1. Introduction

Naretu Initiatives Organization ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or engage with our services.

We respect your privacy and are dedicated to handling your personal information responsibly and in compliance with applicable data protection laws, including the Kenya Data Protection Act, 2019.

2. Information We Collect

We may collect the following types of information:

• Personal Information: Name, email address, phone number, postal address, and other contact details you provide when donating, volunteering, or contacting us.
• Donation Information: Payment details, billing address, and donation history. Note: Payment card information is processed securely by our payment processors and is not stored on our servers.
• Technical Information: IP address, browser type, device information, operating system, and browsing behavior on our website.
• Communication Records: Emails, messages, and feedback you send to us.

3. How We Collect Information

We collect information through:

• Direct interactions when you fill out forms, make donations, or communicate with us
• Automated technologies such as cookies and similar tracking technologies
• Third-party service providers who assist with payment processing and website analytics

4. How We Use Your Information

We use your personal information for the following purposes:

• Processing donations and issuing receipts
• Communicating with you about our programs, events, and impact
• Sending newsletters and updates (with your consent)
• Responding to your inquiries and providing support
• Improving our website and services
• Complying with legal obligations
• Preventing fraud and ensuring security

5. Legal Basis for Processing

We process your personal information based on:

• Consent: When you have given us explicit permission to process your data for specific purposes
• Contract: When processing is necessary for a contract with you
• Legal Obligation: When we are required to comply with the law
• Legitimate Interests: When processing is necessary for our legitimate interests, provided your rights do not override these interests

6. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information with:

• Service Providers: Payment processors, email service providers, and IT support who assist our operations
• Legal Authorities: When required by law, court order, or government regulation
• Professional Advisors: Lawyers, auditors, and insurers when necessary

All third parties are contractually obligated to protect your information and use it only for specified purposes.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• SSL encryption for data transmission
• Secure server infrastructure
• Regular security assessments
• Access controls and authentication procedures
• Staff training on data protection

However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including:

• Legal and accounting requirements (typically 7 years for financial records)
• Ongoing communication preferences
• Establishing, exercising, or defending legal claims

When no longer needed, your information is securely deleted or anonymized.

9. Your Rights

Under data protection laws, you have the following rights:

• Right to Access: Request copies of your personal information
• Right to Rectification: Request correction of inaccurate information
• Right to Erasure: Request deletion of your information in certain circumstances
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or direct marketing
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, please contact us using the details provided below.

10. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to enhance your browsing experience, analyze site traffic, and understand user behavior.

Types of cookies we use:

• Essential Cookies: Necessary for the website to function properly
• Analytical/Performance Cookies: Help us understand how visitors interact with our website
• Functionality Cookies: Remember your preferences and settings

You can manage cookie preferences through your browser settings. However, disabling certain cookies may affect website functionality.

11. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.

12. Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately so we can delete it.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:

• Posting the updated policy on this page with a revised "Last Updated" date
• Sending email notifications to registered users
• Displaying prominent notices on our website

Your continued use of our services after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to your inquiry within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Persona Data Protection Commission (Tanzania).