Privacy Policy

Grace Calvary Ministries is committed to protecting and respecting your privacy. This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and your rights under the Data Protection Act, 2019 (Kenya).

Effective date

This policy is effective from September 22, 2025. We may update it from time to time; the "Last updated" date at the top of this page will reflect any changes.

1. Information we collect

We collect personal data that you provide directly to us and data we collect automatically when you use our site.

• Personal information you provide: name, email address, phone number, postal address, and any other information you provide when you donate, subscribe, or contact us.
• Payment information: when you make a donation we collect the details necessary to process the payment (for example, payment token, transaction reference). We do not store full card numbers on our servers. Payment card data is processed by our payment provider. See section Payment processing below.
• Usage and technical data: IP address, browser type, device information, pages visited, and other analytics data collected automatically via cookies and similar technologies.

2. How we use your information

We use personal data for these main purposes:

• To process donations and issue receipts.
• To communicate with you about your donation, our programs, events, and ways to help.
• To administer subscriptions, newsletters and to respond to enquiries.
• To comply with legal, accounting and reporting obligations.
• To improve our website, security and services (including analytics and fraud prevention).

3. Legal basis for processing

Under the Data Protection Act 2019, we rely on one or more lawful bases to process personal data, including:

• Consent — for marketing communications and newsletters (you can withdraw consent at any time).
• Performance of a contract / provision of a service — to process donations and provide donor receipts.
• Legal obligations — to retain financial records and meet accounting or regulatory requirements.
• Legitimate interests — for fraud prevention, site security, and improving our services, where those interests do not override your rights.

4. Payment processing and billing descriptor

We use third-party payment processors to take donations. These providers process card payments and mobile-money transactions on our behalf. We do not store full card PANs (primary account numbers) on our servers.

Payment provider: (PAYPLA, ABSA). Please contact the payment provider for details about how payment data is handled and for their privacy practices.

Billing descriptor: The name shown on your bank or card statement is set by the payment acquirer. Charges from donations will generally appear as: GRACE CALVARY MINISTRIES or as directed by our processor.

5. Sharing and disclosure

We will not sell your personal data. We may share personal data with:

• Payment processors and acquirers (to process donations).
• Service providers who host our website, send emails, provide analytics, or assist with operations.
• Professional advisers such as auditors and legal advisers when necessary.
• Law enforcement or regulators if required by law or to respond to legal process.

6. Data security

We take reasonable technical and organisational steps to protect personal data. Measures include use of HTTPS (TLS/SSL), access controls, data encryption where appropriate, and staff training. However, no internet transmission is completely secure. If you suspect misuse of your data, contact us immediately.

For payment card security, we rely on our payment providers' PCI-DSS controls. We do not store full card numbers on our site or servers.

7. Cookies and tracking technologies

We use cookies and similar technologies to operate the site, remember your preferences and collect analytics. Cookies may be:

• Essential cookies — required for site functionality.
• Performance and analytics cookies — used to improve the site and monitor usage.
• Marketing cookies — used to deliver relevant messages and measure campaigns.

You can control cookies through your browser settings and opt out of some analytics via browser-based opt-outs. Disabling essential cookies may affect site functionality.

8. Data retention

We retain personal data only as long as necessary for the purposes set out in this policy or to meet legal and accounting requirements.

• Donation and financial records: retained for at least 7 years for accounting and audit purposes.
• Newsletter / marketing lists: retained until you unsubscribe or request deletion.
• Website logs and analytics: retained for up to 12 months unless needed for security or legal purposes.

Please contact us if you need a different retention arrangement for legal reasons.

9. Your rights

You have rights under the Data Protection Act, including:

• Access — you can ask for a copy of your personal data.
• Correction — you can ask that inaccurate data be corrected.
• Deletion — you can ask us to delete your data in some circumstances.
• Restriction and objection — you can ask us to restrict or object to certain processing.
• Portability — you can request your data in a structured, machine-readable format.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time (this will not affect processing already lawfully carried out).

To exercise these rights, contact our Data Protection Officer at: phinora@gracecalvaryministries.org. We will respond to requests in line with the Data Protection Act timelines.

10. International transfers

Some of our service providers may transfer or store data outside Kenya. Where data is transferred outside Kenya, we will ensure appropriate safeguards are in place to protect your data in accordance with applicable law.

11. Children

Our website is not intended for children under 18. We do not knowingly collect or process personal data of children under 18. If you believe we have accidentally collected such data, please contact us and we will delete it promptly.

12. Complaints

If you have a concern about how we process your data please contact us at phinora@gracecalvaryministries.org. You also have the right to complain to the Office of the Data Protection Commissioner (Kenya).

13. Changes to this policy

We may update this policy. Any changes will be posted on this page with an updated effective date. We recommend you check this page periodically.

14. Contact details

Grace Calvary Ministries
Address: Kakamega, Kenya
Phone: +254 708 390 749
Data Protection Officer: phinora@gracecalvaryministries.org

Last updated: September 22, 2025.