and correspondence with our team.

2.3 Member Data Processed on Behalf of Organizations

• Personal identification: full name, ID number or passport number, date of birth, gender, and profile photograph.
• Contact details: home address, email address, and primary phone number.
• Membership information: class year, chapter, membership category, status, and membership number.
• Financial records: dues paid, outstanding balances, payment transaction history, and receipts.
• Next-of-kin details: name, relationship, and contact telephone number.

2.4 Technical and Automatically Collected Data

• Device information: device type, operating system, and browser type.
• Network data: IP address and approximate geographic location derived from IP.
• Platform interactions: pages visited, features used, and error logs.

2.5 How We Use Personal Data

• Providing, operating, maintaining, and improving the Platform.
• Processing membership registrations, payments, and generating receipts.
• Sending service-related communications including payment confirmations and maintenance notices.
• Responding to support requests and enquiries.
• Detecting, investigating, and preventing fraud, security breaches, and abuse.
• Complying with legal obligations, including court orders and regulatory requirements.
• Generating anonymized and aggregated analytics to improve Platform performance.
• We will not use Member data for our own marketing purposes. Member data belongs to the Organization and is processed solely to provide the Platform service.

2.6 Data Sharing and Disclosure

• With authorized sub-processors who assist us in delivering the Platform.
• With the Organization whose account the data belongs to, in accordance with their instructions.
• Where required by Kenyan law, court order, or regulatory authority including the ODPC.
• In connection with a merger, acquisition, or sale of all or substantially all of our assets, with prior notice to affected parties.

2.7 Sub-Processors

• Cloud infrastructure and database services for hosting and storage.
• M-Pesa / Safaricom for payment processing and STK push.
• SMS gateway providers for bulk SMS notifications and OTP delivery.
• Email delivery providers for transactional and notification emails.
• Analytics and monitoring services for performance and error monitoring.
• All sub-processors are bound by contractual data processing agreements that require them to implement appropriate security measures and to process data only as instructed.

2.8 Data Retention

• Administrator account data is retained for the duration of the Organization's subscription and for seven (7) years thereafter for legal and tax compliance purposes.
• Member data is retained for the duration of the Organization's subscription and deleted sixty (60) days after termination unless the Organization requests earlier deletion.
• Payment transaction records are retained for seven (7) years in accordance with the Income Tax Act (Cap. 470) and VAT Act.
• System logs are retained for twelve (12) months for security purposes.
• Next-of-kin data is retained for the same period as the associated Member's data.

2.9 Data Subject Rights

• Right of access: to request a copy of personal data we hold about you.
• Right to rectification: to have inaccurate personal data corrected.
• Right to erasure: to request deletion of personal data in certain circumstances.
• Right to restriction: to restrict processing of your personal data.
• Right to object: to object to processing based on legitimate interests.
• Right to data portability: to receive your data in a structured, commonly used format.
• To exercise any of these rights, contact our Data Protection Officer at privacy@nexusforgeafrica.com. We will respond within twenty-one (21) days. Members should direct such requests to their Organization's Administrator in the first instance, as the Organization is the Data Controller for Member data.

2.10 Cross-Border Data Transfers

2.11 Data Security

• Row-level security (RLS) ensuring each Organization can only access its own data.
• AES-256 encryption for data at rest.
• TLS 1.3 encryption for all data in transit.
• JWT-based authentication with short-lived tokens.
• Multi-factor authentication for Administrator accounts.
• Regular security audits and penetration testing.
• Strict access controls limiting data access to authorized personnel only.
• In the event of a personal data breach that poses a risk to individual rights and freedoms, we will notify the ODPC within seventy-two (72) hours and affected Organizations without undue delay, as required by the Data Protection Act 2019.

2.12 Children's Data

2.13 Contact - Data Protection