Privacy Notice • NG-CDF Digital Platform

1. Data Controller & Data Protection Officer (DPO)

Under Section 18 of the Kenya Data Protection Act, 2019, the National Government Constituencies Development Fund Board (NG-CDF Board) and the respective Constituency Development Fund Committees (NG-CDFCs) operate as joint Data Controllers.

2. Information Collected Across System Modules

We process personal data only when necessary to perform statutory mandates under the NG-CDF Act, 2015:

• Citizen Feedback & Grievances: Feedback may include your name, email address, phone number, ward, message, and any supporting attachment you choose to provide. You may submit anonymously, but anonymous submissions cannot receive direct resolution updates.
• Education Bursaries & Scholarships: Student full name, date of birth, National ID/NEMIS UPI/Birth Certificate entry number, admission number, institution of study, fees and fee arrears statements, parent/guardian full name, contact phone number, occupation, and household income.
• Special Categories & Sensitive Personal Data (Section 44 & 46): PWD status and nature of disability, orphan status, and associated verification documents (death certificates, Chief's letters, or NCPWD registration cards) required for statutory affirmative action scoring.
• Staff & Operational Telemetry: For staff operations, the platform processes account and role information, authentication events, and audit records for access control and accountability. Field inspection records may include project-site and inspector GPS coordinates.

3. Processing of Children's Data (Section 33)

Bursary applications for secondary school students involve the personal data of minors (children under the age of 18). In strict compliance with Section 33 of the Kenya Data Protection Act, 2019, such processing is conducted only with the verified consent of the child's parent or legal guardian, and solely in a manner that protects and advances the best interests of the child. Public beneficiary schedules automatically redact full student names and student identification numbers.

4. Purpose and Access

Contact details are used to route an inquiry and, where contact details are supplied, to track and respond to it. Authorized officers may access submissions to triage, investigate, and resolve them. Avoid including information that is not necessary to explain your inquiry.

Bursary information is accessed strictly by authorized Ward Bursary Vetting Committees, Fund Account Managers, and statutory audit bodies (such as the Office of the Auditor-General) for financial accountability.

5. Hosting and International Transfers

The responsible data controller has advised that primary production data are hosted in Kenya. The application configuration does not independently verify the physical locations of the hosting provider, backups, disaster-recovery copies, logs, or third-party services. Those locations and any cross-border processing or transfer safeguards should be confirmed by the data controller and relevant providers.

6. Retention and Data Rights (DSAR)

The application does not yet enforce an approved retention schedule. Records should be retained only for as long as needed for their stated purpose and applicable legal, public-records, and audit obligations. The responsible data controller must approve and publish category-specific retention periods; a review report in the application may identify records for consideration but does not delete or alter them. You may submit a personal data request or contact the responsible NG-CDF office through the contacts directory. The office may need to verify your identity before acting. Do not send identity documents or national ID numbers through the request form.

7. External Services and Browser Storage

Essential session and security cookies support sign-in and protected forms. Browser storage is used for interface preferences. Some pages load fonts from Google Fonts and map tiles from OpenStreetMap; those providers may receive connection data, including your IP address, when a resource is requested. The platform currently has no analytics or advertising tracker configured.

8. Staff Account Security

Staff sign-in supports password authentication and optional authenticator-app two-factor authentication. Two-factor authentication is not currently mandatory. Authentication audit records are retained for security and accountability and should be handled as personal data.

9. Right to Lodge a Complaint with the Regulator

If you believe that your personal data has been handled in breach of the law, you have the right under Section 56 of the Kenya Data Protection Act, 2019 to lodge a formal complaint with the Office of the Data Protection Commissioner (ODPC):