Privacy Policy

1. Introduction

This Privacy Policy is the privacy notice of the Nyabiosi Sydiney for MP 2027 Campaign (“we,” “our,” or “us”) for the Nyaribari Chache Constituency campaign platform (the “Platform”). It explains how we collect, use, store, share, and protect personal data of constituents, agents, and other users (“you” or “data subjects”).

We process personal data in accordance with Article 31(c) and (d) of the Constitution of Kenya and the Data Protection Act, Cap. 411C (originally Act No. 24 of 2019; revised edition as at 31 December 2022) (view on Kenya Law).

This notice is issued to fulfil our duty to notify under section 29 of Cap. 411C before, or as far as practicable when, we collect personal data.

2. Data Controller and Contact Details

Under Cap. 411C, the data controller is the person who determines the purpose and means of processing personal data.

• Data controller: Nyabiosi Sydiney Campaign (Nyaribari Chache MP Aspirant 2027)
• Platform operator / contact point: Campaign administration via sydiney.com / Nyaribari Chache campaign office
• Constituency: Nyaribari Chache, Kenya
• Privacy / data requests: Contact the campaign office through official Platform channels or the contact details published on the Platform

Where we engage third parties to process data on our instructions (for example SMS, email, WhatsApp, or hosting providers), those parties act as data processors under written arrangements consistent with section 42(2) of Cap. 411C.

Where registration with the Office of the Data Protection Commissioner is required under Part III (sections 18–21), or where appointment of a Data Protection Officer is required under section 24, we will comply and publish the relevant contact details on this Platform.

3. Data Protection Principles (Section 25)

We ensure that personal data is:

• Processed in accordance with your right to privacy
• Processed lawfully, fairly, and transparently
• Collected for explicit, specified, and legitimate purposes, and not further processed incompatibly with those purposes
• Adequate, relevant, and limited to what is necessary
• Collected only where a valid explanation is provided when family or private affairs information is required
• Accurate and, where necessary, kept up to date
• Kept in identifiable form no longer than necessary for the purposes of collection
• Not transferred outside Kenya unless there are adequate safeguards or your consent, as required by Cap. 411C

4. Personal Data We Collect

Fact of collection: When you register on the Platform, give consent, or otherwise interact with campaign services, we collect and process personal data about you. Collection is primarily direct from you (section 28), except where Cap. 411C permits indirect collection (for example public records, your consent to collect from another source, or other lawful exceptions).

4.1 Ordinary personal data

• Names (first, middle, last)
• Date of birth / age indicators
• Phone number(s) and email address (if provided)
• Location details: ward, sub-location, village
• Occupation and education level (if provided)
• Voter registration status (if provided)
• Communication preferences and consent records
• Technical/security data: IP address, browser/device information, login and activity timestamps

4.2 Sensitive personal data (Part V)

Cap. 411C defines sensitive personal data to include, among other things, data revealing race, health status, ethnic social origin, conscience, belief, genetic or biometric data, property details, marital/family details, and sex or sexual orientation.

Depending on what you provide, we may process:

• Sex / gender (sensitive personal data)
• National ID number (where you voluntarily provide it for verification)
• Political opinions / campaign support or affiliation indicators (treated with heightened care as data relating to political / conscience-related engagement in a campaign context)
• Any biometric or identity images only if you voluntarily provide them and we have a lawful basis

Sensitive personal data is processed only where Cap. 411C permits — typically your express consent for specified purposes, and/or the grounds in sections 44–45 (including legitimate activities of a political body with appropriate safeguards, relating to persons in regular contact with the campaign, and without disclosure outside the campaign without consent).

5. Purposes of Processing

We process personal data only for lawful, specific, and explicitly defined purposes (section 28(3)), including:

• Registering and verifying constituents and campaign agents
• Recording and managing informed consent for campaign participation and communications
• Sending campaign updates, events, and mobilisation messages via SMS, email, or WhatsApp only where you have consented to that channel
• Organising data by ward and demographics for legitimate campaign planning
• Creating communication segments and analysing engagement (which may involve limited profiling as defined in Cap. 411C)
• Preventing fraud, securing the Platform, and maintaining audit logs
• Complying with legal obligations and responding to lawful requests
• Improving Platform accuracy (for example deduplication) and service quality

We do not use your personal data for commercial purposes unless we have obtained your express consent or are authorised by written law and have informed you, as required by section 37.

6. Voluntary or Mandatory Collection

Unless a specific legal duty requires otherwise, providing personal data on this Platform is voluntary. Collection is not generally pursuant to a statutory duty to register with us; it is for campaign engagement.

Consequences of not providing data: If you do not provide information marked as required for registration or consent, we may be unable to register you, verify your details, record your support, or contact you on your preferred channels. You may still choose not to participate.

7. Lawful Bases for Processing (Section 30)

We process personal data only where at least one of the following applies:

• Consent — you give express, free, specific, informed, and unambiguous consent by a clear affirmative action for one or more specified purposes (sections 2 and 32)
• Legal obligation — processing is necessary to comply with a legal obligation to which we are subject
• Public interest / public functions — where applicable under section 30(1)(b)
• Legitimate interests — necessary for legitimate interests we pursue (or those of a third party to whom data is disclosed), except where overridden by your rights and interests
• Contract / pre-contract steps — where relevant (for example agent or service arrangements)
• Vital interests — to protect vital interests of a natural person, where applicable

We bear the burden of proving consent (section 32(1)). You may withdraw consent at any time; withdrawal does not affect processing that was lawful before withdrawal (section 32(2)–(3)).

8. Recipients, Processors, and Disclosure

We do not sell or rent your personal data. Recipients may include:

8.1 Data processors / service providers

• SMS gateway providers
• Email service providers
• WhatsApp / messaging API providers
• Cloud hosting, storage, and security providers
• Analytics or AI text-assistance providers used to operate Platform features (where configured)

Processors may only process data on our documented instructions and must provide sufficient guarantees of organisational and technical measures (section 42). Safeguards include access controls, contractual confidentiality, and security obligations.

8.2 Campaign personnel

Authorised campaign administrators and agents may access data on a need-to-know basis for campaign purposes and are required to maintain confidentiality.

8.3 Legal disclosures

We may disclose data where required by written law, court order, or competent authority, or where necessary for establishment, exercise, or defence of legal claims.

9. Transfers Outside Kenya (Part VI)

Personal data is intended to be stored and processed primarily in connection with operations serving data subjects in Kenya. Some processors (for example cloud or messaging providers) may process data outside Kenya.

Cross-border transfers are effected only in accordance with sections 48 and 49, including where appropriate:

• Proof of appropriate safeguards for security and protection of the data
• A permitted necessity ground under section 48(c)
• For sensitive personal data, your consent and confirmation of appropriate safeguards (section 49(1))

Where the Cabinet Secretary prescribes that certain processing must occur through a server or data centre in Kenya (section 50), we will comply with those requirements.

10. Security Measures (Sections 41–42)

We implement appropriate technical and organisational measures designed to give effect to data protection principles and to protect integrity and confidentiality of personal data, including data protection by design and by default. Measures include, as appropriate:

• Access controls and role-based permissions
• Authentication and session security for authorised users
• Encryption in transit (and at rest where applied)
• Secure hosting, password protection, and database access controls
• Audit logging of relevant access and actions
• Staff/agent confidentiality expectations and limited need-to-know access
• Regular review of safeguards against foreseeable risks

No method of electronic transmission or storage is completely secure. We apply measures appropriate to the nature of the data and the risks of processing.

11. Personal Data Breach Notification (Section 43)

Where personal data is accessed or acquired by an unauthorised person and there is a real risk of harm to data subjects, we will:

• Notify the Data Commissioner without delay, and within seventy-two (72) hours of becoming aware of the breach (with reasons if delayed)
• Communicate to affected data subjects in writing within a reasonably practical period, unless identity cannot be established or communication may be delayed/restricted as permitted by section 43
• Record the facts relating to the breach, its effects, and remedial action taken

Notifications will include sufficient information for you to take protective measures, such as the nature of the breach, measures taken or proposed, and recommended steps for you.

12. Retention (Section 39)

We retain personal data only as long as reasonably necessary for the purposes of processing, unless retention is:

• Required or authorised by law
• Reasonably necessary for a lawful purpose
• Authorised or consented to by you
• For historical, statistical, journalistic, literature, art, or research purposes with appropriate safeguards

In practice, constituent and consent records are retained during the active 2027 campaign period and for a limited period thereafter (ordinarily up to two years after the election, unless a longer period is required by law or a live legal claim). When retention ends, we delete, erase, anonymise, or pseudonymise the data as appropriate.

13. Your Rights as a Data Subject

Under section 26 of Cap. 411C, you have the right:

• To be informed of the use to which your personal data is to be put
• To access your personal data in our custody
• To object to the processing of all or part of your personal data
• To correction of false or misleading data
• To deletion of false or misleading data about you

Additional rights under Cap. 411C include:

Rights may be exercised by you, or where applicable by a parent/guardian (for a minor), a duly authorised guardian/administrator, or a person you authorise (section 27).

14. Consent Management

Where processing is based on consent, consent must be an express, unequivocal, free, specific, and informed indication of your wishes by a statement or clear affirmative action (section 2 definition of “consent”).

• You may consent separately to data collection and to SMS, email, and/or WhatsApp communications
• You may withhold consent for any non-essential purpose
• You may update preferences or withdraw consent at any time
• We do not make campaign participation conditional on consent to processing that is unnecessary for that participation (section 32(4))

Campaign support / political engagement data is recorded only with appropriate consent and safeguards applicable to sensitive or politically related processing.

15. Children (Section 33)

This Platform is intended for persons who are eligible to vote ((18 years and above). We do not knowingly process personal data of a child unless consent is given by the child’s parent or guardian and processing protects and advances the child’s best interests.

We incorporate age-related checks appropriate to the Platform. If we learn that we hold a child’s data without the required parental/guardian consent, we will delete or restrict that data promptly.

16. Data Protection Impact Assessment (Section 31)

Where processing is likely to result in high risk to rights and freedoms (for example large-scale processing of constituent data, sensitive data, or systematic monitoring/segmentation), we carry out a data protection impact assessment before such processing, and consult the Data Commissioner where Cap. 411C requires.

17. Cookies and Similar Technologies

The Platform may use cookies or similar technologies to:

• Maintain authenticated sessions
• Remember preferences
• Support security and basic usage analysis

You can control cookies through your browser settings. Disabling some cookies may affect Platform functionality (for example staying logged in).

18. Changes to This Privacy Policy

We may update this notice to reflect changes in our practices or in Cap. 411C / related regulations. Material changes will be indicated by updating the “Last Updated” date and, where appropriate, by notice on the Platform or via a consented communication channel.

Please review this page periodically. Continued use of the Platform after an update means you should read the revised notice; where we rely on consent for new purposes, we will seek fresh consent as required.

19. Contact Us

For questions about this Privacy Policy or to exercise your rights:

20. Complaints to the Data Commissioner

If you are not satisfied with how we handle your personal data or respond to your requests, you may lodge a complaint with the Office of the Data Protection Commissioner (sections 8–9 of Cap. 411C).