Privacy Policy

Heaven's Home Children's Empowerment (CBO)

Last updated: 01/01/2026

1. Introduction

Heaven's Home Children's Empowerment ("Heaven's Home," "we," "us," or "our") is committed to protecting the privacy and personal data of everyone who interacts with us, including visitors to our website, donors, volunteers, guardians, partner organizations, staff, and, with the utmost care, the children in our programs.

This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and what rights you have regarding your personal data. This policy applies to our website (hhce-kenya.org), our physical programs and activities, and our internal Management Information System (MIS).

We are committed to complying with the Kenya Data Protection Act, 2019, and its accompanying regulations, and we handle all personal data, particularly data relating to children, with the seriousness that responsibility demands.

By using our website, submitting a form, registering as a volunteer, donating, or otherwise engaging with our organization, you consent to the practices described in this policy. If you do not agree with this policy, please do not provide us with personal information beyond what is necessary for basic browsing.

2. Who This Policy Covers

This policy applies to:

Visitors browsing our public website
Individuals who submit our contact form
Prospective and registered volunteers
Donors, whether one-time or recurring, individual or institutional
Guardians and families connected to our programs
Children enrolled in or benefiting from our programs, subject to the heightened protections described in Section 7
Staff and administrators using our internal Management Information System
Partner organizations, government bodies, and institutional stakeholders we work with

3. Information We Collect

We collect different categories of information depending on how you interact with us.

3.1 Information You Provide Directly

Contact form submissions: name, email address, phone number, subject, and message content
Volunteer registration: name, contact details, skills, availability, and any supporting documents (such as a resume) you choose to upload
Donations: name, email address, donation amount, date, payment/transaction reference, and, where applicable, proof of payment documentation
Newsletter or communications preferences: your email address, if you choose to provide it for updates
Program-related information: for guardians and beneficiaries directly engaged in our programs, we may collect information relevant to case management, including but not limited to household circumstances, guardian contact details, and service history, always collected and stored through our secure internal systems, not the public website

3.2 Information Collected Automatically

When you visit our website, we may automatically collect:

IP address
Browser type and version
Device type
Pages visited and time spent on our site
Referring website or search terms that led you to our site

This information is collected through standard web server logs and is used for security, troubleshooting, and understanding how our site is used, not for tracking individuals for marketing purposes.

3.3 Information We Do Not Collect Through the Public Website

We do not collect payment card details directly through our website. Donation confirmations rely on bank transfer details and proof-of-payment uploads, verified manually by our staff, not automated card processing.

4. How We Use Your Information

We use the information we collect for the following purposes:

To respond to inquiries submitted through our contact form
To process and verify donations, and to issue acknowledgments or receipts where appropriate
To register, screen, and coordinate with volunteers
To manage and deliver our programs, including education support, health and nutrition services, child protection casework, family strengthening initiatives, and residential care
To communicate with guardians, donors, volunteers, and partners regarding our programs and activities
To maintain accurate internal records for organizational accountability, reporting, and monitoring and evaluation purposes
To comply with legal, regulatory, or reporting obligations, including those required by donors, government bodies, or child protection authorities
To improve our website, services, and programs based on how they are used and the feedback we receive
To protect the safety, security, and legal rights of our organization, our staff, our beneficiaries, and the public

We do not sell, rent, or trade personal information to third parties for marketing purposes, under any circumstances.

5. Legal Basis for Processing

Where applicable under the Kenya Data Protection Act, 2019, we rely on the following legal grounds to process personal data:

Consent: for example, when you voluntarily submit a contact form, register as a volunteer, or subscribe to updates
Legitimate interest: for example, maintaining donor records for accountability and financial reporting
Legal obligation: for example, retaining certain records as required by law or by regulatory and donor compliance requirements
Protection of vital interests: particularly in child protection contexts, where sharing or processing information may be necessary to protect a child from harm

6. How We Share Your Information

We do not share your personal information with third parties except in the following limited circumstances:

Service providers: we use third-party services to operate our website and communications, including hosting providers, email delivery services (for sending contact form notifications, password resets, and donation confirmations), and payment verification tools. These providers are given access only to the information necessary to perform their function, and are expected to handle that data securely.
Partner organizations: where you have engaged with us through a joint program or initiative (for example, a community outreach event run in partnership with another organization), limited information may be shared with that partner solely for the purposes of that collaboration.
Legal and safeguarding requirements: we may disclose personal information where required by law, by a court order, or where necessary to protect the safety of a child or another individual, including reporting to relevant child protection or law enforcement authorities.
Organizational continuity: in the unlikely event of a merger, restructuring, or transfer of our operations, personal data may be transferred as part of that transition, subject to the same protections described in this policy.

We never share information about children in our care publicly, or with any third party, beyond what is strictly necessary for their protection, wellbeing, or continuity of care, and always with appropriate confidentiality and consent considerations in mind.

7. Special Protections for Children's Data

Given the nature of our work, a significant part of the information we hold relates to children who are vulnerable, and we hold this responsibility with particular seriousness.

We collect only the information about children that is genuinely necessary for their care, protection, and support.
Information about children is stored within our secure internal Management Information System, with access strictly limited to authorized staff on a need-to-know basis, determined by their specific role in casework, education support, health and nutrition, or child protection.
We do not publish identifying details, case histories, or sensitive personal information about any child on our public website without explicit, informed consent from the child's legal guardian, and, where age-appropriate, the child themselves.
Photographs or stories involving children used for public communications (such as our website, newsletters, or reports) are used only where appropriate consent has been obtained, and we take care to avoid content that could identify a child in a way that compromises their safety or dignity.
We do not use children's data for any marketing, fundraising appeal, or communication that has not been reviewed with their best interests and privacy in mind.
Guardians have the right to ask what information we hold about their child, and to request corrections where information is inaccurate, subject to our overriding obligation to protect the child's safety and wellbeing.

8. Data Security

We take reasonable technical and organizational measures to protect personal information from unauthorized access, alteration, disclosure, or destruction. These measures include:

Role-based access controls within our internal systems, ensuring staff only see the information relevant to their responsibilities
Secure hosting infrastructure with encrypted connections (HTTPS) across our website
Regular review of who has access to sensitive records, particularly those involving children, donations, and beneficiary casework
Restricted, audited access to documents containing sensitive personal information

No method of electronic storage or transmission is completely secure, and while we strive to protect your personal information, we cannot guarantee absolute security.

9. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law, donor compliance obligations, or organizational accountability standards.

Contact form submissions are retained for a reasonable period to allow follow-up, and are periodically reviewed and removed if no longer needed.
Donation records are retained in accordance with financial record-keeping obligations and good governance practice.
Volunteer records are retained for the duration of the volunteer's engagement with us and for a reasonable period afterward, in case of future re-engagement or reference needs.
Records relating to children and beneficiaries are retained in line with child protection best practice and any applicable legal or regulatory requirements, and are handled with particular care upon a child's transition out of our programs.

10. Your Rights

Under the Kenya Data Protection Act, 2019, you have certain rights regarding your personal information, including the right to:

Be informed of how your personal data is being used
Access the personal data we hold about you
Request correction of inaccurate or outdated personal data
Request deletion of your personal data, subject to our legal, safeguarding, or record-keeping obligations
Object to certain types of processing
Withdraw consent at any time, where our processing is based on consent

To exercise any of these rights, please contact us using the details in Section 13. We will respond to legitimate requests within a reasonable timeframe, and may need to verify your identity before proceeding.

Please note that in cases involving child protection, our ability to fulfill certain requests (such as deletion) may be limited where retaining information is necessary to protect a child's safety and wellbeing.

11. Cookies and Website Technologies

Our website may use cookies or similar technologies to support basic website functionality, remember preferences, and understand how visitors use our site. We do not use cookies for third-party advertising or cross-site tracking.

You can control or disable cookies through your browser settings. Disabling cookies may affect certain website features but will not prevent you from accessing our core content.

12. Third-Party Links

Our website may contain links to third-party websites, including partner organizations, donation platforms, or social media pages. We are not responsible for the privacy practices of these third-party sites. We encourage you to review the privacy policies of any external site you visit.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us:

Heaven's Home Children's Empowerment (CBO)
Email: info@hhce-kenya.org
Phone: +254790611035
Address: Omoringamu, Nyasakia, Kisii - Kilgoris Rd.

For matters specifically relating to data protection, you may also reach out to Kenya's Office of the Data Protection Commissioner (ODPC) if you believe your data protection rights have not been respected