Privacy Policy

1. Data We Collect

We may collect and process the following types of data:

• User Data: Name, email, phone number, organization, role, login credentials, access logs
• Project Data: Surveys, indicators, reports, LogFrames, theories of change, dashboards
• Device & Usage Data: IP address, browser type, device ID, OS version, error logs
• Payment Data: Transaction references, timestamps, payment provider metadata (via Pesapal & M-Pesa and open exchange)
• Metadata: Audit trails, timestamps, data versioning

2. Data Collection Sources

We collect data through:

• Online forms
• KoboToolbox surveys, uploaded datasets (CSV, JSON, Excel)
• System logs, cookies, and usage tracking
• Payment integrations with Pesapal and Safaricom M-Pesa
• Communication with our support team

3. Purpose of Data Use and Lawful Basis

4. Data Sharing and Transfers

We do not sell your data. We share it only:

• With Google Cloud for secure hosting (ISO 27001 compliant)
• With KoboToolbox and integrated tools
• Through authorized APIs
• With payment providers (Pesapal, Safaricom)
• With regulators when legally required
• With developers or consultants under strict NDA

International Transfers: Data may be processed outside Kenya, including in the EU and U.S. We use Standard Contractual Clauses (SCCs) and equivalent safeguards to ensure lawful transfers.

5. Data Security

• Encryption: SSL/TLS (in transit) and AES-256 (at rest)
• Access Controls: Role-based access, audit logging
• Storage: Secure, geo-redundant backups via Google Cloud
• Monitoring: Security audits, breach detection, penetration testing

6. User Rights

Under GDPR and ODPC, you have the right to:

• Access, correct, or delete your data
• Withdraw consent
• Object to processing
• Data portability
• File a complaint with the ODPC or an EU Data Protection Authority

To exercise these rights, contact us at: info@evaluate4change.com

7. Data Retention

• Data is retained for up to 5 years after account inactivity
• Payment data is retained for 7 years for financial compliance
• After the retention period, data is deleted securely

8. Cookies

We use the following cookies:

Users can manage cookie preferences via browser settings. Consent is obtained via our cookie banner.

9. Children's Data

We do not knowingly collect data from persons under 18 without verified parental consent. Where beneficiaries include minors, organizations must obtain appropriate consent as per Section 33 of Kenya's Data Protection Act.

10. Breach Notification

In the event of a breach, we will notify affected users and the ODPC within 72 hours in accordance with legal requirements.

11. Data Controller/Processor Roles

When organizations use our platform for Monitoring, Evaluation and Learning projects:

• The client is the Data Controller
• Evaluate4Change is the Data Processor

We enter into Data Processing Agreements (DPAs) to define roles and responsibilities.

12. Changes to This Policy

We may revise this policy. Changes will be posted on our website with an updated date. Continued use indicates acceptance of changes.

13. Data Protection Officer (DPO)

Dorcas Wambui Nyanjui, Director of Evaluate4Change, is our appointed DPO. Contact via: info@evaluate4change.com