Privacy policy
At Islamic Relief Kenya we are committed to keeping your personal data secure and confidential.
We have written this privacy statement to inform you about why we collect and use your personal data, in what circumstances we may share your personal data with another organisation, and your individual rights with regard to your personal data.
We are committed to being fully open and honest with you about why we collect and use your personal data. This is the right thing to do and it will also help you understand and exercise your rights over your personal data.
This privacy notice is categorised into the following sections for ease of reference.
If you have any questions about this privacy statement or information we hold about you, please contact our Data Protection Lead:
Telephone: +254 727 531 220 / +254 734 740 074
Email: [email protected]
Post: Data Protection Lead, Islamic Relief Kenya, Third Floor, Adams Masjid Building, Adams Arcade, Ngong Road, P.O. Box 417 – 00202 (KNH), Nairobi, Kenya
Who we are
We are an independent, faith-based humanitarian and development organisation working to assist marginalised and vulnerable communities in Kenya, without discrimination based on race, creed, ethnicity or gender.
We are registered locally under the Public Benefit Organizations Act (Registration No. 218/051/204/0374/3386), and we are part of the wider Islamic Relief family of organisations, which includes Islamic Relief Worldwide, Islamic Relief UK, and Islamic Relief member offices and country programmes in more than 40 countries. Islamic Relief Kenya is registered with the Office of the Data Protection Commissioner (ODPC) as a data controller (certificate serial no. 15074) and as a data processor (certificate serial no. 27640), under ODPC identification number 739-6606-DA55. You can view both certificates by selecting the serial numbers (PDF, opens in a new tab). Our privacy statement applies to Islamic Relief Kenya’s website and donation portal, and to our other activities as described in this policy.
Our registered address is:
Third Floor, Adams Masjid Building
Adams Arcade, Ngong Road
P.O. Box 417 – 00202 (KNH)
Nairobi, Kenya
Your rights over your personal data
Direct marketing
If you want to stop the processing of your personal data for any direct marketing purpose (including postal marketing and our use of profiling), please contact our Supporter Relations team:
Telephone: +254 727 531 220 / +254 734 740 074
Email: [email protected]
Post: Supporter Relations Team, Islamic Relief Kenya, Third Floor, Adams Masjid Building, Adams Arcade, Ngong Road, P.O. Box 417 – 00202 (KNH), Nairobi, Kenya
Right to withdraw consent
If we ask for your consent to use your personal data, you always have the right to withdraw your consent at any time. You can expect that any direct marketing that you receive from us will include clear and easy instructions on how to withdraw your consent. Please note that if you withdraw your consent to receiving email, WhatsApp or SMS text messages from us, this will not necessarily prevent advertisements being shown to you on websites and social media based on cookie data (see ‘Use of cookies’ below).
Right of access (also known as subject access)
You have the right to ask what personal data we hold about you and to request a copy of that information.
Right to object and/or restrict processing
You have the right to know why your personal data is being collected and used and to request that this is restricted or stopped.
Right of data portability
You have the right to request that a copy of your personal data that we hold is transferred directly to another organisation, where technically feasible.
Right of erasure (also known as right to be forgotten)
You have the right to request that your personal data that we hold is erased, subject to any legal or contractual obligation we may have to retain it.
Right of rectification
If you believe your personal data that we hold is inaccurate, you have the right to request that it is corrected or updated.
If you want to exercise any of these rights or want to find out more information, please contact our Data Protection Lead. You have the right to expect a confidential and professional service and to receive a full response.
Telephone: +254 727 531 220 / +254 734 740 074
Email: [email protected]
Post: Data Protection Lead, Islamic Relief Kenya, Third Floor, Adams Masjid Building, Adams Arcade, Ngong Road, P.O. Box 417 – 00202 (KNH), Nairobi, Kenya
Privacy statement for our supporters
Islamic Relief Kenya is established in Kenya, and this policy is governed primarily by the Data Protection Act, 2019 (Laws of Kenya). Because some of our supporters and donors are based in the European Union, we also design our data practices to meet the standards of the EU General Data Protection Regulation (GDPR) where it applies to our processing of your personal data. Where the GDPR imposes a higher standard of protection than Kenyan law for a particular individual, we aim to apply that higher standard to your personal data.
When do we collect your personal data
When you make a donation to us, including via our donation portal, M-PESA, or card payment.
When you sign up to a campaign or appeal with us.
When you register for, or attend, one of our events or challenges, such as the IRK Charity Ramadan Run.
When you contact us by email, telephone, letter, or through our website and donation portal.
When you visit and use our website and donation portal (see ‘Use of cookies’ below).
When you interact with us on our social media platforms.
Why do we collect and use your personal data
To process your donations and to comply with any donation-related instructions you give us, and to issue receipts and, where applicable, supporting documentation for tax purposes.
To keep you informed about our activities and ways to support us. Please note:
We will only send you marketing materials by email, WhatsApp or SMS text if you have provided your consent. You can withdraw your consent at any time (see ‘Your rights over your personal data’ above).
We will not send you marketing materials by post if you have asked us to stop (see ‘Your rights over your personal data’ above).
To deal with your queries, requests and responses to our projects and campaigns.
To send you a confirmation of your donations and event registrations.
To personalise our services – for example, we may use personal data you have given us and your interactions with our services to help us predict your interests and to send you marketing materials that we think might be of most interest to you (see also ‘Use of profiling’ below).
To improve our services – for example, if we are allowed, we may request your feedback on our services.
To carry out screening and due diligence checks on certain donations, in order to meet our legal obligations relating to counter-terrorism financing and anti-money laundering, and to safeguard the charitable purposes of donated funds.
In what situations do we collect personal data from other sources
When you agree to support us through a third-party fundraising platform and provide your consent for that platform to share your personal data with us.
When we receive significant donations or support, we may run a background check using publicly available sources and a third-party screening and due diligence service, in accordance with our due diligence policies and procedures, in order to protect our charitable interests.
In what situations do we share personal data with other organisations
We contract a limited number of trusted third parties to process personal data on our behalf, or to provide services that make our website and donation portal work. We do not name each provider individually in this policy, both because the specific providers we use may change over time, and because we do not consider it necessary or advisable to publish a detailed map of our technical suppliers. In line with the Data Protection Act, 2019 and the EU GDPR, we instead describe below the categories of third party we share personal data with, and the purpose for each. A full list of our current data processors is available on request — see ‘How to make a complaint’ below for our contact details.
Payment processing providers – to process mobile money (M-PESA) and card donations made through our donation portal.
Please note that payment service providers, such as M-PESA, may act as independent data controllers. Where they do so, they may retain your personal data and disclose or transfer it to their permitted recipients, successors or assignees (including outside Kenya) in accordance with their own privacy policies and applicable data protection law.
Cloud hosting and infrastructure providers – to host our website, donation portal, and the data submitted through them.
Website and donation portal development and technical support providers – who build and maintain our website and donation portal on our behalf.
Security and content-delivery providers – who help protect our website and donation portal from malicious activity and keep them running reliably.
SMS and communications delivery providers – to send you notifications relating to your donation or enquiry.
Email and office productivity platform providers – used by our staff to communicate with you.
We may also share your personal data with other organisations in the following situations:
Where you request supporting documentation for tax relief purposes, we may need to share limited details with the Kenya Revenue Authority (KRA).
With law enforcement or regulatory agencies if we receive a valid legal instruction.
If you register for one of our events or challenges, we may be required to share your personal data with event partners or suppliers for health and safety purposes.
If we receive a significant donation or support, we may run a background check using a third-party screening and due diligence service, in accordance with our due diligence policies and procedures, in order to protect our charitable interests.
We only share personal data with another organisation if we have a legal basis to do so.
We only use payment processing partners that are certified against appropriate frameworks, such as the Payment Card Industry Data Security Standard (PCI DSS). Where personal data is transferred outside Kenya, we ensure appropriate safeguards are in place such as contractual data protection clauses, or reliance on a jurisdiction recognised as providing an adequate level of protection consistent with the requirements of the Data Protection Act, 2019 and the EU GDPR.
In all the above situations, we will ensure that we have a written contract (or valid legal instruction) in place with the organisation concerned that includes data protection clauses to ensure that they do not use personal data for their own marketing purposes, and have appropriate security requirements in place to protect your personal data.
What is our legal basis for collecting and using personal data
Under the Data Protection Act, 2019 and, where applicable, the EU GDPR, we only process your personal data where we have one of the following lawful bases.
Where we have your consent – for example, we will only send you emails, WhatsApp messages or SMS text messages with your consent. You can withdraw this consent at any time (see ‘Your rights over your personal data’ above).
Where the processing is necessary to enter into or fulfil the terms and conditions of a contract – for example, processing a donation made to us.
Where the processing is required under the law – for example, carrying out screening checks to prevent money laundering or terrorism financing, or disclosing personal data to a law enforcement agency if we receive a valid legal instruction.
Where the processing is in our legitimate interest – for example, dealing with your enquiries and complaints. We will only rely on this legal basis if we believe your interests and fundamental rights do not override our legitimate interest.
How we protect your personal data
We take appropriate technical and organizational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, access or other unlawful processing, considering the nature of the personal data and the risks associated with its processing.
We limit access to your personal data to authorised employees, representatives, service providers and other persons who have a legitimate need to access it for the purposes described in this Privacy Statement. Such persons are subject to appropriate confidentiality and data protection obligations.
We use appropriate physical, technical and organizational safeguards, which may include access controls, authentication measures, secure storage and transmission, appropriate security software, confidentiality measures, regular review of access rights and physical security measures.
Where we engage third-party service providers to process personal data on our behalf, we take appropriate steps to ensure that they provide sufficient safeguards for the protection of your personal data and process it in accordance with our instructions and applicable data protection laws.
Where your personal data is transferred outside Kenya or the European Economic Area, where applicable, we will take appropriate steps to ensure that the transfer is carried out in accordance with applicable data protection requirements and that appropriate safeguards are in place to protect your personal data.
We regularly review and update our security measures to take account of changes in technology, the nature and volume of personal data we process, and the risks associated with its processing.
If we become aware of a personal data breach affecting your personal data, we will take appropriate steps to contain, investigate and address the breach and make any notifications required under applicable data protection laws, including notification to the relevant supervisory authority and/or affected individuals where required.
While we take appropriate measures to protect your personal data, no method of storing or transmitting information can be guaranteed to be completely secure. We will nevertheless continue to review and improve our safeguards to maintain an appropriate level of protection for your personal data.
Consequences of failing to provide personal data
In some cases, if you choose not to provide certain personal data requested by us, it may affect our ability to provide you with the products, services, information or support you have requested. The specific consequences will depend on the type of personal data requested and the purpose for which it is being collected.
For example, if you are a donor or supporter and do not provide certain contact or identification details, we may not be able to process your donation, issue an acknowledgement or receipt, respond to your enquiries, provide information you have requested, or communicate with you about our programmes and activities. Where particular personal data is necessary for us to comply with a legal or regulatory obligation, failure to provide that information may also prevent us from completing the relevant transaction or activity.
We encourage you to consider the personal data requested and its importance for the intended purpose. If you have concerns about providing certain information, please contact us to discuss your specific circumstances.
Privacy statement for our beneficiaries
This section applies to individuals, households and communities who receive, or are assessed for, humanitarian or development assistance through Islamic Relief Kenya’s programmes. It is separate from the sections above, which describe how we handle the personal data of our donors, supporters and website visitors.
When do we collect your personal data
When you register for, or are assessed for, support through one of our programmes – for example, food distributions, water, sanitation and hygiene (WASH) projects, health and nutrition support, education support, livelihoods and financial inclusion, child welfare and orphan sponsorship, or emergency response.
When you take part in a needs assessment, vulnerability assessment, or programme monitoring and evaluation activity, including surveys and interviews.
When you, or someone acting on your behalf, raises a complaint, reports a concern (including a safeguarding concern), or gives feedback through one of our community feedback mechanisms.
When a parent or guardian provides information on behalf of a child who benefits from our programmes.
What personal data we collect
Identification details, such as your name, age or date of birth, gender, and, where required to register you for assistance or verify your eligibility, a national ID or other identification number.
Contact and location details, such as phone number, village, sub-county or county.
Household and vulnerability information relevant to assessing your needs, such as household composition, disability status, livelihood, or other vulnerability criteria used to prioritise assistance.
Photographs, video, or case study material, but only where you (or, for a child, your parent or guardian) have given specific consent.
Details of any complaint, feedback, or safeguarding concern you raise with us.
Why we collect and use your personal data
To assess your eligibility for assistance and register you for a programme.
To design, deliver, monitor and evaluate our programmes, and to understand whether they are meeting their objectives.
To prevent duplication of assistance and to guard against fraud, in line with our due diligence obligations to our donors and regulators.
To respond to, investigate, and act on complaints, feedback, and safeguarding concerns.
To report to our donors, institutional funders, and regulators on how funds have been used, usually in anonymised or aggregated form.
Where you have given consent, to share your story, photograph, or case study to illustrate our work to supporters and the public.
In what situations do we collect personal data from other sources
From local administration, government officials, or community leaders involved in identifying and verifying people in need of assistance.
From other humanitarian organisations, where coordinated targeting, referral, or beneficiary-verification systems are used across agencies to avoid duplication of assistance.
In what situations do we share personal data with other organisations
With our donors and institutional funders, to demonstrate the impact and proper use of their funding. Wherever possible we share this information in anonymised or aggregated form; where individual-level data must be shared to meet a donor’s reporting requirements, we limit what is shared to what is necessary and require the donor to protect it under a written agreement.
With relevant government authorities and local administration, where necessary for programme coordination, registration, or as required by law.
With partner organisations who help us deliver a programme jointly with us.
With law enforcement or child protection authorities, where necessary to protect a child or vulnerable adult from harm.
We only share personal data with another organisation where we have a legal basis to do so, and we do not sell personal data or share it for another organisation’s own marketing purposes.
Special protections for children
Where a programme involves children including our child welfare and orphan sponsorship work — we collect and use personal data only with the involvement of a parent or guardian wherever one can be identified, and we apply additional safeguards consistent with our child safeguarding policy. We do not publish a child’s photograph, name, or identifying story without the specific consent of a parent or guardian (or, in their absence, an appropriate responsible adult), and we limit sharing of a child’s personal data to what is strictly necessary to deliver the programme safely.
Data protection in humanitarian and insecure contexts
Some of our programmes operate in areas affected by drought, displacement, insecurity, or conflict. In these contexts, the disclosure of certain personal data such as a person’s exact location, ethnicity, religion, or household circumstances — could increase risk to that person or their community. Consistent with the humanitarian principle of ‘do no harm’ and the Core Humanitarian Standard, we collect only the personal data we need for a specific purpose, restrict access to it on a need-to-know basis, and take extra care over how and with whom it is shared in these settings.
What is our legal basis for collecting and using personal data
Where we have your informed consent which we seek wherever it is practical and meaningful to do so, recognising that in some emergency or humanitarian settings the circumstances in which assistance is provided may limit how consent can be obtained.
Where the processing is necessary to protect your vital interests, or those of another person – for example, providing life-saving assistance during an emergency.
Where the processing is necessary to perform a task carried out in the public interest, or in our legitimate interest as a humanitarian organisation – for example, assessing needs and preventing duplication of assistance.
Where the processing is required under the law, or necessary to comply with a legal or regulatory obligation — for example, reporting to a donor or regulator.
The rights described in ‘Your rights over your personal data’ above apply to beneficiaries in the same way as they apply to our supporters. In some humanitarian contexts, our ability to fully action a request – for example, to erase data during an active emergency response may be limited where retaining it is necessary to protect your vital interests or to meet a legal or donor reporting obligation; where this is the case, we will explain why.
How we protect beneficiary personal data
We take appropriate technical and organizational measures to protect beneficiary personal data against unauthorised access, disclosure, alteration, loss, destruction or other unlawful processing, taking into account the nature and sensitivity of the information and the risks associated with the context in which assistance is provided.
We limit access of beneficiary personal data to authorised staff, programme personnel, partners, service providers and other persons who have a legitimate need to access the information for purposes connected with the delivery, assessment, monitoring or administration of our humanitarian and development programmes.
We apply appropriate physical, technical and organizational safeguards, which may include access controls, authentication measures, secure storage and transmission, appropriate security software, confidentiality requirements and regular review of access rights.
Where we work with partners, service providers, government authorities, donors or other organisations that may process beneficiary personal data on our behalf or as part of a programme, we take appropriate steps to ensure that personal data is handled securely and in accordance with applicable data protection requirements and any agreed data protection safeguards.
We take additional precautions where beneficiary information may create heightened risks to an individual or community if disclosed or misused.
If we become aware of a personal data breach affecting beneficiary information, we will take appropriate steps to contain, investigate and address the breach and make any notifications required under applicable data protection laws, taking into account the safety and protection of affected individuals.
While we take appropriate measures to protect beneficiary personal data, no method of storing or transmitting information can be guaranteed to be completely secure. In humanitarian and development settings, certain circumstances may also limit the security measures that can practically be implemented. Where this occurs, we will take reasonable steps to minimise the risks to beneficiaries and their personal data.
Consequences of failing to provide personal data
In some cases, if you choose not to provide certain personal data requested by us, it may affect our ability to assess your needs, provide assistance, communicate with you or otherwise deliver our humanitarian or development programmes effectively. The specific consequences will depend on the type of personal data requested, the purpose for which it is needed and the circumstances in which assistance is being provided.
For example, where certain information is necessary to assess your eligibility or needs, register you for a programme, provide assistance, prevent duplication of assistance or communicate with you about the support available, failure to provide that information may mean that we are unable to complete the relevant process or provide the particular assistance or service.
We encourage you to consider the personal data requested and its importance for the intended purpose. If you have concerns about providing certain information, including concerns about how it may affect your access to assistance, please speak to the relevant IRK programme representative or contact us using the details provided in this Privacy Statement.
Sensitive personal data
Kenya’s Data Protection Act, 2019 and the EU GDPR give special protection to certain categories of personal data. In connection with donations made through our website and donation portal, we may process:
Religious or philosophical beliefs – for example, where you choose to designate a donation as Zakat, Sadaqah, or another Islamic giving category, which indicates a religious practice or belief.
Payment card and mobile money details – processed securely on our behalf by our payment processing providers (see ‘In what situations do we share personal data with other organisations’ above); we do not store full card numbers on our own systems.
We process this data only to the extent necessary to fulfil your donation and our related legal and reporting obligations, and we apply additional safeguards to protect it, consistent with the higher standard of care these laws require for sensitive personal data.
Use of cookies
Like most websites, our website (islamic-relief.or.ke) and donation portal (donate.islamic-relief.or.ke) use cookies. Cookies are small text files that are stored on your device when you visit a website. We use cookies to provide you with a smooth and efficient experience – for example, to enable the donation process, to understand how our site is used so we can improve it, and to remember your preferences.
We keep the technical detail in this section deliberately general, because the specific cookies active on our site can change over time as we add or update tools and features. Rather than listing individual cookie names here – which would quickly become outdated and potentially inaccurate – we describe below the categories of cookies we use and what each category is for. You can see the specific cookies active at any time, and manage your preferences, through the cookie settings on the site. See our Cookie Policy for details.
Categories of cookies we use
Strictly necessary cookies – required for the website and donation portal to function, for example, to keep track of your donation as you move through the giving process, or to remember your cookie preferences. These cannot be switched off, and do not require your consent.
Performance and analytics cookies – help us understand how visitors use our site, such as which pages are most visited, so we can identify problems and improve the site. Data collected through these cookies is aggregated and does not identify you individually.
Functional cookies – remember choices you make (such as language or currency) to give you a more personalised experience.
Marketing and social media cookies – used, only where you have given consent, to help us understand which of our campaigns and content are of interest to you, and, where we advertise on social media or other websites, to help those platforms show you more relevant Islamic Relief Kenya content. These may be set by us or by third parties such as social media platforms embedded in our pages (for example, YouTube, Facebook, Instagram, X, or TikTok).
Managing your cookie preferences
On your first visit to our website or donation portal, you will be asked to accept or decline non-essential cookies. You can change your preferences at any time, either through the cookie settings on the site (also linked in the website footer) or through your browser settings. If you choose to decline cookies, some features of our website or donation portal may not work as intended.
Where our pages embed content from third-party websites, those third parties may set their own cookies in accordance with their own privacy and cookie policies, which we do not control. We encourage you to review the relevant third party’s policy for more information.
This section will be reviewed periodically to ensure it reflects the cookies actually in use on our website and donation portal.
Use of profiling
We use limited profiling to help us raise funds for our fundraising objectives, by providing an improved experience for our supporters. For example, we use your donation history and engagement with our campaigns to help us understand the interests and preferences of our supporters, so we can contact them with the most relevant communications. Supporters can opt out of profiling at any time (see ‘Your rights over your personal data’ above).
We will not use personal data obtained through profiling to unlawfully discriminate against you or to make decisions that unfairly or unlawfully affect your rights. Where profiling or automated processing informs a decision that may have a significant effect on you, IRK will provide for appropriate human intervention and review, where required or appropriate, to ensure that the decision is fair, reasonable and consistent with applicable data protection laws.
How long we keep personal data
We only keep personal data for as long as we need it for the purpose it was collected for, including to meet our legal, audit, tax, regulatory and reporting obligations. Islamic Relief Kenya follows the data retention guidelines of Islamic Relief Worldwide, which apply across the Islamic Relief family, together with the retention requirements of Kenyan law. Unless the law or a funding agreement requires a longer period, we keep personal data for no longer than seven (7) years.
Donation and payment records – including M-PESA and card transaction references, receipts and acknowledgements: seven (7) years from the date of the donation, to meet our audit, tax and reporting obligations.
Supporter records – your contact details and the history of your support and communications with us: while you continue to support or engage with us, and for no longer than seven (7) years after your last donation or contact with us.
Marketing preferences – until you withdraw your consent or ask us to stop. We then keep a minimal record of your request so that we do not contact you again.
Enquiries, feedback, complaints and data protection requests – for as long as we need to respond to and resolve them, and for no longer than seven (7) years afterwards.
Event and challenge registrations – for the duration of the event and any related fundraising, and for no longer than seven (7) years afterwards.
Beneficiary records – for the duration of the programme and the period our donors, partners and auditors require for audit and reporting, normally no longer than seven (7) years after the programme ends.
Cookies – for the period set for each cookie, which you can see in our Cookie Policy and cookie settings.
System backups – our website and donation systems are backed up regularly. Backups are kept for a limited period and are overwritten on a rolling cycle.
When personal data is no longer needed, we securely delete it or anonymise it so that it can no longer identify you. Anonymised information may be kept for statistical and reporting purposes.
For more information about how long we keep your personal data, please contact the Data Protection Lead.
Telephone: +254 727 531 220 / +254 734 740 074
Email: [email protected]
As part of the Islamic Relief family, Islamic Relief Kenya is supported in data protection matters by the central Data Protection Team at Islamic Relief Worldwide (IRW), who provide guidance and oversight on data protection practice across Islamic Relief member offices, including our data retention standards.
Telephone: 0800 520 0000 (UK)
Email: [email protected]
Post: Data Protection Team, Islamic Relief Worldwide, 19 Rea Street South, Digbeth, Birmingham, B5 6LB, United Kingdom
Changes to our privacy statement
We keep our privacy statement under regular review, and we will place any updates on this web page. If material changes are made, we will place a prominent notice on our website.
This privacy statement was last updated in October 2026.
How to make a complaint
If you are unhappy about how we have processed your personal data, or have a privacy concern, we want to know about it. To make a complaint or raise a concern, please contact our Data Protection Lead.
Email: [email protected]
Post: Data Protection Lead, Islamic Relief Kenya, Third Floor, Adams Masjid Building, Adams Arcade, Ngong Road, P.O. Box 417 – 00202 (KNH), Nairobi, Kenya
You may also raise a data protection concern with the central Data Protection Team at Islamic Relief Worldwide, who support Islamic Relief Kenya and other member offices on data protection matters:
Telephone: 0800 520 0000 (UK)
Email: [email protected]
Post: Data Protection Team, Islamic Relief Worldwide, 19 Rea Street South, Digbeth, Birmingham, B5 6LB, United Kingdom
If you are unhappy with how we deal with your complaint or concern, you should contact Kenya’s data protection authority, the Office of the Data Protection Commissioner (ODPC). The ODPC can be contacted at:
Britam Towers, 12th Floor, Hospital Road, Upperhill, Nairobi, Kenya
P.O. Box 30920 – 00100, Nairobi, Kenya
Telephone: 020 7801 800
Email: [email protected] | Website: www.odpc.go.ke
You also have the right to make your complaint to the ODPC directly. However, they may advise you to contact us first to see if the matter can be resolved in the first instance.