We practisewhat we preach.

Ficha Uchi is a campaign run by Open Institute, a non profit organisation based at 9 Riverside, Nairobi, Kenya. When this policy says “we”, “us” or “our”, it means Open Institute.

We are the data controller for personal data collected through fichauchi.org. We are registered with the Office of the Data Protection Commissioner (ODPC) under registration number [ODPC REGISTRATION NUMBER].

Things you give us. When you fill in our Get Involved form we collect your name, email, phone number, organisation or school, county, and anything you choose to tell us. When you take the rights check or privacy risk surveys, we collect your answers. These surveys don’t ask for your name unless you choose to leave contact details.

Things collected automatically. When you visit the site we collect basic technical information like your browser type, device, the pages you visit and your approximate location based on your IP address. Some of this is collected through cookies (see Cookies below).

Things we don’t want. We don’t ask for sensitive data like your health, religion, ethnicity or ID number. Please don’t include it in free text fields.

We use your data to:

• respond to you and arrange sessions, partnerships or media appearances (based on your consent)
• show you your rights check or privacy risk result (based on your consent)
• understand, in summary form, what people know about data protection so we can improve the campaign and report to partners (legitimate interest)
• keep the site secure and working (legitimate interest)
• meet our legal obligations (legal obligation)

We will never sell your data, and we will never use it for advertising.

We only share your data with people who help us run the campaign, and only what they need:

• Sabasi, Open Institute’s data collection platform, which hosts our forms and surveys
• [WEBSITE HOST], who hosts this website
• [ANALYTICS PROVIDER], if you accept analytics cookies

When we share findings with partners like the ODPC, Amnesty International Kenya, GIZ or the Hewlett Foundation, we only share combined, anonymous numbers. Never your name or contact details.

Some of our service providers may store data outside Kenya. When this happens, we make sure there are proper safeguards in place, as required by Part VI of the Data Protection Act 2019. [CONFIRM WHERE SABASI AND WEBSITE DATA ARE HOSTED.]

• Get Involved form responses: [12 months] after our last contact with you
• Survey answers linked to contact details: [12 months]
• Anonymous, combined survey results: kept for reporting
• Analytics data: [26 months]

After that, we delete or fully anonymise it.

We use access controls, encrypted connections (HTTPS) and limit who on our team can see personal data. No system is 100% secure, but if a breach affects you, we’ll tell you and the ODPC as the law requires.

Under the Data Protection Act 2019, you have the right to:

• be told how your data is used
• get a copy of your data
• object to how we use it
• have wrong or misleading data corrected
• have false or misleading data deleted
• withdraw your consent at any time
• ask for your data in a format you can move elsewhere

To use any of these, email Hello@openinstitute.com with the subject “Data request”. We’ll reply within [X] days. It’s free.

Not happy with our response? You can complain to the Office of the Data Protection Commissioner at odpc.go.ke.

Our content is made for everyone, including young people. If you’re under 18, please ask a parent or guardian before filling in any of our forms. If we learn we’ve collected a child’s data without consent, we’ll delete it.

Cookies are small files saved on your device when you visit a website. Here’s what we use:

We may update this policy from time to time. When we do, we’ll change the date at the top. If the changes are big, we’ll let you know on the site.

Questions about your data? Talk to us.

Data Protection Officer: [DPO NAME]
Email: Hello@openinstitute.com
Post: Open Institute, 9 Riverside, Nairobi, Kenya