Legal

Privacy Policy

How we collect, use and protect personal information — and what you can ask us to do with it.

Last updated 11 November 2026

Who we are

Start Walking Foundation is a youth-focused non-profit organisation based in Kenya. When you donate to us, subscribe to our updates, or simply visit this website, we decide how your information is handled — which makes us the data controller for that information under Kenya's Data Protection Act, 2019.

You can reach us about anything on this page at info@startwalkingfoundation.org.

What we collect, and why

When you donate by M-Pesa

To send the payment request to your phone and to keep a record of your gift, we collect:

• Your M-Pesa phone number. Required — there is no way to send a payment prompt without it.
• The amount, the M-Pesa receipt number, and the date and time of payment.
• Your name and email address, only if you choose to give them. These fields are optional. We use them for one thing: to thank you and send you a record of your gift. Leaving them blank does not affect your donation in any way.

Donation records are kept in a private spreadsheet that only the small number of staff who need it can open.

If you type your name or email before paying, they are held very briefly in a separate pending list so that they can be attached to your donation once the payment confirms. If a payment is never completed, that entry is deleted automatically within an hour.

When you donate by PayPal

PayPal handles the payment and your card or account details entirely. We never see or store them. We receive only what PayPal reports to us about the donation itself.

When you subscribe to updates

If you sign up for our newsletter we collect your first name, last name and email address, and use them only to send you news about our work. Every email includes an unsubscribe link, and you can also ask us directly.

When you simply visit the site

Our hosting provider keeps standard server logs, which include visitors' IP addresses, for a short period for security and troubleshooting. We also record a note in your browser of whether you accepted or declined cookies, so we do not keep asking.

We do not write your name, email address or full phone number into our server logs. Phone numbers are masked there.

Cookies and advertising

We use Google Ads tracking to understand whether our advertising reaches people. It sets cookies in your browser.

Nothing advertising-related runs until you accept it. When you first arrive, advertising and analytics storage are switched off. The banner you see is what turns them on: choosing Accept enables them, and choosing Decline leaves them off. Declining genuinely withholds them — it is not only a note of your preference.

To change your mind later, clear this site's data in your browser settings. The banner will appear again on your next visit and you can choose differently.

The site also loads fonts and code libraries from Google Fonts and Cloudflare's CDN. Those services can see your IP address when your browser requests the files, as is normal for any site using them.

Who else handles your information

We use a small number of established providers to run the site and process donations. Each sees only what it needs:

• Safaricom (M-Pesa Daraja) — processes the payment itself.
• Google — hosts the spreadsheet holding donation records.
• Vercel — hosts this website and keeps the server logs.
• Resend — delivers donation emails, including your thank-you.
• Mailchimp — manages our newsletter list.
• PayPal — processes card and PayPal donations.
• Google Ads — advertising measurement, only once you accept cookies.

Some of these providers are based outside Kenya, which means your information may be stored or processed abroad. We do not sell your personal information, and we do not share it with anyone for their own marketing.

How long we keep it

• Donation records — kept for seven years, so that we can account properly for funds received and meet our reporting obligations.
• Newsletter details — until you unsubscribe or ask us to remove you.
• Unconfirmed donor details — deleted automatically within an hour.
• Server logs — kept only for the short period our hosting provider retains them.

Your rights

Under the Data Protection Act, 2019, you have the right to:

• ask what personal information we hold about you, and get a copy;
• have information that is wrong or incomplete corrected;
• ask us to delete your information, where we are not required to keep it;
• object to how we are using it, or ask us to restrict that use;
• withdraw consent you have given, at any time;
• receive your information in a portable form.

Write to info@startwalkingfoundation.org and we will respond. If you are not satisfied with how we have handled your request, you can complain to the Office of the Data Protection Commissioner of Kenya.

Children and young people

Much of our work is with children and young people. We do not knowingly collect personal information from a child through this website, and donations are intended to be made by adults. If you believe a child has given us information here, contact us and we will remove it.

Keeping information safe

The site is served over an encrypted connection. Donation records are held in a private spreadsheet shared with as few people as the work requires, and the credentials our systems use are stored as secrets rather than in our website's code. No system is perfectly secure, but we take these obligations seriously and review them as the site changes.

Changes to this policy

If we change how we handle personal information, we will update this page and change the date at the top. Significant changes will be made clear rather than slipped in quietly.