Privacy Policy

1. Introduction

The National Gender and Equality Commission (NGEC) Kenya, a Constitutional Commission established under Article 59(2)(a) of the Constitution of Kenya 2010 and operationalised by the National Gender and Equality Commission Act, No. 15 of 2011, is committed to protecting the privacy and personal data of all persons who interact with our website and services.

This Privacy Policy explains how NGEC collects, uses, discloses and safeguards personal data in compliance with the Data Protection Act, No. 24 of 2019, the Data Protection (General) Regulations, 2021, and all other applicable laws of Kenya. By using this website or submitting your information to NGEC, you acknowledge the practices described in this Policy.

2. Data Controller Details

• Organisation: National Gender and Equality Commission (NGEC)
• Address: 1st Floor, Solution Tech Place, 5 Longonot Road, Upper Hill, Nairobi, Kenya
• Telephone: +254 20 20 500 100 | Toll Free: 0800 720 187
• Email: info@ngeckenya.org
• Website: www.ngeckenya.org
• Data Protection Officer (DPO): Contact via dpo@ngeckenya.org

3. Personal Data We Collect

NGEC may collect the following categories of personal data:

• Identity Data: Full name, national identification number or passport number (for complainants and petitioners).
• Contact Data: Email address, telephone number, postal address and physical location.
• Complaint Data: Details of a complaint or petition, including statements, evidence and correspondence submitted to NGEC.
• Special Categories: Where relevant to a complaint or programme, we may process sensitive data including gender, disability status or ethnic origin, strictly in accordance with Section 46 of the Data Protection Act, 2019.
• Technical Data: IP address, browser type, pages visited and time stamps collected automatically through cookies and server logs.
• Subscription Data: Email address provided when subscribing to our newsletters or alerts.
• Feedback Data: Comments, survey responses and enquiries submitted via our contact forms.

We collect personal data only to the extent necessary for the specific purpose for which it is collected (data minimisation principle, Section 26(c) of the Data Protection Act, 2019).

4. Purpose of Processing

NGEC processes personal data for the following purposes:

• Receiving, registering and investigating complaints and petitions related to gender equality and non-discrimination.
• Administering programmes, research, outreach, and public education activities in furtherance of NGEC's statutory mandate.
• Responding to enquiries, feedback and requests for information submitted by members of the public.
• Sending newsletters, bulletins and event notifications to subscribers who have opted in to communications.
• Complying with statutory, regulatory and reporting obligations under Kenyan law.
• Monitoring and improving the security, functionality and performance of this website.
• Conducting research and compiling statistical data to advance gender equality in Kenya.

5. Legal Basis for Processing

In accordance with Section 30 of the Data Protection Act, 2019, NGEC processes personal data on the following lawful bases:

• Performance of a public task: Most processing is carried out in exercise of our constitutional and statutory mandate under Article 59 of the Constitution of Kenya 2010 and the NGEC Act, 2011.
• Consent: Where we process data for newsletters, marketing communications or optional programmes, we rely on your freely given, specific and informed consent. You may withdraw consent at any time.
• Legal obligation: Processing required to comply with statutory obligations under Kenyan law.
• Vital interests: In rare cases where processing is necessary to protect the life or safety of an individual.

6. Data Sharing & Disclosure

NGEC does not sell, rent or trade personal data. We may share personal data only in the following circumstances and subject to appropriate safeguards:

• Article 59 Commissions & Government Agencies: Where necessary for the exercise of official functions or compliance with a legal obligation, e.g., the Kenya National Human Rights Commission, the Director of Public Prosecutions or the Judiciary.
• Service Providers & Data Processors: Third-party service providers (e.g., cloud hosting, email delivery) who process data strictly on NGEC's instructions under a written data processing agreement.
• International Partners: Where necessary for programme delivery and subject to Section 49 of the Data Protection Act, 2019 (adequate safeguards for cross-border transfers).
• Legal Proceedings: Where disclosure is required by a court order, law or lawful authority.

7. Data Retention

NGEC retains personal data only for as long as is necessary to fulfil the purpose for which it was collected and to comply with applicable legal, regulatory and reporting obligations. Retention periods are set out in NGEC's Records Management Policy and are informed by the National Archives and Documentation Service Act and Public Finance Management Act requirements. When personal data is no longer required, it is securely deleted, anonymised or disposed of in accordance with the Data Protection Act, 2019.

8. Your Rights as a Data Subject

Under Part IV of the Data Protection Act, 2019 (Sections 26–34), you have the following rights in respect of your personal data:

To exercise any of the above rights, submit a written request to our Data Protection Officer at dpo@ngeckenya.org. We will respond within 21 days as required by the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021. If you are unsatisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

9. Cookies & Tracking Technologies

This website uses cookies — small text files stored on your device — to improve user experience and gather analytical data. We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the website to function correctly. These cannot be disabled.
• Analytics Cookies: Help us understand how visitors interact with the site (e.g., Google Analytics). Collected data is anonymised and aggregated.
• Preference Cookies: Remember your accessibility settings and display preferences.

You may control or disable non-essential cookies through the cookie consent banner displayed on your first visit, or via your browser settings. Disabling cookies may affect some website features.

10. Data Security

NGEC implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or alteration, in accordance with Section 41 of the Data Protection Act, 2019. These measures include:

• TLS/SSL encryption for all data transmitted via this website.
• Role-based access controls and multi-factor authentication for staff systems.
• Regular security audits and vulnerability assessments.
• Staff training on data protection obligations and information security.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, NGEC will notify the ODPC within 72 hours and affected data subjects without undue delay, as required by the Data Protection (General) Regulations, 2021.

11. Children's Data

NGEC recognises the special protection afforded to children (persons under 18 years) under the Children's Act, 2022 and the Data Protection Act, 2019. We do not knowingly collect personal data directly from children without the consent of a parent or guardian. Where child-related data is processed in the context of complaints or programmes, such processing is carried out with appropriate safeguards and in the best interest of the child.

12. Links to External Websites

This website may contain links to third-party websites and government portals. NGEC is not responsible for the privacy practices or content of those external sites. We encourage you to review the privacy policies of any website you visit via links on our platform.

13. Changes to This Policy

NGEC may update this Privacy Policy periodically to reflect changes in law, technology or our operational practices. Any material changes will be communicated through a notice on this website and, where appropriate, by direct communication to affected data subjects. The "Last Updated" date at the top of this page indicates when the most recent revision was made. Continued use of this website after an update constitutes acceptance of the revised Policy.

14. Contact & Complaints