Privacy Policy
Crater SDA Welfare Society ("Society", "we", "us") is committed to protecting the privacy of our members and beneficiaries. This Privacy Policy explains how we collect, use, store and protect your personal data when you use our Platform.
This policy is compliant with the Kenya Data Protection Act, 2019 and its accompanying regulations.
We collect the following categories of personal data:
- Full name, national ID number, date of birth
- Phone number (M-Pesa registered), email address
- Residential address, church membership details
- M-Pesa transaction records and confirmation codes
- Contribution history, payment dates and amounts
- Bank account details (where provided for disbursements)
- Names, relationships and contact details of registered beneficiaries and next-of-kin
- Claim type, description and supporting documents
- Hospital invoices, death certificates, school fee statements
- Medical information provided voluntarily in support of a claim
- IP address, browser type and device information
- Login timestamps and session activity
- Push notification subscription tokens
- OTP delivery logs (phone and email)
- In-platform notifications and announcements
We use your personal data for the following purposes:
| Purpose | Legal Basis |
|---|---|
| Creating and managing your member account | Contractual necessity |
| Processing contributions and payments via M-Pesa | Contractual necessity |
| Evaluating and disbursing welfare claims | Contractual necessity |
| Sending OTP codes for secure admin login | Legitimate interest (security) |
| Sending contribution reminders and claim updates | Legitimate interest |
| Sending push notifications | Consent |
| Maintaining financial records for audit purposes | Legal obligation |
| Detecting and preventing fraud | Legitimate interest |
We do not use your data for marketing, advertising or any purpose unrelated to the Society's welfare mandate.
We do not sell your personal data to any third party.
We share data only with the following trusted service providers, strictly for operational purposes:
| Service Provider | Purpose | Data Shared |
|---|---|---|
| Safaricom (M-Pesa) | Payment processing | Phone number, transaction reference |
| Cloudinary | Document storage | Claim supporting documents (images/PDFs) |
| Email/SMS provider | OTP and notifications | Phone number, email address |
All service providers are contractually bound to process your data only on our instructions and in accordance with applicable data protection law.
We may disclose data to law enforcement or regulatory authorities where required by Kenyan law or a valid court order.
| Data Category | Retention Period |
|---|---|
| Member account data | Duration of membership + 7 years |
| Financial & contribution records | 7 years (legal requirement) |
| Claim records and documents | 7 years from claim closure |
| Technical/session logs | 90 days |
| Push notification tokens | Until withdrawn or membership ends |
After the retention period, data is securely deleted or anonymised.
- All data is transmitted over encrypted HTTPS connections.
- Passwords are hashed using industry-standard algorithms and are never stored in plain text.
- Admin accounts are protected by two-factor authentication (2FA).
- Claim documents are stored on Cloudinary with access controls. Direct public URLs are not shared without authorisation.
- We conduct periodic reviews of our security practices.
- In the event of a data breach likely to result in risk to your rights and freedoms, we will notify you and the Office of the Data Protection Commissioner (ODPC) within 72 hours of becoming aware.
Under the Kenya Data Protection Act, 2019, you have the right to:
- Access — request a copy of personal data we hold about you
- Correction — request correction of inaccurate or incomplete data
- Deletion — request deletion of your data (subject to legal retention obligations)
- Objection — object to processing based on legitimate interest
- Withdrawal of Consent — withdraw consent for push notifications at any time via Platform or browser settings
- Data Portability — receive your data in a portable format where technically feasible
- Complaint — lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke
To exercise any of these rights, contact your Society administrator.
The Platform is not intended for use by persons under 18. We do not knowingly collect personal data from minors. Beneficiary data for dependants under 18 is collected solely for welfare claim purposes and handled with additional care.
We may update this Privacy Policy from time to time. Material changes will be notified via the Platform. Continued use after notification constitutes acceptance.
Data Controller: Crater SDA Welfare Society, Crater SDA Church, Nakuru, Kenya.
For privacy concerns or to exercise your rights, contact your Society administrator or email: doanemusa561@gmail.com
© 2026 Crater SDA Welfare Society · Nakuru, Kenya