Data & Privacy Policy

Last updated: July 2026 · Sample policy for the prototype — to be reviewed against the Kenya Data Protection Act, 2019 before launch.

1. Who we are

Maahad Daawah Organisation (Nairobi, Kenya) is the data controller for personal information collected through this site. Contact us at info@maahad.org for any privacy matter.

2. What we collect

• Your name, phone number and email when you donate, order or subscribe.
• If you apply for support, the application details described in section 3 below.
• Order and delivery details, including a delivery address where you choose delivery, and any names you provide for an Udhiya offered on behalf of others.
• Payment metadata (amount, reference, status). We do not collect or store full card numbers.
• Basic technical data needed to run and secure the site.

3. Support applications (beneficiary data)

If you apply for assistance, we collect what we need to assess your application. Every application includes your name, phone number, where you live, a short statement of your situation, and one identity document of your choice — a national ID, a birth certificate, a guardian’s ID, or a letter from your chief or imam. We never insist on a national ID.

Depending on the kind of support you ask for, we also collect:

• Education — the school, level and fees, and a parent or guardian’s details where the student is a minor.
• Widow support — evidence of your husband’s passing (a death certificate, burial permit or local-authority letter) and details of your dependents.
• Medical — the condition, a medical report, the facility and the estimated cost. This is health information — sensitive data that we collect only with your explicit consent.
• General relief — your household size and the nature of the hardship.

Why we collect it: to assess eligibility for and administer charitable assistance, and to meet our legal, audit and reporting obligations.

Sensitive information: some of this is special-category data under the Kenya Data Protection Act, 2019 — for example health details, and information about dependents including children. We collect it only where it is necessary for your application, and only with your consent.

Who can see it: application details and uploaded documents are visible only to a small number of designated Maahad staff (administration and finance). Every document access is restricted and logged. Your application is never shared with other applicants, donors, or the public.

Documents: identity and supporting documents are stored in restricted, private storage. They are not publicly accessible.

Retention: [Retention period to be confirmed by Maahad — pending Data Protection review.]

Your choices: you may ask to access, correct or delete your application data, or withdraw your consent, using the contact in section 1 — subject to records we must keep for legal and audit reasons.

Note for review: the retention period above and the lawful basis for health data are pending confirmation by Maahad’s Data Protection reviewer.

4. How we use it

• To process donations and orders, issue receipts, tag and fulfil Udhiya, and share slaughter and distribution proof.
• To send you transactional updates and, where you have opted in, news and appeals.
• To meet our legal, audit and reporting obligations as an NGO.

5. Payments

Payments are handled by Safaricom (M-Pesa) and Paystack. They process your payment under their own terms and privacy policies; we receive confirmation and a reference, not your card details.

6. Messages & consent

We send transactional messages (receipts, order and proof updates) as part of providing the service.

When you donate, order or subscribe, our forms include a pre-selected option to “Keep me updated with Maahad news, appeals & impact by email and SMS”. Leaving it ticked means you consent to receiving these promotional messages; you may untick it before submitting if you would rather not.

You can withdraw your consent at any time: use the unsubscribe link in the footer of any email, or reply STOP to any SMS, and we will stop sending you promotional messages. Transactional messages relating to your orders and donations will still be sent where needed.

7. Who we share with

We share data only with service providers who help us operate — payment processors, email/SMS providers, and our own delivery riders (who see the name, address and phone needed to deliver your order). We do not sell your data.

Support application data is not shared with our delivery, payment or messaging providers. It is seen only by designated administration and finance staff, and every document access is logged (see section 3).

8. Retention

We keep personal and financial records for as long as needed to provide the service and to meet legal and audit requirements, then securely delete or anonymise them.

9. Your rights

Under the Kenya Data Protection Act, 2019 you may request access to, correction of, or deletion of your personal data, and object to certain processing. Email info@maahad.org and we will respond within a reasonable time.

10. Security & children

We use appropriate safeguards to protect your data. The site is not directed at children. Where an application concerns a minor (for example education support), we collect the child’s information through a parent or guardian, who consents on the child’s behalf.

11. Changes

We may update this policy; the latest version always applies. For questions, contact info@maahad.org.