Data Protection Policy

1. Data Protection Overview

Africa Sojourners of Hope (ASOH) is committed to protecting personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR) for EU residents and Kenya's Data Protection Act.

This policy outlines our commitments, processes, and safeguards for protecting personal information in our custody.

2. Legal Basis for Processing

We process personal data based on the following legal grounds:

• Consent: You explicitly consent (donations, applications, contact forms)
• Contract Performance: Processing necessary to fulfill donation or application requests
• Legal Obligation: Compliance with tax, audit, and regulatory requirements
• Legitimate Interest: Improving our services, preventing fraud, securing our systems
• Public Task: Fulfilling our humanitarian mission as a non-profit

3. Data Controller and Processor Information

Data Controller

Data Processors

We use external service providers for specific functions:

• Supabase (Database): Secure cloud data hosting with encryption
• Paystack (Payments): PCI-DSS compliant payment processing
• Email Services: Transactional email delivery
• Vercel (Hosting): Web application hosting with DPA

All processors have signed Data Processing Agreements (DPAs) ensuring GDPR compliance.

4. Data Subject Rights (GDPR)

Right to Access

You have the right to request a copy of your personal data held by ASOH. We will provide this information within 30 days in a structured, commonly-used format.

Right to Rectification

You may request correction of inaccurate or incomplete personal information. We will update our records within 30 days.

Right to Erasure ("Right to be Forgotten")

Under certain circumstances, you may request deletion of your personal data. However, we must retain information as required by law (tax records, legal holds, fraud prevention).

Right to Data Portability

You may request your data in a machine-readable format for transfer to another organization. We will provide this within 30 days at no cost.

Right to Object

You may object to certain processing activities, including marketing communications and profiling for non-contractual purposes.

Rights Related to Automated Processing

You have rights regarding automated decision-making and profiling that significantly affects you. ASOH does not use fully automated decisions for eligibility determinations without human review.

5. Security Measures

ASOH implements comprehensive technical and organizational security measures:

Technical Safeguards

• TLS/SSL encryption for data in transit (HTTPS)
• AES-256 encryption for data at rest
• Secure authentication (password hashing, session tokens)
• Regular security testing and penetration testing
• Firewalls and intrusion detection systems

Organizational Safeguards

• Access controls (principle of least privilege)
• Employee data protection training
• Confidentiality agreements with staff and contractors
• Data breach response procedures
• Regular security audits and compliance reviews

6. Data Breach Notification

In the event of a personal data breach, ASOH will:

• Notify affected individuals without undue delay (maximum 72 hours)
• Provide information about the breach, risk, and mitigation steps
• Report to relevant supervisory authorities where required
• Maintain detailed breach records and documentation

7. Data Processing Procedures

Donation Processing

• Payment data processed by Paystack (PCI-DSS compliant)
• Donation records stored with encrypted payment references
• Full payment details not retained in ASOH systems
• Donor info retained for receipts and communication (7+ years for accounting)

Application Processing

• Applications reviewed by authorized staff only
• Decisions documented with reasoning and reviewer identity
• Sensitive information (medical, financial) secured separately
• Applicants notified of status and decisions within 30 days

Case Assessments

• Beneficiary data marked confidential and access-controlled
• Family and household information protected from unauthorized disclosure
• Audio/video evidence (if any) encrypted and separately stored
• Case files deleted 5 years after closure unless legally required

8. Data Processing Agreement (DPA)

For organizations or individuals subject to GDPR who transfer personal data to ASOH, a Data Processing Agreement is available upon request. The DPA outlines:

• Scope and purpose of data processing
• ASOH's obligations as a data processor
• Sub-processor arrangements
• Data subject rights implementation
• Security and confidentiality requirements
• International data transfer safeguards

Contact dpo@asoh.org to request a DPA.

9. International Data Transfers

ASOH operates in Kenya and may transfer data to processors in other countries. For transfers outside Kenya/EEA, we:

• Use Standard Contractual Clauses (SCCs) as approved transfer mechanisms
• Require processors to implement equivalent protections
• Assess third-country data protection adequacy
• Obtain additional safeguards where necessary

10. Data Protection Officer & Contact

To exercise your data protection rights or file a complaint:

You also have the right to lodge a complaint with your local data protection authority.