Skip to main
Donate

Privacy Policy

Privacy Notice 

Last Updated: 1 September 2026 

1. Introduction 

inABLE is committed to respecting privacy and protecting personal data. 

This Privacy Notice explains how inABLE collects, uses, stores, shares and protects personal data when individuals: 

  • Visit or interact with our website
  • Make a donation
  • Subscribe to newsletters or organizational updates
  • Register for an event, conference, programme or training activity
  • Complete an application, survey or online form
  • Contact us or request information
  • Participate in our programmes, research, interviews or monitoring and evaluation activities
  • Contribute a photograph, video, audio recording, quotation, testimonial or impact story
  • Engage with us as a donor, partner, volunteer, consultant, applicant, beneficiary, parent, guardian, educator or other stakeholder 

inABLE processes personal data in accordance with applicable data-protection laws, including the Kenya Data Protection Act, 2019 and its implementing regulations, and applicable laws of the United States

This Notice applies to inABLE’s website and related online and organizational interactions. A separate or supplementary privacy notice may be provided for a particular programme, research project, event, application, partnership or media activity where more specific information is required. 

2. Who Is Responsible for Your Personal Data? 

inABLE acts as a data controller when it determines why and how personal data will be processed. 

Privacy Contact: [email protected]. Privacy enquiries and requests to exercise data-protection rights may be submitted using the contact details above. 

3. Personal Data We Collect 

The personal data we collect depends on how an individual interacts with inABLE. 

3.1 Contact and identification information 

This may include: 

  • Name
  • Email address
  • Telephone number
  • Postal or physical address
  • Country or location
  • Organization
  • Job title or professional affiliation 

3.2 Donation and transaction information 

This may include: 

  • Donation amount 

  • Transaction date 

  • Transaction reference 

  • Billing and contact information 

  • Receipt and communication preferences 

  • Limited payment-status information received from a payment provider 

Complete payment-card details, mobile-money credentials and online-banking passwords are processed by the applicable payment provider. inABLE does not intentionally store complete payment-card numbers or payment-security codes on its website or servers. 

3.3 Programme, event and application information 

This may include: 

  • Programme or event registration details 

  • School, institution or organization 

  • Age or age range 

  • Parent or guardian information 

  • Accessibility and reasonable-accommodation requirements 

  • Participation and attendance information 

  • Application responses 

  • Supporting documents 

  • Feedback and survey responses 

  • Programme outputs and outcomes 

3.4 Communication information 

This may include: 

  • Enquiries and messages 

  • Communication preferences 

  • Newsletter subscription information 

  • Records of consent or withdrawal 

  • Communication history 

  • Feedback and complaints 

3.5 Photographs, video, audio and stories 

Where an appropriate legal basis has been established, we may process: 

  • Photographs 

  • Video and audio recordings 

  • Interview responses 

  • Quotations 

  • Testimonials 

  • Impact stories 

  • Programme experiences and outcomes 

3.6 Website and technical information 

When an individual uses our website, we may collect: 

  • Internet Protocol address 

  • Browser and device type 

  • Operating system 

  • Pages visited 

  • Website interactions 

  • Referral source 

  • Date, time and approximate duration of a visit 

  • Cookie identifiers and preference settings 

  • Website security and diagnostic information 

4. Sensitive Personal Data 

Some inABLE activities may involve sensitive personal data, including information concerning a person’s health, disability-related needs, family details or other information treated as sensitive under applicable law. 

Educational, safeguarding and programme information may also require heightened protection depending on its content, context and connection to an identifiable person. 

inABLE will process sensitive personal data only: 

  • For a specific and lawful purpose 

  • Where processing is permitted under applicable law 

  • Using only the information reasonably necessary for that purpose 

  • With appropriate access restrictions and security safeguards 

  • With explicit consent where required 

  • Subject to any additional safeguards required by law 

We will not use accessibility or disability-related information for an unrelated purpose without establishing an appropriate legal basis. 

5. Information About Children 

Some inABLE programmes involve children and learners under the age of 18. 

When processing a child’s personal data, inABLE will take reasonable and appropriate measures to: 

  • Prioritize the child’s best interests 

  • Explain the intended processing in clear, age-appropriate and accessible language 

  • Obtain and verify the consent or authority of a parent or legal guardian where required by law 

  • Seek the child’s views or assent where appropriate 

  • Collect only information necessary for the specified purpose 

  • Implement suitable safeguarding, security and access controls 

  • Apply reasonable age-verification and guardian-verification measures 

  • Enable the child’s rights to be exercised in accordance with applicable law 

  • Consider whether using the child’s name, image, voice, school, disability information or story could expose the child to foreseeable harm, stigma or unwanted identification 

Consent to participate in an inABLE programme is separate from consent to use a child’s photograph, image, voice, quotation or story in fundraising, communications, publicity or media activities. 

Refusing consent for optional media or publicity use will not, by itself, prevent a child from participating in a programme. 

6. How We Collect Personal Data 

We may collect personal data: 

  • Directly from the individual 

  • From a parent, guardian or authorized representative 

  • From a teacher, school, partner or programme implementer 

  • Through website forms, applications, surveys, registrations and donation pages 

  • During programme delivery, events, conferences, interviews and research 

  • Through photography, video, audio or written documentation where appropriately authorized 

  • From payment processors and other service providers 

  • Automatically through cookies and similar website technologies 

  • From publicly available sources where collection is lawful, fair and appropriate 

Where personal data is obtained from another source, inABLE will provide relevant privacy information to the individual where required by law. 

7. How and Why We Use Personal Data 

inABLE may use personal data to: 

  • Process donations and issue receipts 

  • Respond to enquiries, complaints and requests 

  • Register individuals for programmes, training, conferences and events 

  • Deliver, administer and improve programmes and services 

  • Provide accessibility support and reasonable accommodations 

  • Manage partnerships, volunteers, consultants and other stakeholder relationships 

  • Assess applications and expressions of interest 

  • Conduct research, monitoring, evaluation and learning activities 

  • Measure and report programme results and organizational impact 

  • Prepare and communicate approved impact stories 

  • Send newsletters, event information, campaign updates and fundraising communications 

  • Maintain the security, functionality, accessibility and performance of our website 

  • Prevent fraud, misuse and security incidents 

  • Maintain organizational, financial and consent records 

  • Meet contractual, legal, regulatory and safeguarding obligations 

  • Establish, exercise or defend legal claims 

inABLE will not use personal data for a new and incompatible purpose unless permitted by law and, where required, appropriate additional notice or consent has been provided. 

8. Legal Bases for Processing 

Depending on the activity, inABLE may rely on one or more of the following legal bases: 

Consent

We may rely on consent for activities such as: 

  • Optional newsletters and fundraising communications 

  • Photography, video, audio, testimonials and public impact stories 

  • Certain surveys or research activities 

  • Processing sensitive personal data where explicit consent is required 

Consent must be freely given, specific and informed. Where processing relies on consent, the individual may withdraw it at any time. Withdrawal will not affect processing that was lawful before withdrawal. 

Contract or steps requested before a contract 

This basis may apply where processing is necessary to: 

  • Administer an event or programme registration 

  • Manage a donation 

  • Process an application 

  • Provide a requested service 

  • Manage a consultancy, volunteer or partnership arrangement 

Legal obligation 

We may process information where necessary to meet applicable: 

  • Financial and accounting duties 

  • Tax requirements 

  • Regulatory responsibilities 

  • Safeguarding responsibilities 

  • Lawful court orders or official requests 

Legitimate interests 

We may process personal data where necessary for a legitimate organizational purpose, including: 

  • Maintaining website and information security 

  • Preventing fraud 

  • Managing stakeholder relationships 

  • Improving programmes and services 

  • Maintaining appropriate organizational records 

Before relying on legitimate interests, inABLE will consider the purpose, necessity and potential effect of the processing on the individual’s rights and freedoms. 

Vital interests 

We may process personal data where necessary to protect a person’s life, health or safety. 

Public interest or another lawful basis 

Where applicable, we may rely on a public-interest ground or another processing basis permitted by law. 

9. Research, Monitoring and Evaluation 

Where personal data is processed for research, monitoring, evaluation or learning, inABLE will provide participants with information appropriate to the activity, including: 

  • The purpose of the activity 

  • The information being collected 

  • How the information will be used 

  • Intended recipients 

  • Applicable retention arrangements 

  • Whether participation is voluntary 

  • Applicable rights and withdrawal arrangements 

  • Any relevant risks or safeguards 

Depending on the activity, safeguards may include: 

  • Data minimization 

  • Restricted access 

  • Confidentiality obligations 

  • Secure storage 

  • Pseudonymization 

  • Anonymization 

  • Ethical or organizational review 

  • A data-protection impact assessment where required 

Research participation does not automatically authorize inABLE to publish an identifiable participant’s image, identity, quotation or story. 

10. Donations and Payment Security 

Online donations are processed through third-party payment providers. 

Payment providers process payment information under their own privacy, security and service terms. Donors should review the provider’s privacy information before completing a transaction. 

inABLE may retain: 

  • Donor contact information 

  • Donation amount 

  • Transaction date and reference 

  • Payment status 

  • Receipt records 

  • Communication preferences 

This information may be used for financial administration, fraud prevention, reporting, donor communication and legal compliance. 

11. Fundraising and Marketing Communications 

Subject to applicable law and the individual’s communication choices, inABLE may send: 

  • Newsletters 

  • Programme updates 

  • Event announcements 

  • Fundraising appeals 

  • Campaign information 

  • Impact stories 

  • Opportunities to donate, volunteer, partner or participate 

Where consent is required, inABLE will request it before sending promotional communications. 

Recipients may unsubscribe at any time by: 

  • Selecting the unsubscribe link in an email 

  • Updating available communication preferences 

  • Contacting inABLE using the details in Section 2 

We may retain limited information about an opt-out request so that the preference continues to be respected. 

12. Cookies and Similar Technologies 

Our website may use cookies and similar technologies to: 

  • Operate essential website functions 

  • Protect website security 

  • Remember accessibility and display preferences 

  • Understand website use and performance 

  • Diagnose technical problems 

  • Measure the effectiveness of content and campaigns 

Strictly necessary cookies may be used to operate and secure the website. 

Where legally required, non-essential analytics, advertising or tracking technologies will not be activated until the visitor has been provided with appropriate information and a meaningful choice. 

Visitors may manage cookie preferences through the website’s cookie-preference tool, where available, and through their browser settings. 

Details of the cookies and similar technologies we use, including their providers, purposes and retention periods, are available in our cookie-preference tool, which you can open at any time from the link at the bottom of every page

13. When We Share Personal Data 

inABLE does not sell or rent personal data. 

We may share limited personal data with: 

  • Payment and donation-processing providers 

  • Website hosting, security and maintenance providers 

  • Analytics and communications platforms 

  • Event-registration and programme-management providers 

  • Professional advisers, auditors, insurers and legal advisers 

  • Research, monitoring and evaluation partners 

  • Funders and programme partners, normally using aggregated, anonymized or de-identified information where practical 

  • Government authorities, regulators, courts or law-enforcement bodies where disclosure is legally required 

  • Other parties authorized by the individual 

Service providers and partners will receive only the information reasonably necessary for the relevant purpose. Where required, they will be subject to appropriate confidentiality, security and data-processing obligations. 

Participation in an inABLE programme does not, by itself, authorize public use of a person’s identifiable photograph, image, voice, quotation, video or impact story. 

14. International Transfers 

Some service providers may process personal data outside Kenya. 

Where inABLE transfers personal data outside Kenya, it will use a transfer basis permitted under applicable law and apply appropriate safeguards. Depending on the circumstances, these may include: 

  • Assessing the protection available in the receiving country 

  • Entering into appropriate contractual arrangements 

  • Carrying out a transfer or data-protection impact assessment 

  • Obtaining consent where legally appropriate 

  • Using another transfer mechanism recognized by law 

  • Maintaining appropriate records of the transfer 

inABLE will take reasonable steps to identify the purpose, recipient, destination and safeguards applicable to a transfer.

15. Data Retention 

inABLE retains personal data only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, financial, accounting, reporting, contractual, safeguarding and dispute-resolution requirements. 

Retention decisions may consider: 

  • The nature and sensitivity of the information 

  • The purpose of processing 

  • Legal and contractual requirements 

  • Safeguarding considerations 

  • Consent and withdrawal records 

  • The potential risk created by continued retention 

  • Whether the information can be securely anonymized 

Retention periods are maintained through inABLE’s records-retention arrangements. When personal data is no longer required, it will be securely deleted, destroyed or anonymized. 

16. Data Security and Personal-Data Breaches 

inABLE applies reasonable technical and organizational safeguards designed to protect personal data against: 

  • Unauthorized access 

  • Accidental loss 

  • Misuse 

  • Alteration 

  • Unauthorized disclosure 

  • Destruction 

Safeguards may include: 

  • Access controls 

  • Secure systems and storage 

  • Confidentiality requirements 

  • Backups 

  • Security updates 

  • Encryption where appropriate 

  • Staff awareness and training 

  • Incident-response procedures 

No internet transmission or storage system can be guaranteed to be completely secure. 

If a personal-data breach occurs, inABLE will document and assess the incident, take reasonable steps to contain and address it, and notify the Office of the Data Protection Commissioner and affected individuals where notification is required by applicable law.

17. Your Data-Protection Rights 

Subject to applicable legal conditions and exemptions, individuals have the right to: 

  • Be informed about how their personal data is used 

  • Request access to their personal data 

  • Request correction of inaccurate or incomplete information 

  • Object to certain processing 

  • Withdraw consent where processing is based on consent 

  • Request deletion or erasure where legally applicable 

  • Request restriction of processing where applicable 

  • Request portability of eligible personal data 

  • Raise a complaint about the handling of their personal data 

  • Seek review of certain decisions based solely on automated processing 

Requests may be submitted using the contact details in Section 2. 

To protect personal data, inABLE may request information reasonably necessary to confirm the requester’s identity or authority. An authorized representative, parent or guardian may submit a request where permitted by law. 

inABLE will review and respond to requests in accordance with applicable legal requirements. 

18. Automated Decision-Making 

inABLE does not intend to make decisions that produce legal or similarly significant effects on an individual solely through automated processing unless: 

  • The processing is permitted by law 

  • Appropriate safeguards have been implemented 

  • Required information has been provided to the individual 

  • The individual’s applicable rights can be exercised 

If inABLE introduces such processing, this Notice or an activity-specific privacy notice will be updated. 

19. Third-Party Websites and Embedded Services 

Our website may contain links to or display content from: 

  • External websites 

  • Social-media platforms 

  • Video services 

  • Donation platforms 

  • Forms 

  • Maps 

  • Event-registration services 

  • Other third-party services 

These third parties may process personal data under their own privacy notices. inABLE does not control the independent privacy practices of third parties and encourages visitors to review the relevant privacy information before providing personal data. 

20. Accessibility of Privacy Information 

inABLE is committed to making privacy information clear, accessible and understandable. 

Individuals who require this Privacy Notice in an alternative format, or who need reasonable accessibility support to understand the Notice or exercise their rights, may contact inABLE using the details in Section 2. 

Where reasonably practicable, inABLE will provide appropriate accessibility support. 

21. Complaints 

Individuals who are concerned about inABLE’s handling of personal data may first contact inABLE using the details in Section 2. 

If you are dissatisfied with how inABLE has handled your personal data or responded to your concern, you have the right to lodge a complaint with Kenya’s Office of the Data Protection Commissioner. 

Office of the Data Protection Commissioner 
Britam Towers, 12th Floor 
Hospital Road, Upper Hill 
P.O. Box 30920-00100 
Nairobi, Kenya 
Email: [email protected] 
Telephone: 020 780 1800 

Visit the Office of the Data Protection Commissioner 

22. Changes to This Privacy Notice 

inABLE may update this Privacy Notice to reflect changes in: 

  • Processing activities 

  • Programmes and services 

  • Website technologies 

  • Service providers 

  • Legal or regulatory obligations 

  • Organizational practices 

The revised Notice will be published on this page with a new “Last Updated” date. 

Where a change materially affects how personal data is used, inABLE will provide additional notice or request fresh consent where required.