1. Overview
This Privacy Notice informs you about how and for which purposes ANGLICAN DEVELOPMENT SERVICES (NORTH RIFT REGION) (also referred to here as ‘ADS-NRR’, ‘we’ or ‘us’) will process your personal data and explains your rights under The Data Protection Act 2019 of Kenya. We remain dedicated to handling your personal data responsibly, diligently and in compliance with all legal requirements to ensure the integrity and security of your personal data. ADS-NRR is the Data Controller for your Personal Data.
2. Introduction
2.1. At ADS-NRR, we build partnerships with communities and enable them to exercise their God given potentials in addressing their needs through community development, advocacy, research & knowledge management. To provide these services, we process and use personal data in compliance with the laws of the Republic of Kenya.
2.2. ADS- NRR is committed to protecting the fundamental human right to privacy. We respect your personal information and the data we collect from you through different mediums. Whether you are a beneficiary, an employee, a consultant, a supplier or a service provider, we are committed to processing and protecting all personal data in a relevant and appropriate manner in compliance with the Data Protection Act, 2019.
2.3. This Privacy Notice details the personal data we collect, how we process it, the purposes for which we use it, and to whom your personal data may be disclosed in connection with ADS-NRR. It also describes the controls we have established to safeguard your data and provides information on your rights regarding the processing of your personal data.
2.4. We may update this Privacy Notice periodically to reflect changes in legislation or our organizational practices. All changes will be posted on our website, and the most recent version will supersede all previous versions unless otherwise stated. We will notify you of significant changes to this Notice via a notification on our website, or any other effective communication method.
3. Definition of terms
3.1. We/our/ours/us/ADS-NRR means ANGLICAN DEVELOPMENT SERVICES (NORTH RIFT REGION).
3.2. Data Protection Officer is a person designated or appointed by The Organization to monitor compliance with the Data Protection Act, 2019 and any instant regulations.
3.3. Data Collection means gathering of information that relates to you.
3.4. Personal data means information about you that identifies you directly or indirectly as a unique individual such as name, an identification number, location data or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of a natural person. The personal data that we collect will depend on the context of our relationship with you. We may collect, use, store and transfer different kinds of personal data about you or people connected to you depending on our engagement.
3.5. Processing means any operation or sets of operations which is performed on your personal data whether by automated means, such as: collection, recording, organization or structuring; Storage, adaptation or alteration; Retrieval, consultation or use; Disclosure by transmission, dissemination, or otherwise making available; Alignment or combination, restriction, erasure or destruction.
3.6. Sensitive personal data is data revealing your racial or ethnic origin, political opinions, professional membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's gender.
3.7. Third Party - means a natural or legal person, public or private authority, agency or body other than you, who under the direct authority of ADS- NRR are authorized to process your personal data.
3.8. You/ Your (s) means:
3.8.1. Any person who is currently employed or is a future employee of ADS- NRR
3.8.2. Any person who has participated in a project by ADS- NRR
3.8.3. Any individual who has filled out an application on social media.
3.8.4. Any individual service provider, partner, or third party who is involved in delivering services to or through ADS- NRR.
4. Processing
“Processing” collectively means handling, collecting, using, altering, merging, linking, organizing, disseminating, storing, protecting, retrieving, disclosing, erasing, archiving, destroying, or disposing of your personal data.
4.1.1. Data Collection - Personal Data that is processed by ADS-NRR includes but is not limited to; Bio and Contact information such as name, address (and proof of address), other contact details (e.g., email, social media, mobile numbers), gender, marital status, date and place of birth Government Generated Information such as National ID Number, Tax PIN, Passport Details, NHIF & NSSF Details, birth certificates, marriage certificates, clearance certificates, Tax Compliance certificate, CR12, drivers’ licenses.
4.1.2. Employment and Educational Information such as Employment History, Educational Background including institutions attended and Professional Memberships, academic certificates, resumes, reference checks, background check information.
4.1.3. Health Data information such as current or former physical or mental medical conditions, health status, injury or disability information, medical procedures performed, prescription information, medical history.
4.1.4. Financial Information such as Bank Account, Investments, account details, bank statements, Mpesa statements, audited books of accounts, net worth details
4.2. Audio-Visual Information - Passport size photographs for personnel file, pension claims and medical scheme, Photographs for project participants, partners, donors, stakeholders, Video recordings for project activities e.g. success stories.
4.2.1. How we collect Data
4.2.2. We collect your personal information with your knowledge and consent. We may collect your personal data through any of the following ways:
4.2.2.1. Directly from You: We collect data directly from you in person, when you fill our physical forms or through our website.
4.2.2.2. Indirectly: We collect data indirectly through intermediaries, service providers and other third parties. We may receive data from partners, government bodies, banks or other organizations with whom we collaborate.
5. General Principles for Protecting Personal Data at ADS- NRR
5.1. Transparency: We are committed to being fully transparent about how we comply with applicable data protection laws, ensuring you are always informed about how your data is handled.
5.2. Purpose Limitation: We only collect and process the Personal Data necessary to deliver our services. The data we collect is used for specified, legitimate purposes, and we do not process it in ways that are incompatible with those purposes.
5.3. Lawful Processing: We only process sensitive Personal Data when there is a clear and justified legal basis for doing so, ensuring that your privacy is respected at all times.
5.4. Data Minimization: We collect only the Personal Data that is essential for achieving the intended purposes. Our data collection is carefully tailored to meet the specific needs of our services.
5.5. Informed Consent: We provide clear information about the Personal Data we collect, including how it will be stored, used, and protected. We ensure that you understand the reasons for data collection and how your data will be managed.
5.6. Confidentiality and Security: Your Personal Data is treated with the utmost confidentiality. We implement robust technical and organizational security measures to safeguard your data against loss, unauthorized access, and unlawful processing.
5.7. Data Retention: We retain your Personal Data only for as long as necessary to fulfill the purposes for which it was collected or as required by applicable laws. Once it is no longer needed, we securely delete or anonymize the data.
6. Why do we collect your personal data?
6.1. We use your Personal Data at ADSNRR depending on our relationship (i.e. Employees, Partners, Board of Directors, project participants, etc.) including the type of communications between us and the services we provide.
6.2. Our data usage aims to enhance our services, communicate effectively, and ensure compliance with legal requirements.
6.3. The reasons include;
6.3.1. Monitoring and Evaluation purposes, to assess the impact of our programs and improve service delivery.
6.3.2. Employee Due Diligence (EDD)
6.3.3. Fulfilling donor/partner requirements
6.3.4. Communicating with partners/donors, project participants, stakeholders etc.
6.3.5. Fulfilling regulatory requirements such as Filing Reports with various regulators such as Office of the Data Protection Commissioner (ODPC), Retirements Benefits Authority (RBA) etc
6.3.6. Responding to feedback, queries and complaints that you submit through our feedback mechanisms.
6.3.7. Facilitating business operations including information technology systems.
6.3.8. Providing information through communication channels such as email, texts, and other platforms
6.3.9. Filling returns for Board of Directors
6.3.10. Payroll preparation
6.3.11. Compliance purposes e.g. Filling of company returns, NHIF, NSSF, Housing Levy
7. Legal Basis for Processing Personal Data
7.1. We process your Personal Data on the following legal grounds to ensure that our services are provided lawfully, transparently, and with respect to your privacy:
7.1.1. Consent: We shall process your data when you have given explicit consent, such as when you fill our physical forms or through our website. You have the right to withdraw your consent at any time.
7.1.2. Contract Performance: Your data may be processed to fulfill our contractual obligations to you, and perform statutory tasks related to management of the services we are offering you.
7.1.3. Legitimate Interests: We may process your data based on our legitimate interests, such as improving the welfare of communities and addressing their needs through community development, advocacy, research & knowledge management. We always ensure that our legitimate interests do not override your fundamental rights and freedoms.
7.1.4. Legal Obligations: We may process your data to comply with applicable laws, regulations, and legal requirements, such as the Work Injury Benefit Act and data protection laws like the Data Protection Act, 2019 of Kenya. This includes cooperating with regulatory authorities, responding to legal requests, and maintaining appropriate records for auditing and compliance purposes.
8. Data Sharing & Disclosure
8.1. At ADS- NRR we are committed to protecting your privacy. However, in certain circumstances, we may need to share your Personal Data with third parties to provide our services and comply with legal obligations.
8.2. Sharing with Third Parties
8.2.1. Service Providers: We may share your Personal Data with trusted service providers who assist us in delivering our services, such as payment processors. These providers only have access to the data necessary to perform their specific functions and are obligated to keep your information confidential and secure. The sharing of data is governed within a Data Sharing Agreement or a Data Processing Agreement, as applicable
8.2.2. Legal Requirements: We may disclose your Personal Data when required by law, regulation, or court order, or to protect the rights, property, or safety of ADS- NRR, our clients, or other stakeholders. This includes cooperating with regulatory authorities, law enforcement, and other entities as necessary to comply with legal obligations and to prevent fraud or other illegal activities.
8.3. International Data Transfers
8.3.1. Your Personal Data may be transferred to and processed in countries outside the Republic of Kenya, including those that may not provide the same level of data protection as provided for in the Data Protection Act, 2019.
8.3.2. In such cases, we implement appropriate safeguards, such as standard contractual clauses or other legally approved mechanisms, to ensure that your data remains protected and that your privacy rights are upheld during these transfers.
9. Data Security
9.1. At ADS- NRR, safeguarding your Personal Data is our top priority. We have implemented a comprehensive set of security measures to ensure your data remains protected from unauthorized access, misuse, and breaches.
9.2. Security Measures
9.2.1. Only authorized ADS NRR staff access data collected and kept based on user roles and permissions.
9.2.2. We regularly create back-up of our data and destroy them once their time of usage has expired in line with our records destruction policy
9.2.3. We train our staff on online data protection which includes password usage, installation and use of antivirus, spam protection etc.
9.3. Data Breach Response
9.3.1. In the unlikely event of a data breach, ADS NRR is dedicated to taking immediate, transparent, and effective action to protect your personal data and minimize any potential impact. We have a comprehensive Data Breach response plan in place to manage and contain data breaches promptly.
9.3.2. Immediate Assessment and Containment: Upon detecting a breach, our Incident Response team will swiftly assess the situation to understand the nature and scope of the breach. We will immediately take steps to contain the breach, secure our systems, and prevent any further unauthorized access.
9.3.3. Incident Classification: Upon assessment of the breach, the incident response team will classify it as follows, based on the severity
9.3.3.1. Low: Minimal impact, unlikely to affect individuals or operations significantly.
9.3.3.2. Medium: Moderate impact, may affect specific individuals or require some operational changes.
9.3.3.3. High: Significant impact, likely to affect multiple individuals and operations, requires urgent attention.
9.3.3.4. Critical: Severe impact, requires immediate escalation to senior management and external authorities.
9.3.4. Data Subject and Data Commissioner Notification: We are committed to keeping you informed. If your data is affected, we will notify you as soon as possible, providing details about the breach, the type of data involved, and the steps we are taking to mitigate the impact. We will also notify the Data Commissioner, in accordance with legal requirements.
9.3.5. Mitigation and Remediation: Our team will work quickly to address the breach, mitigate any potential harm, and implement remedial measures to strengthen our security protocols. This may include conducting a thorough investigation, enhancing existing safeguards, and providing guidance on steps you can take to protect yourself.
9.3.6. Continuous Improvement: After a breach, we will perform a detailed analysis of the incident to understand its root cause. We will use these insights to further improve our security measures and prevent similar incidents in the future, ensuring your data remains secure.
10. Your Rights and Choices
10.1. At ADS- NRR, we respect your privacy and are committed to providing you with control over your Personal Data. You have several rights that allow you to understand and manage how your data is used.
10.2. Right to object to processing of personal data; The right is not an absolute right and we can reject the request where we demonstrate that we have justifiable reasons for processing that would negate your interests e.g. when we are required by a Government agency exercising their legal mandate to provide your personal data against your request not to avail the same or in our defense of a legal case. We will always inform you when we have declined your request and provide the reasons.
10.3. Right to restrict processing of personal data; You have the right to request the suspension of processing of your personal data in certain circumstances. This right is not an absolute right and shall be available when;
10.3.1. You contest the accuracy of your personal data
10.3.2. Your personal data has been unlawfully processed and you oppose the erasure and request restriction instead
10.3.3. You no longer need your personal data but we require the same to be kept in order to establish, exercise or defend a legal matter
10.3.4. You have objected to the processing, pending verification as to whether our use of your personal data is justifiable.
10.4. Right to access personal data – You have the right to access your personal data and obtain information of how the said personal data is used and processed.
10.5. Right to rectification of personal data– You have the right to request your personal data to be corrected in instances of inaccuracy or incompleteness. In implementation of this right, you shall use the statutory form “Request for rectification” provided in our website. Click here to access the Rectification Form Request
10.6. Right to data Portability – You have the right to receive your personal data in a structured, commonly used and machine- readable format to transmit the said personal data obtained to another third party without any hindrance.
10.7. Right to erasure – This right is sometimes referred to as “the right to be forgotten” and entitles you to request deletion or removal of your personal data from our records.
10.8. Right to complain to the Office of the Data Commissioner
10.9. Right to withdraw consent to processing of personal data.
10.10. Rights relating to automated decision making and profiling – You have a right not to be subjected to a decision based solely on our automated processing, including profiling, which legally and significantly affects you.
11. Children’s Privacy
ADS- NRR is committed to protecting the privacy of all users, especially children. ADS NRR has in place a Child and Vulnerable Adult Safeguarding Policy that stipulates protection of all organisations beneficiaries and stakeholders.
12. How long do we store your personal data?
12.1. We will only retain your personal data for as long as may be reasonably necessary to fulfill the purpose we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting information.
12.2. We may retain your personal data for a longer period if the retention is:
12.2.1. required or authorized by law
12.2.2. reasonably necessary for a lawful purpose.
12.2.3. authorized or consented by you.
12.2.4. is necessary for the purpose of responding to a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
12.2.5. for historical, statistical, journalistic, literature and art or research purposes.
12.2.6. reaching out to you for pension claim updates, post project evaluations, future job vacancies etc
13. Consequences of not providing personal data
Your decision to share Personal Data with ADS- NRR is voluntary; however, certain services and projects of ADS- NRR rely on specific types of Personal Data to operate effectively. If you choose not to provide the necessary data, you will be unable to access some of our services.
14. Contact
14.1. Your privacy is important to us, and we are here to help with any questions or concerns you may have about this Privacy Notice or how your Personal Data is handled. If you have any inquiries, require clarification, or wish to raise a complaint, please feel free to reach out to us through any of the following channels: Email: – dataprotection@adsnorthrift.org Our team is available to assist you with any privacy-related questions or issues. reach out to us on: Address: – You can write to us at our physical address for any formal correspondence.
Data Protection Officer
ADS North Rift Region
P.O. Box 6495-30100
ELDORET KENYA
We are committed to resolving any concerns promptly and ensuring your experience with ADS- NRR remains secure and transparent.
Notice Effective Date: June, 2025
This Data Privacy Notice was last update d on June, 2025