We collect the following categories of personal data:

• ▸Children in care: Names or initials, age, gender, health status, guardian details, school enrolment.
• ▸Donors: Full name, email address, phone number, payment details (processed securely).
• ▸Volunteers & Staff: National ID, contact details, qualifications, emergency contacts.
• ▸Website visitors: IP address, browser type, pages visited (via cookies — see Section 15).
• ▸Medical camp participants: Name, age, presenting health concern, treatment provided.

Some of our programmes — particularly medical camps — require us to collect special category data including health conditions, treatment records, and disability status. This data is:

• ▸Collected only with explicit written or verbal consent from the individual or their guardian.
• ▸Stored separately from general personal data with restricted access.
• ▸Used exclusively for delivering medical or care services — never shared commercially.
• ▸Retained only as long as necessary for the care programme (see Section 9).

• ▸Online: Donation forms, contact forms, newsletter sign-ups, and website enquiries.
• ▸Field operations: Paper consent forms at medical camps, outreach visits, and community events.
• ▸Photography & media: Only with signed or witnessed consent (see Section 12).
• ▸Third parties: Partner NGOs or referral agencies who share data only with your knowledge.

We process personal data under the following lawful bases as recognised by the Kenya Data Protection Act 2019:

• ▸Consent: You have given clear consent (e.g. signing a medical camp form or donation form).
• ▸Legitimate interest: Processing is necessary to carry out our charitable mission.
• ▸Legal obligation: We are required to retain certain records by law.
• ▸Vital interests: In emergencies, to protect the life of a child or vulnerable individual.

We use collected data to:

• ▸Deliver programmes, medical care, and support services to those in need.
• ▸Process donations securely and issue acknowledgement receipts.
• ▸Communicate with donors and volunteers about our work and impact.
• ▸Report to regulatory bodies and grant-making partners (using anonymised data where possible).
• ▸Improve our website and digital communications.
• ▸Safeguard children and vulnerable individuals in our care.

We never sell, rent, or trade personal data. We may share data only in the following limited circumstances:

• ▸Service providers: Secure payment processors and email platforms, under strict data agreements.
• ▸Government authorities: When legally required (e.g. child protection referrals).
• ▸Partner organisations: Only with your knowledge and consent, for coordinated care.
• ▸Auditors / Funders: Anonymised or aggregated data only, for reporting purposes.

Under the Kenya Data Protection Act 2019, you have the right to:

• ▸Access the personal data we hold about you.
• ▸Correct inaccurate or incomplete information.
• ▸Erase your data (right to be forgotten) where applicable.
• ▸Restrict or object to certain types of processing.
• ▸Data portability — receive your data in a readable format.
• ▸Withdraw consent at any time without affecting past processing.

To exercise any of these rights, contact us at: privacy@lightlovefoundation.org

We recognise that children require enhanced privacy protection. Our policy is:

• ▸We never display the full identity (name + face) of a child without guardian consent.
• ▸Photos and videos of children are blurred or use initials only when full consent is not obtained.
• ▸Children's data is processed only under vital interests or explicit guardian consent.
• ▸All staff and volunteers working with children receive child safeguarding training.

Before any photo, video, or personal story is shared publicly, we:

• ▸Obtain a signed or witnessed consent form from the individual or their guardian.
• ▸Clearly explain how and where the media will be used.
• ▸Give individuals the right to withdraw consent and have content removed at any time.
• ▸Never use images for any purpose beyond what was originally agreed.

We implement the following technical and organisational safeguards:

• ▸SSL/TLS encryption on all web forms and donation pages.
• ▸Restricted access to personal data — only authorised staff can view sensitive records.
• ▸Password-protected and encrypted file storage for all digital records.
• ▸Locked physical storage for all paper-based consent and medical forms.
• ▸Regular staff training on data protection and safeguarding best practices.

In the event of a personal data breach, we will:

• ▸Investigate and contain the breach within 24 hours of discovery.
• ▸Notify the Office of the Data Protection Commissioner (ODPC) within 72 hours if required by law.
• ▸Inform affected individuals promptly where there is a high risk to their rights and freedoms.
• ▸Document all breaches in our internal breach register, regardless of severity.

Our website uses cookies to improve your experience. These include:

• ▸Essential cookies: Required for the website to function (cannot be disabled).
• ▸Analytics cookies: Help us understand how visitors use the site (e.g. Google Analytics). These are optional.

You can control or disable analytics cookies through your browser settings. This will not affect your ability to use the site.

We may update this Privacy Policy from time to time. Changes will be published on our website with an updated effective date. Significant changes will be communicated directly to registered donors and partners.

We encourage you to review this page periodically to stay informed about how we protect your data.

For any privacy-related queries, data subject requests, or safeguarding concerns — please reach out:

• ▸Privacy / DPO: privacy@lightlovefoundation.org
• ▸General: info@lightlovefoundation.org
• ▸Location: Baringo, Kenya

We aim to respond to all data requests within 30 days in line with the Kenya Data Protection Act 2019.