Privacy Policy

When you interact with eywafrica.org we may collect the following categories of personal data:

• Contact data you provide directly — name, email address, phone number, organisation, and message content when you fill in a form (contact, partner enquiry, volunteer expression of interest, newsletter signup).
• Donation and purchase data processed by our partners on spark.eywafrica.org — billing name, email, shipping address (for physical rewards), and payment confirmation reference. Card details are handled directly by Stripe and never touch our servers.
• Technical data collected automatically — IP address (truncated where possible), device type, browser, referring URL, pages viewed, and approximate location (country/region level).
• Analytics data from Google Analytics 4 and Microsoft Clarity — anonymised session recordings, scroll depth, click events, and aggregated traffic statistics. See our Cookie Policy for details.

DRAFT — REPLACE BEFORE PUBLISHING. The lawful basis for processing each category is currently legitimate interest (analytics) or consent (marketing) — confirm with counsel.

We use personal data to:

• Respond to enquiries and follow up on partnership, volunteer, or press requests.
• Send programme updates and impact reports to people who have opted in.
• Issue receipts and acknowledgements for donations made via Spark.
• Monitor and improve the website — performance, content effectiveness, broken links.
• Comply with charitable reporting obligations in the UK and Kenya.

We do not sell, rent, or trade your personal data. We do not use it for automated decision-making or profiling.

We use a small number of cookies and similar technologies. See our Cookie Policy for the full list, why we use each one, and how to opt out.

To run the site and our programmes we rely on these processors. Each is bound by a data-processing agreement.

• Formspree — receives contact and partner-enquiry form submissions and forwards them to our team inbox.
• Cloudflare — hosts the site, provides CDN, DNS, and bot/DDoS protection. Processes IP addresses and request metadata.
• Google Analytics 4 — aggregated traffic analytics. IP anonymisation enabled.
• Microsoft Clarity — anonymised session replay and heatmaps. PII is masked by default.
• Resend — transactional email delivery (form acknowledgements, receipts).
• Stripe — payment processing for donations and purchases made via Spark. Stripe is a separate data controller for cardholder data.

We keep personal data only for as long as we need it:

• Form submissions — 24 months from last contact, then archived or deleted.
• Donation records — 7 years (HMRC and Charity Commission requirements).
• Newsletter subscriptions — until you unsubscribe.
• Analytics data — 14 months (GA4 default).

Under the UK GDPR and the Kenya Data Protection Act 2019 you have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate or incomplete data.
• Ask us to delete your data (subject to legal retention obligations).
• Object to or restrict certain processing.
• Withdraw consent at any time, where consent is the lawful basis.
• Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or the Office of the Data Protection Commissioner Kenya (odpc.go.ke).

To exercise any of the rights above, or if you have questions about this policy, email eyw@eywafrica.org. We aim to respond within 30 days.