Privacy Policy

DATA PROTECTION AND PRIVACY POLICY

Hearts of Green Organization

Effective Date: 01/01/2020
Last Updated: 21/10/2026

1. Introduction

Hearts of Green Organization (“Hearts of Green,” “we,” “our” or “us”) is committed to protecting the privacy and personal information of individuals who interact with our organization, programmes, website and partners.

This Data Protection and Privacy Policy explains how we collect, use, store, disclose and protect personal data in the course of our environmental conservation, landscape restoration, tree-growing, community engagement, educational and partnership activities.

We are committed to handling personal data responsibly and in accordance with the applicable laws of Kenya, including the Data Protection Act, 2019, and its applicable regulations.

By interacting with our website or providing personal information to us, you acknowledge that you have been informed of the practices described in this policy. Where consent is required, we will seek it separately and appropriately.

2. Scope of This Policy

This policy applies to personal data collected through:

The Hearts of Green website and online contact forms.
Communications by email, telephone and other official channels.
Environmental conservation and landscape restoration programmes, including LANSRET.
Tree-growing, seedling distribution, monitoring and field activities.
School, community and stakeholder engagement programmes.
Partnerships with corporate organizations, institutions, donors and other stakeholders.
Photographs, videos, interviews and other communication materials.
Digital platforms and tools used to support programme monitoring, reporting and communication, where applicable.

This policy applies to website visitors, programme participants, community members, school representatives, partners, donors, volunteers, staff, suppliers and other individuals whose personal data we process.

3. Personal Information We May Collect

Depending on your interaction with Hearts of Green, we may collect the following categories of information:

a. Identification and contact information

Names, email addresses, telephone numbers, job titles, organizational affiliations and other contact details you voluntarily provide.

b. Programme and participation information

Information necessary to coordinate environmental activities, training, school engagements, community programmes, volunteering and stakeholder participation.

c. Photographs, videos and recordings

Images, video recordings, interviews and related information captured during tree-growing activities, restoration projects, events, field visits and other organizational activities.

d. Partnership and professional information

Names, roles, institutional affiliations, business contact details and correspondence relating to partnerships, project implementation, funding, reporting and stakeholder engagement.

e. Website and technical information

Where supported by our website configuration, we may collect technical information such as IP addresses, browser type, device information, website usage data and information collected through cookies or similar technologies.

f. Other information

Any additional information you voluntarily submit through our communication channels or that is lawfully required for a specific programme or organizational purpose.

We aim to collect only information that is relevant and necessary for the purpose for which it is required.

4. How We Use Personal Information

Hearts of Green may use personal data for the following purposes:

To implement and coordinate environmental conservation and landscape restoration programmes.
To organize tree-growing activities, community engagements, training and educational initiatives.
To communicate with programme participants, schools, partners, donors and other stakeholders.
To document project activities and monitor progress, where necessary.
To prepare programme reports, project updates and accountability records.
To publish approved photographs, videos, stories and updates on our website, social media platforms, reports and other communication channels.
To manage partnerships, correspondence and organizational operations.
To respond to enquiries, feedback and requests.
To maintain website security, troubleshoot technical problems and improve website functionality.
To meet applicable legal, regulatory, contractual and reporting obligations.
To protect the rights, safety and legitimate interests of the organization and relevant individuals, where permitted by law.

We will not use personal data for purposes that are incompatible with the original purpose of collection unless an appropriate legal basis permits the further processing.

5. Lawful Basis for Processing

We process personal data only where an appropriate legal basis applies under Kenyan data protection law.

Depending on the circumstances, this may include:

Consent: Where an individual has freely agreed to a specific use of their personal information.
Contractual necessity: Where processing is necessary to perform an agreement or take steps requested by an individual before entering into an agreement.
Legal obligations: Where processing is necessary to comply with applicable laws or regulatory requirements.
Legitimate interests: Where processing is necessary for a legitimate organizational purpose and the individual’s rights and freedoms are appropriately protected.
Public interest or other lawful grounds: Where a specific provision of law permits or requires the processing.

Where consent is the applicable basis, individuals may withdraw it, subject to applicable legal requirements. Withdrawal does not invalidate processing lawfully carried out before the withdrawal.

6. Photographs, Videos and Children’s Personal Data

Photographs and videos may form an important part of our environmental documentation, public education, programme reporting and communication activities.

Hearts of Green will take appropriate steps to ensure that identifiable individuals are photographed, recorded and featured in accordance with applicable law and appropriate consent or other lawful requirements.

Where activities involve children, we will apply additional safeguards, including obtaining consent from a parent or lawful guardian where required, considering the child’s best interests and age-appropriate assent where appropriate, and avoiding the unnecessary disclosure of identifying or sensitive information.

We will take reasonable care not to publish personal information that could expose children or other vulnerable individuals to unnecessary risks.

Individuals who have concerns about the use of their photographs or recordings may contact us using the details provided in this policy.

7. Sharing and Disclosure of Personal Data

Hearts of Green does not sell personal data to third parties.

We may share personal data where necessary and lawful with:

Programme implementation partners, schools and participating institutions.
Donors, funders and project sponsors where required for legitimate programme reporting or accountability.
Service providers supporting our website, communications, data storage, IT systems or programme operations.
Authorized personnel and representatives who require access to perform their duties.
Government agencies, regulators, courts or other authorities where disclosure is legally required or permitted.
Other parties where the individual has consented or another lawful basis applies.

Where appropriate, we will take reasonable steps to ensure that recipients protect personal data and use it only for authorized purposes.

8. Website Cookies and Third-Party Services

Our website may use cookies or similar technologies to support functionality, improve user experience, understand website usage or maintain security, depending on the services enabled.

Where applicable, users will be provided with appropriate information and choices concerning non-essential cookies.

Our website may contain links to third-party websites, platforms or services. These services operate under their own privacy policies and practices. Hearts of Green is not responsible for the privacy practices of external websites that we do not control.

We encourage visitors to review the relevant privacy notices before providing personal information to third-party services.

9. Data Storage, Retention and Deletion

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, meet applicable legal or contractual obligations, maintain appropriate programme records or resolve legitimate disputes.

Retention periods may vary depending on the nature of the information and the requirements of the relevant programme.

When personal data is no longer required, we will take reasonable steps to securely delete, anonymize or otherwise dispose of it, subject to applicable legal requirements and legitimate record-retention obligations.

10. Data Security

Hearts of Green is committed to applying appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, loss, destruction or other misuse.

Depending on the systems and information involved, safeguards may include:

Restricting access to authorized personnel.
Using appropriate passwords and access controls.
Maintaining secure systems and applying relevant software updates.
Using secure methods to store and transfer information.
Maintaining appropriate backups and recovery arrangements.
Providing guidance to personnel on responsible data handling.
Reviewing security risks and responding to suspected incidents.

No method of electronic storage or transmission is completely secure. However, we will take reasonable and appropriate measures to protect the personal data entrusted to us.

11. International Transfers of Personal Data

Some service providers or digital platforms used by Hearts of Green may process or store information outside Kenya.

Where personal data is transferred outside Kenya, we will take appropriate steps to ensure that the transfer complies with applicable Kenyan data protection requirements, including any required safeguards, assessments or consent.

12. Your Data Protection Rights

Subject to applicable law, individuals whose personal data we process have rights that may include:

Right to be informed: To receive information about how their personal data is collected and used.
Right of access: To request access to their personal data held by us.
Right to correction: To request correction of inaccurate, incomplete or misleading information.
Right to deletion: To request deletion of personal data where the applicable legal conditions are met.
Right to object: To object to certain forms of processing.
Right to withdraw consent: Where processing is based on consent.
Right to data portability: Where applicable under the law.
Right to complain: To raise concerns with the Office of the Data Protection Commissioner (ODPC) where they believe their rights have been infringed.

These rights are subject to applicable legal conditions and exceptions.

13. How to Make a Privacy Request or Complaint

If you wish to access, correct or request deletion of your personal data, withdraw consent, object to processing or raise a privacy concern, please contact Hearts of Green through the contact details below.

Please provide sufficient information to help us understand and respond to your request. We may need to verify your identity before disclosing or changing personal information.

We will review and respond to requests within the applicable legal timelines.

If you are dissatisfied with our response, you may contact the Office of the Data Protection Commissioner in Kenya through its official website: https://www.odpc.go.ke/

14. Personal Data Breaches

If Hearts of Green becomes aware of a personal data breach, we will take appropriate steps to assess and contain the incident, investigate its cause, mitigate potential harm and implement corrective measures.

Where required by applicable law, we will notify the relevant regulatory authority and affected individuals within the prescribed timelines.

15. Changes to This Policy

We may update this policy from time to time to reflect changes in our programmes, website functionality, data-processing practices or legal requirements.

The latest version will be published on our website with its updated revision date. We encourage visitors and stakeholders to review this policy periodically.

16. Contact Us

For questions, requests or complaints concerning this Data Protection and Privacy Policy, please contact: