Privacy Policy and Data Consent Notice

Careers by Muthoni (“CBM”, “we”, “us”, “our”) is a Nairobi-based youth career development organisation. We run school and university workshops, career discovery and mentorship sessions, career fairs and expos, and related programmes and content.

We are a data controller under the Data Protection Act, 2019 (the “Act”) and the Data Protection (General) Regulations, 2021. This policy explains how we collect, use, share, store and protect personal data, and the choices and rights you have.

“You” means:

1. 1.Visitors to our website and social media pages;
2. 2.Students and learners (including minors) who take part in our programmes;
3. 3.Parents, legal guardians and sponsors of learners;
4. 4.Teachers, school administrators and institutional partners;
5. 5.Mentors, volunteers, speakers and facilitators;
6. 6.Donors, funders, sponsors and other partners; and
7. 7.Anyone who contacts us or subscribes to our communications.

By using our website or giving us your personal data, you confirm that you have read this policy. Where the law requires your consent, we will ask for it (see Section 11). By registering for our workshops and programmes, you consent to photographs and videos being taken and used as set out in Section 11.2.

We process personal data in line with the Act. This means we will:

1. 1.Process data lawfully, fairly and transparently;
2. 2.Collect data only for specified, explicit and legitimate purposes;
3. 3.Collect only what is adequate, relevant and necessary (data minimisation);
4. 4.Keep data accurate and up to date;
5. 5.Keep data only for as long as necessary;
6. 6.Respect your rights; and
7. 7.Not transfer data outside Kenya unless the law allows it and safeguards are in place.

We collect personal data with your knowledge and, where required, your consent, when you:

1. 1.Browse or use our website;
2. 2.Register or book a workshop, career discovery session, mentorship programme, fair or event (including through third-party booking tools such as Calendly);
3. 3.Complete a form, survey, questionnaire or career assessment;
4. 4.Enrol a child or learner in any CBM programme;
5. 5.Contact us by email, phone, WhatsApp or social media;
6. 6.Subscribe to our newsletter or updates;
7. 7.Apply to be a mentor, volunteer, speaker or partner;
8. 8.Make a payment or donation;
9. 9.Attend our events, in person or online (including photos and recordings); or
10. 10.Engage with us as a school, university, employer or funder.

We may also receive learners’ details from their school or parent/guardian where they have arranged for the learner to take part in our programmes.

We do not intentionally collect sensitive personal data (such as health data, religious beliefs, ethnic origin or biometric data). If you choose to share such information with us, for example to request accessibility support for a session, we will process it only with your explicit consent and only for that purpose.

We will not use your personal data for a purpose that is incompatible with the purpose for which we collected it without telling you and, where required, obtaining fresh consent.

We process personal data on one or more of these bases under the Act:

1. 1.Consent: you (or your parent/guardian, for a child) have agreed to the processing for a specific purpose. Examples: newsletters, sharing data with partners, using photographs, and career assessments for learners.
2. 2.Contract: processing is necessary to provide a service you have requested or to take steps before entering a contract with you.
3. 3.Legal obligation: we must comply with a law, such as tax and accounting requirements.
4. 4.Legitimate interests: we have a legitimate interest, such as running and improving our programmes and securing our systems, and this does not override your rights and freedoms.
5. 5.Vital interests: processing is necessary to protect someone’s life or physical safety in an emergency.

Much of our work involves learners under 18. We take extra care with their data.

1. 1.Parental or guardian consent. We process the personal data of a child only where a parent or legal guardian has given consent, or where another lawful basis under section 33 of the Act applies and the processing is in the child’s best interests.
2. 2.School-based programmes. Where we deliver workshops through a school, we rely on the arrangement and consent processes between the school and parents, and we may ask the school to confirm this in writing. We will not collect a child’s data beyond what the programme needs.
3. 3.Age-appropriate notices. We aim to explain what we do with a child’s data in simple language.
4. 4.Limited use. We do not use children’s data for targeted advertising or profiling. Images and recordings used to showcase our work are covered by Section 11.2.
5. 5.No sharing without consent. We do not share a child’s personal data with third-party partners, including study-abroad, scholarship or education service providers, unless a parent or guardian has given explicit, separate consent.
6. 6.Photographs and recordings. Photographs and videos of learners are taken and used as described in Section 11.2. For a learner under 18, this consent is given by the parent or legal guardian who registers the learner, or through the school’s parental consent process for school-based programmes.
7. 7.Guardian rights. Parents and guardians may access, correct or request deletion of their child’s data, including photographs, videos and recordings, and may withdraw consent at any time.

If you believe a child has given us personal data without a parent’s or guardian’s consent, please contact us and we will act promptly.

We do not sell your personal data. We share it only where necessary and on a need-to-know basis, with:

1. 1.CBM team members, mentors and facilitators who need it to deliver programmes, bound by confidentiality.
2. 2.Parents and guardians, in relation to their child’s participation and progress.
3. 3.Schools and universities, where a programme is delivered in partnership with the institution.
4. 4.Service providers that support our operations, such as website hosting, email and messaging tools, scheduling and booking tools, cloud storage, analytics and payment processors. They may process data only on our instructions and under written agreements.
5. 5.Programme and referral partners, such as study-abroad or scholarship providers, only with your explicit consent and only for the purpose you agreed to.
6. 6.Funders and sponsors, generally in anonymised or aggregated form, together with photographs and videos of our work as described in Section 11.2.
7. 7.The public, through our website, social media pages and printed or digital materials, where photographs, videos and recordings are published under Section 11.2.
8. 8.Regulators, law enforcement and courts, where required or permitted by law.
9. 9.Professional advisers, such as lawyers, accountants and auditors.

Where we use a third party to process data for us, we require them to protect it in line with the Act.

Our website uses cookies and similar technologies.

You can accept or reject non-essential cookies through our cookie banner and change your choice at any time. You can also block cookies through your browser settings, though some parts of the website may not work properly.

Our website may link to third-party websites and social media platforms. We are not responsible for their privacy practices; please read their policies.

Some of our service providers (for example, cloud, email or analytics tools) may store or process data outside Kenya. We transfer personal data outside Kenya only where the Act permits, which means we have put in place appropriate safeguards, or the destination provides an adequate level of protection, or you have consented where required. We do not transfer sensitive personal data outside Kenya without meeting the additional conditions in the Act.

Where we rely on consent, it will be:

1. 1.Freely given: you can use our core services without agreeing to optional uses such as marketing or sharing with partners (photograph and video consent is given on registration, as set out in Section 11.2);
2. 2.Specific: separate tick-boxes for optional purposes such as marketing and sharing with partners;
3. 3.Informed: we tell you what we will do with your data;
4. 4.An active choice: we do not use pre-ticked boxes or silence as consent; and
5. 5.Withdrawable at any time, as easily as it was given, by emailing muthoni@careersbymuthoni.co.ke or using the “unsubscribe” link in our messages. This includes withdrawing consent to photographs and videos (see Section 11.2). Withdrawal does not affect processing done before you withdrew.

We keep a record of when and how consent was given.

11.1 Sample consent statements for forms

11.2 Photographs, videos and recordings

Consent on registration. By registering for, attending or taking part in CBM workshops, programmes, mentorship sessions, career fairs and events, you consent to photographs, videos and audio recordings being taken of you and used by CBM to showcase the impact of our work and to highlight our mentorship work.

Where we use them. This includes our website, social media pages, newsletters, presentations, proposals, reports to funders and partners, and printed and digital promotional materials.

Learners under 18. For a learner under 18, this consent is given by the parent or legal guardian who registers the learner or, for school-based programmes, through the school’s parental consent process (see Section 7). We do not publish a learner’s home address, phone number or other contact details alongside their image.

Your right to have them removed. You (or, for a child, the parent or guardian) may at any time ask us to stop using, remove or delete photographs, videos and recordings in which you appear, by emailing muthoni@careersbymuthoni.co.ke. We will act on the request within the timelines set by the Act by removing them from our website and social media pages, stopping future use, and deleting them from our systems. Withdrawing this consent will not affect your participation in our programmes or the lawfulness of use made before the request. We cannot recall material that has already been printed or distributed, or that third parties have shared on their own platforms, but we will take reasonable steps to ask them to remove it.

We keep personal data only as long as needed for the purpose it was collected, and to meet legal, tax, accounting or reporting requirements. We consider the nature and sensitivity of the data, the risk of harm from unauthorised use, the purposes for which we use it, and legal requirements.

We may keep data longer if there is a complaint or a reasonable prospect of legal proceedings. When data is no longer needed, we delete or securely destroy it. Anonymised data that can no longer identify you may be kept indefinitely.

We use technical and organisational measures appropriate to the risk, including access controls, encryption where appropriate, secure cloud storage, secure passwords and multi-factor authentication where available, restricted access on a need-to-know basis, confidentiality obligations for team members and mentors, and staff training.

If a personal data breach is likely to put your rights and freedoms at risk, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and will notify you without unreasonable delay where the law requires.

Under the Act, and subject to legal exceptions, you have the right to:

1. 1.Be informed of how your personal data is being used;
2. 2.Access the personal data we hold about you;
3. 3.Object to the processing of all or part of your personal data, including for direct marketing;
4. 4.Correct false or misleading data;
5. 5.Delete false or misleading data, data we no longer have a lawful reason to keep, and photographs, videos and recordings in which you appear (see Section 11.2);
6. 6.Data portability, in the circumstances the Act provides;
7. 7.Withdraw consent at any time; and
8. 8.Not be subject to a decision based solely on automated processing, including profiling, that significantly affects you. CBM’s assessment tools inform guidance and do not replace human judgement or make decisions about a learner on their own.

To exercise any right, email muthoni@careersbymuthoni.co.ke. We may need to verify your identity (and, for a child, the parent or guardian’s identity) before acting. We will respond within the timelines set by the Act and its Regulations.

Data Protection Officer / Data Protection contact
Careers by Muthoni (CBM) Mentorship Program
Email: pa@careersbymuthoni.co.ke

If you are unhappy with how we have handled your personal data, please contact us first so we can resolve it. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya: www.odpc.go.ke.

We may update this policy from time to time to reflect changes in our activities or the law. The updated version will be posted on this page with a new effective date. Where a change is significant, or where we need fresh consent, we will notify you directly.