Wema Bukembe Development Organization (WBDO) Data Protection Policy

Policy Number: WBDO-DPP-2025 Version: 1.0 Effective Date: August 5, 2025 Review Date: August 5, 2026

1. Introduction

Wema Bukembe Development Organization (WBDO) is a non-profit organization dedicated to empowering children and communities across Kenya through educational sponsorship and sports initiatives. We are committed to protecting the privacy of all individuals whose personal data we process, including children, their guardians, our donors, and our employees. This Data Protection Policy outlines our commitment to ensuring the lawful, fair, and secure processing of personal data in accordance with the Data Protection Act, 2019, and its subsidiary regulations. WBDO operates as a

Data Controller, which means we determine the purpose and means of processing personal data in our operations.

2. Scope and Applicability

This policy applies to all personal data and sensitive personal data processed by WBDO, regardless of how it is collected, stored, or used. This includes data from our Educational Sponsorship Program and the Wema Girls Cup initiative. The policy is binding on all WBDO employees, volunteers, contractors, and any third-party partners who process personal data on our behalf.

3. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person.
• Sensitive Personal Data: Data revealing a natural person’s race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, family details, or sexual orientation.
• Data Subject: An identified or identifiable natural person who is the subject of personal data.
• Data Controller: A person or body that, alone or jointly with others, determines the purpose and means of processing personal data.
• Processing: Any operation performed on personal data, such as collection, storage, adaptation, retrieval, use, disclosure, or destruction.

4. Data Protection Principles

WBDO adheres to the following principles as mandated by the Data Protection Act, 2019:

• Lawfulness, Fairness, and Transparency: We will process personal data lawfully, fairly, and in a transparent manner. We will ensure that data subjects are informed of how their data will be used and what their rights are through clear privacy notices.
• Purpose Limitation: We collect personal data for specified, explicit, and legitimate purposes only. For example, data for our sponsorship program is for eligibility verification and reporting, and data for the Wema Girls Cup is for promotion and fundraising. We will not process it further in a manner incompatible with those purposes.
• Data Minimisation: We will ensure that the personal data we collect is adequate, relevant, and limited to what is necessary for our stated purposes.
• Accuracy: We will take reasonable steps to ensure that personal data is accurate, up-to-date, and complete. Data subjects have the right to have inaccurate data about them corrected or erased.
• Storage Limitation: We will not retain personal data for longer than is necessary to achieve the purposes for which it was collected. We will have a clear data retention policy and securely destroy data once it is no longer needed.
• Integrity and Confidentiality: We will process personal data in a manner that ensures its security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.
• Accountability: WBDO is responsible for complying with the DPA and for demonstrating that compliance.

5. Data Subject Rights

WBDO is committed to respecting and facilitating the exercise of all data subject rights.

• Right to be Informed: Data subjects have the right to be informed that their data is being collected and the purpose for which it is being processed.
• Right to Access: Data subjects have the right to request access to their personal data held by WBDO.
• Right to Rectification or Erasure: Data subjects have the right to have inaccurate data corrected or to have their data deleted if there is no legitimate reason for its continued processing.
• Right to Object: Data subjects have the right to object to the processing of their personal data.
• Right to Withdraw Consent: Consent can be withdrawn at any time, without affecting the lawfulness of processing that occurred before the withdrawal.
• Right to Data Portability: Data subjects have the right to receive their personal data in a structured, commonly used, and machine-readable format.

6. Specific Processing Activities

• Consent for Minors’ Data: WBDO will obtain explicit, specific, and informed consent from a parent or legal guardian for the processing of any personal and sensitive data of a minor. This includes separate consent for the use of identifiable images and videos for promotional purposes.
• Cross-Border Data Transfers: All transfers of personal data outside of Kenya have been temporarily suspended. We will only resume transfers after implementing appropriate safeguards and, where required, obtaining explicit approval from the ODPC.
• High-Risk Processing: We recognize that our processing activities involving sensitive personal data of minors constitute a high risk. We are therefore conducting a Data Protection Impact Assessment (DPIA) to identify, assess, and mitigate these risks.

7. Data Security and Breach Management

WBDO has implemented a combination of technical, organizational, and physical safeguards to ensure the integrity and confidentiality of personal data.

• Technical Safeguards: Include data encryption, strong access controls, multi-factor authentication for sensitive systems, and the use of firewalls and antivirus software.
• Organizational Safeguards: Include mandatory data protection training for all personnel, a documented Security Incident Response Plan, and the enforcement of data-sharing agreements with third-party vendors and partners.
• Physical Safeguards: Include secure storage of any physical documents, a “clean desk” policy for remote staff, and a procedure for the secure destruction of physical data.

In the event of a personal data breach, WBDO will notify the ODPC without delay and within

72 hours of becoming aware of the breach, as well as the affected data subjects in a timely manner.

8. Policy Governance

This policy will be reviewed annually to ensure its continued relevance and effectiveness. All WBDO personnel are required to participate in mandatory data protection training.

Contact Information: For any questions or concerns regarding this policy or to exercise your rights as a data subject, please contact us on info@wemabdo.org or reach us on 0784084692