Controller
AAHRED, headquartered in Nairobi, Kenya, is the data controller for this website and for enquiries submitted through it.
Privacy centre
Your data, your rights, in plain terms
This page is maintained by AAHRED to answer common privacy questions about this site and the secretariat's data handling. It describes our own practices; it is not an independent certification or a legal opinion.
Frameworks
Practices are aligned to the EU GDPR, the Kenya Data Protection Act 2019 and the CCPA/CPRA rights framework.
No sale of data
AAHRED does not sell personal information and does not share it for cross-context behavioural advertising.
Contact route
Privacy requests are handled through the secretariat contact form and acknowledged with a reference number.
Processing register
What we collect, why, and for how long
Every category of personal data processed through this site, with its lawful basis, retention schedule and recipients.
| Category | Data held | Lawful basis | Retention | Recipients |
|---|---|---|---|---|
| Contact enquiries | Name, email, organisation, subject, message, attachments | Legitimate interest / consent | 24 months from last contact | Secretariat staff only |
| Technical logs | User agent, request timestamps, error diagnostics | Legitimate interest (security) | 12 months | Hosting and error-monitoring processors |
| Staff accounts | Email, authentication credentials, role assignment | Contract | Duration of engagement plus 12 months | Authentication processor |
| Programme research data | De-identified survey and routine service data | Consent / public interest research | Per approved protocol | Ministry data owners and named collaborators |
| Newsletter and updates | Email address, subscription preferences | Consent | Until unsubscribe | Email delivery processor |
Your rights
Eight rights you can exercise at any time
Access
Request a copy of the personal data we hold about you and the purposes of processing.
Rectification
Ask us to correct inaccurate or incomplete personal data.
Erasure
Request deletion where the data is no longer necessary and no legal duty requires retention.
Restriction & objection
Object to processing based on legitimate interest, or ask that processing be restricted while a dispute is resolved.
Portability
Receive data you provided in a structured, machine-readable format.
Withdraw consent
Withdraw consent at any time where consent is the basis for processing, without affecting prior lawful processing.
Do not sell or share (CCPA/CPRA)
AAHRED does not sell personal information and does not share it for cross-context behavioural advertising.
Non-discrimination
Exercising any of these rights never affects the services or support you receive from AAHRED.
Request workflow
How a rights request is handled
1. Submit
Send your request through the secretariat contact form, stating the right you wish to exercise and the data you are asking about.
2. Verify
We confirm identity proportionately — usually by replying to the email address associated with the data — before disclosing or deleting anything.
3. Assess
We check whether any statutory retention duty, research-ethics approval or legal claim prevents full action, and tell you if it does.
4. Respond
A substantive response is issued within 30 calendar days, extendable once by a further 30 days for complex requests, with reasons given.
5. Escalate
If you are dissatisfied you may escalate internally to the Data Protection focal point, and thereafter to your competent supervisory authority.
Cookies & tracking
Our cookie position
- This site sets no advertising, profiling or cross-site tracking cookies.
- A session storage entry is used only to keep staff signed in to the secretariat console.
- No third-party analytics or social media pixels are embedded in these pages.
- Server logs are retained for security and reliability purposes and are not used to build user profiles.
Subprocessors
Who processes data on our behalf
| Processor | Purpose | Location |
|---|---|---|
| Cloud application hosting | Website delivery and server-side application runtime | Global edge network |
| Managed database & storage | Storage of contact enquiries and attachments | Managed cloud region |
| Authentication service | Staff sign-in for the secretariat console | Managed cloud region |
| Transactional email delivery | Notification of enquiries to the secretariat | Managed cloud region |
International transfers
Where data is processed outside its country of origin, transfers rely on documented safeguards including standard contractual clauses and processor agreements. Ministry-owned programme data stays under the data-sharing agreement negotiated with that ministry.
Children and vulnerable participants
Programme data involving children or vulnerable participants is collected only under an approved research protocol with guardian consent, data minimisation and de-identification before analysis.
Security of processing
Technical and organisational measures — role-based access, private storage, malware screening and audit trails — are described in full on the data governance and security page.