Effective date: 07 September 2026
Data controller: Wezesha Africa Organisation
Contact: info@wezeshaafrica.org

1. Introduction

This Privacy Policy explains how Wezesha Africa Organisation (“we”, “us”, “our”) collects, uses, discloses, and safeguards personal data when you visit https://wezeshaafrica.org/ (the “Website”), use our services, make purchases, or otherwise interact with us online or offline.

We are committed to protecting your privacy and complying with the Data Protection Act, 2019 (Kenya) and applicable data protection laws in the East African Community and other jurisdictions where we operate.

2. Personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data:

  • Identity and contact data: name, email address, phone number.
  • Delivery data: delivery/shipping address (where applicable for orders).
  • Transaction data: information about payments and purchases (handled by third‑party payment processors; we do not store full card numbers or mobile money PINs).
  • Communications data: messages you send to us, including support queries and feedback.
  • Technical and usage data: IP address, browser type, device information, pages viewed, referring URLs, and similar data collected via cookies and similar technologies.
  • Marketing data: preferences for receiving communications from us and our partners, and records of your interactions with our emails and SMS.

We do not intentionally collect special categories of personal data (such as health, biometric, political, religious, or ethnic data) unless strictly necessary and with additional safeguards and consent where required.

3. How we use your personal data (purposes and lawful bases)

We process personal data only where we have a lawful basis under the Data Protection Act, 2019. Our main purposes and corresponding lawful bases include:

  • Providing and managing services and orders: to process purchases, deliver goods/services, manage accounts, and provide customer support.
  • Communications and marketing: to send newsletters, updates, event invitations, and promotional communications (where you have opted in or where permitted by law).
  • Website operation and improvement: to analyse usage, improve functionality, personalise content, and maintain security.
  • Legal and regulatory compliance: to comply with applicable laws, tax, accounting, and regulatory obligations, and to respond to lawful requests by authorities.
  • Fraud prevention and security: to detect, prevent, and investigate fraud, abuse, or security incidents.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

4. Cookies and similar technologies

We use cookies and similar technologies to:

  • Ensure the Website functions correctly (strictly necessary cookies).
  • Understand how visitors use the Website (analytics cookies).
  • Remember your preferences (functional cookies).
  • Deliver relevant advertising and measure campaign performance (advertising cookies).

You can manage cookie preferences via our cookie banner and your browser settings. Disabling certain cookies may affect Website functionality.

5. Sharing and disclosure of personal data

We may share personal data with:

  • Service providers and processors: hosting providers, email/SMS platforms, analytics providers, payment processors (e.g., Paystack, M‑Pesa, Airtel Money), logistics/courier partners, and IT support. These parties process data on our instructions and under data processing agreements.
  • Legal and regulatory authorities: where required by law, court order, or to protect our rights, safety, or those of others.
  • Affiliates and partners: only where you have consented or where necessary to fulfil a service you requested.

We do not sell your personal data to third parties.

6. Cross‑border transfers

Some of our service providers may store or process data outside Kenya (for example, cloud, email, or analytics providers in the US, EU, or elsewhere). Where this occurs, we implement appropriate safeguards, such as contractual clauses and due diligence, to ensure an adequate level of protection in line with the Data Protection Act and applicable international frameworks.

7. Data retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, unless a longer retention period is required or permitted by law.

  • General rule: we retain personal data for up to 12 months from the date of your last active interaction or transaction, after which it is securely deleted or anonymised, unless legal, tax, or regulatory obligations require longer retention.

8. Data security

We implement reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including encryption, access controls, secure storage, and staff training. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner (ODPC) within 72 hours and, where required, notify affected individuals.

9. Your rights as a data subject

Under the Data Protection Act, 2019, you have the right to:

  • Be informed about how your data is used (this policy).
  • Access your personal data.
  • Request correction of inaccurate or incomplete data.
  • Request deletion (erasure) of your data in certain circumstances.
  • Restrict or object to processing.
  • Data portability (receive your data in a structured, commonly used format).
  • Withdraw consent at any time (where processing is based on consent).
  • Lodge a complaint with the ODPC.

To exercise these rights, contact us at info@wezeshaafrica.org. We aim to respond within statutory timelines (for example, within 7 days for access requests where practicable, and otherwise within the periods prescribed by law).

10. Children’s privacy

The Website is not directed at children under 13. We do not knowingly collect personal data from children under 13 without parental or guardian consent. If we become aware that we have collected such data without appropriate consent, we will take steps to delete it.

11. Third‑party links

Our Website may contain links to third‑party websites, apps, or services (including payment processors and social media). This Privacy Policy does not apply to those third parties. We encourage you to review their privacy policies before providing any personal data.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. The updated version will be posted on the Website with a revised “Effective date”. We encourage you to review this policy periodically.

13. Contact details

For any questions, requests, or complaints regarding this Privacy Policy or our data practices, please contact:

Wezesha Africa Organisation
Email: info@wezeshaafrica.org

You may also contact the Office of the Data Protection Commissioner (ODPC) in Kenya for concerns that are not resolved directly with us.