Privacy Policy

Home / Privacy Policy

Introduction
ZanaAfrica Foundation (“ZanaAfrica,” “we,” “our” or “us”) equips adolescent girls and boys in Kenya with the tools they need to navigate puberty and unlock their potential safely. Its work combines locally made menstrual health products, comprehensive rights-based education, and real-time digital support. In the course of delivering these programmes and selling products through our website zana.africa (the “Site”) and related services (collectively the “Services”), we collect and process personal information.

This Privacy Policy outlines what personal information we collect, how we use it, the legal basis for processing, the circumstances under which we may share it with third parties, and your rights and choices. The policy applies to information we gather when you interact with us online, make a purchase, enrol in our programmes, contact us, subscribe to our newsletter, or use our hotline/chatbot. It does not apply to organisations we do not own or control or to individuals we do not employ. By using our Services, you agree to the practices described here. If you have questions or wish to exercise your rights, please contact us at contactus@zanaafrica.org.

Information we collect

Information you provide directly
We collect information you voluntarily provide when you create an account, place an order, make a donation, enrol in a programme, sign up for our newsletter, request information, or otherwise interact with us. This may include:

• Account and profile data: username, password, date of birth, and gender.
• Contact information: name, email address, phone number, postal address and country of residence.
• Programme information: school, county, preferred language, care-giving status, or other data needed to enrol in reproductive health or parenting programmes.
• Health-related information: questions or concerns that you submit to our chatbot, hotline or rights-based training sessions. We only collect health data with your consent and treat it as sensitive.
• Payment information: credit/debit card details, mobile money details, insurance information and billing address. We use third-party payment processors to securely handle payments and store financial data only as necessary to process transactions.
• Demographic or support data: feedback, testimonials, survey responses or information you provide to us at events, training sessions or through partnerships with community-based organisations.

Providing personal information is optional; however, some services (such as ordering products, receiving programme materials, or hotline responses) cannot be supplied without it.

Information collected automatically
When you use the Site, our servers automatically record certain information sent by your browser or device. This may include your IP address, device type, operating system, browser type, language preferences, pages visited, time spent on pages, search terms and dates and times of access. This data is used to identify potential misuse, to compile statistical reports and to improve our Services; it is not aggregated in a way that identifies any particular user.

Information from third-party sources
We may receive personal information about you from public databases, social media platforms, payment processors, community-based organisations or research partners. This may include demographic information (age, gender), device information (IP address, location), or behavioural data such as page views and search results. We collect these data to enhance our programmes and to better serve our beneficiaries. We do not purchase marketing lists.

How we use personal information
We process personal information for the following purposes:

• Account creation and management: to enable you to register, log in, set preferences and maintain your account.
• Order fulfilment: to process and deliver products (pads, diapers, sanitary cups, dignity kits), issue receipts, manage donations and handle returns or exchanges.
• Programme delivery: to enrol participants in rights-based reproductive health and life-skills programmes, schedule training sessions, evaluate learning outcomes, connect beneficiaries with mentors and send educational materials.
• Hotline and chatbot support: to provide real-time answers to health and safety questions via our toll-free hotline and chat service.
• Communications: to send transactional messages, administrative information, newsletters, programme updates, promotional communications and surveys. You may opt out of marketing communications at any time.
• Personalisation and analytics: to tailor content and programme recommendations, analyse user behaviour, improve products and Services, and measure the impact of our work.
• Research and impact evaluation: to conduct research on reproductive health, gender norms and social behaviour change, often in partnership with academic or government institutions. Data used for research is anonymised whenever possible.
• Legal compliance: to comply with Kenyan law (including the Data Protection Act 2019), European Union General Data Protection Regulation (GDPR) and other applicable laws, respond to law-enforcement requests, enforce our policies, detect fraud and ensure health and safety.

Legal basis for processing
We rely on one or more of the following legal grounds to process personal information:

• Consent: You have given clear consent for us to process your personal data for specific purposes, such as subscribing to our newsletter or participating in a programme.
• Contract: Processing is necessary for the performance of a contract with you—for example, fulfilling an order or delivering a programme.
• Legal obligations: We have legal obligations under Kenya’s Data Protection Act 2019 and other regulations to process certain data (e.g., maintaining purchase records or complying with public health requirements).
• Legitimate interests: Processing is necessary for our legitimate interests (e.g., programme evaluation, fraud prevention, service improvement) provided these do not override your data-protection rights.

Sharing and disclosure
We respect your privacy and do not sell or rent personal information. We may share information with:

• Affiliates and service providers: trusted partners who assist us in operating the Site, fulfilling orders, delivering programmes, hosting events, analysing data, processing payments or sending communications. These providers act on our behalf and may access personal data only to perform their duties and must protect it.
• Community-based organisations and research partners: when necessary to deliver programmes or evaluate impact. We share only what is required and ensure partners uphold similar data-protection standards.
• Government agencies or law enforcement: when required by law (e.g., compliance with subpoenas), to protect your safety or ours, to investigate fraud or to respond to public-health obligations.
• Business transfers: if we ever merge, restructure or transfer assets, personal information may be transferred as part of that transaction.

We do not otherwise disclose your personal information to third parties without your consent.

International data transfers
We operate primarily in Kenya, but we may transfer data to partners or service providers in other countries, including within the European Union or the United States. We ensure that such transfers comply with applicable data-protection laws and that appropriate safeguards, such as contractual clauses, are in place.

Retention of personal information
We retain personal information only as long as necessary to fulfil the purposes described in this policy and to comply with legal obligations. Data retention periods vary depending on the type of information, the purposes for which it is used, and local law. After these periods expire, we securely delete or anonymise the data.

Cookies and similar technologies
We use cookies and similar technologies to personalise your experience, remember your preferences and gather statistics. Our Cookie Policy (see below) provides detailed information about how we use cookies, what types of cookies we employ and how you can manage them.

Children’s privacy
We do not knowingly collect personal information from children under the age of 13, and our programmes serve adolescents through school partnerships and parental consent. If you are under 13, please do not submit any personal information. Parents or guardians who believe that a child has submitted personal information may contact us to request deletion.

Your rights and choices
You may have the following rights under the Kenya Data Protection Act 2019, GDPR or other applicable laws:

• Access: Request confirmation about whether we process your personal data and obtain a copy of that data.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data, subject to legal exceptions.
• Restriction: Ask us to restrict processing of your personal data in certain circumstances.
• Objection: Object to our processing of your personal data based on legitimate interests or for direct marketing.
• Portability: Request a copy of your data in a structured, commonly used and machine-readable format.
• Withdraw consent: Where processing is based on consent, withdraw that consent at any time (without affecting the lawfulness of prior processing).

To exercise these rights, please email contactus@zanaafrica.org. We may ask for proof of identity. You also have the right to lodge a complaint with the Kenyan Data Protection Commissioner or other supervisory authority.

Security
We implement reasonable administrative, technical and physical safeguards to protect personal information against unauthorised access, use, alteration or disclosure. Measures include encryption, secure servers and access controls. However, no method of transmission or storage is 100 % secure; therefore, we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and ensuring the security of your device.

Data breaches
If we become aware of a security breach that affects personal data, we will take appropriate measures to investigate and contain the breach, notify affected individuals if required by law and cooperate with regulators.

Updates to this policy
We may modify this Privacy Policy to reflect changes in our practices or legal requirements. When we update the policy, we will revise the “last updated” date below and, where required, notify you via the Site or email. Your continued use of the Services after any update constitutes acceptance of the revised policy.

Last updated: October 10, 2025