Nyumba Yetu Privacy Policy

This policy explains how Nyumba Yetu collects, uses, and protects your personal data. We follow the UK GDPR and the Data Protection Act 2018.

Effective date: 23 September 2025

Who we are

Nyumba Yetu (“we”, “us”, “our”) is the data controller for the personal data processed through our website and services.

• Legal name: Nyumba Yetu (replace with registered name if different)
• Registered address: [Add full UK postal address]
• Email: privacy@nyumbayetu.org

Data we collect

• Identifiers – name, email address, phone number, postal address.
• Usage data – pages visited, links clicked, referring pages, approximate location (from IP), device and browser information.
• Communication data – messages you send us (e.g., via forms or email).
• Donations & payments – amount, date/time, and transaction references handled by our payment provider (we do not store full card details).
• Cookies – small files used for core site functions and analytics (see Cookies).

How we use your data

• Provide our website, respond to enquiries, and deliver requested services.
• Process donations and send confirmations/receipts.
• Improve site performance and content through analytics.
• Send updates or newsletters when you opt in (you can unsubscribe anytime).
• Keep our services secure and detect/prevent fraud.

Lawful bases

• Consent – for optional cookies and marketing emails.
• Contract – to provide services you request.
• Legitimate interests – to improve our site and communicate with you about similar services, balanced against your rights.
• Legal obligation – to meet compliance and record‑keeping requirements (e.g., charitable/donation records).

Cookies & analytics

We use essential cookies to make the site work. With your consent, we may use analytics cookies to understand site usage and improve our content. You can change your preferences at any time via the cookie banner or your browser settings.

Sharing your data

We do not sell your data. We share limited personal data with trusted service providers (e.g., web hosting, analytics, payment processing) under contracts that require them to protect your information and use it only for our instructions.

International transfers

If any provider stores data outside the UK, we ensure appropriate safeguards are in place (such as UK International Data Transfer Agreement or other approved mechanisms).

Data retention

We keep personal data only as long as necessary for the purposes described above, including satisfying legal, accounting, or reporting requirements. Typical retention: enquiries up to 24 months; donation records up to 7 years.

Security

We use technical and organisational measures to protect your data, including encryption in transit (HTTPS), access controls, and regular updates. No method is 100% secure; if a breach occurs, we will act promptly and, where required, notify you and the ICO.

Your rights (UK)

• Access your data and get a copy.
• Correct inaccurate data.
• Delete data in certain circumstances.
• Restrict or object to processing.
• Data portability for information you provided to us.
• Withdraw consent at any time (where processing is based on consent).
• Lodge a complaint with the UK Information Commissioner’s Office (ICO): ico.org.uk.

Children

Our website is not intended for children under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it where appropriate.

Third‑party links

Our website may link to external sites. We are not responsible for their privacy practices. We recommend reviewing their policies.

Changes to this policy

We may update this policy from time to time. We will post the new version on this page and update the effective date above.

Contact us

Questions or requests about this policy or your data? Email privacy@nyumbayetu.org or write to us at [Add full UK postal address].