Privacy Policy

1. Who we are

Leadership Sio Kelele Movement

Leadership Sio Kelele ("the Movement", "we", "us", "our") is a national citizens movement operating this public website and the My Account member portal at /my-account. This policy covers both. If you have questions about this policy or how your data is handled, contact us at info@leadsioskelele.or.ke.

2. Information we collect

When you register a My Account membership: your name, phone number, email address, a password (we never see or store it in plain text; see "How we protect your information" below), and, if you provide them, your occupation, country, county, constituency and ward. Kenyan members are grouped by county and constituency for chapter matching; diaspora members record their country of residence instead.

When you enable two-factor authentication: an encrypted authenticator secret used only to verify the 6-digit codes generated by your authenticator app.

When you make a payment or donation: for a one-time contribution to unlock a downloadable digital ID, an optional annual support-level contribution, or a guest donation, we record the amount, currency, payment method, a reference to the transaction, and, for M-Pesa payments, the phone number used. For guest donations we also record the donor name and email you provide. We do not receive or store your M-Pesa PIN, card number or banking credentials; those are handled directly by our payment processor, PayHero, and the relevant mobile money or card network.

When you contact us, subscribe to our newsletter, apply to coordinate a chapter, or respond to a public survey: the information you submit in that form (for example, your name, email and message).

Technical and session information: a session token is generated when you sign in and stored in your browser to keep you signed in; we also log administrative actions (such as membership status changes) for accountability. See "Cookies and local storage" below.

3. How we use your information

We use your information to: create and operate your My Account membership; match you to the correct county or constituency chapter; issue and verify your digital membership ID; process payments and contributions you initiate; respond to messages, applications and survey responses you send us; and, only where a channel is active and you have not opted out, send you SMS or email updates about the movement's activities.

SMS messages (verification codes, event reminders, broadcast notices) are sent through Africa's Talking. Emails (password resets, account notices, invitations) are sent through the SMTP provider we have configured. We do not use either channel for advertising, and we do not share your contact details with either provider for any purpose beyond delivering that specific message.

4. Your digital membership card and the public verification page

Your digital membership card includes a QR code. Scanning it opens a public page confirming your membership is active and showing your name, membership category, verification status, county and constituency, the same information already visible on the physical card itself, intended to let a Movement officer or partner organisation confirm your membership at a glance. This verification page does not show your phone number, email address, payment history or any other contact or financial information, and it does not require the viewer to be signed in. If you would prefer this page not to resolve for your account, contact us and we can deactivate your membership number's public verification.

5. Cookies and local storage

This site does not use third-party advertising or cross-site tracking cookies. We use a small amount of necessary browser storage: to keep you signed in to My Account or the administration portal, to remember that you have already seen a one-time public survey prompt, and to protect our public forms (contact, newsletter, coordinator applications) from automated spam submissions. Clearing your browser's storage will simply sign you out and reset any form you were filling in.

6. Who we share information with

We do not sell member or donor data. We share information only with the service providers necessary to run the platform, each acting on our instructions: PayHero (and, for M-Pesa transactions, Safaricom) to process payments; Africa's Talking to deliver SMS messages, if SMS is active; our configured SMTP provider to deliver email; and our database and hosting infrastructure. We may also disclose information where required by Kenyan law or to protect the rights, safety or property of the Movement, our members or the public.

7. How we protect your information

Passwords are one-way hashed and are never stored or logged in readable form. Two-factor authentication secrets and gateway credentials (payment, SMS and email provider secrets) are encrypted at rest. Sign-in sessions use a bearer token; the token itself is hashed on our servers, so a database copy alone cannot be used to sign in as you. Payment card and mobile money credentials are never transmitted to or stored on our servers.

8. Your rights and choices

You can exercise the following directly from My Account → Settings, without waiting on us:

Access and correct your data: your profile is visible and editable at any time. Export your data: download a copy of your account information as a file. Change your password or enable/disable two-factor authentication: under Security. Sign out of all devices: immediately invalidates your active session everywhere. Delete your account: permanently removes your membership record, including your digital ID and stored profile information. Account deletion cannot be undone.

If you would rather we handle a request on your behalf, including correcting information tied to a payment record or restricting your public verification page, email info@leadsioskelele.or.ke and we will respond within a reasonable time.

9. Data retention

We retain your membership information for as long as your account is active, and payment records for as long as required for financial accountability and Kenyan law. If you delete your account, your profile and digital ID are removed immediately; payment and audit records that Kenyan law requires us to retain are kept only as long as legally necessary and are no longer linked to an active membership profile.

10. Children

My Account membership is intended for adults (18 years and older) and young people old enough to meaningfully participate in civic life under the guidance of a parent or guardian. We do not knowingly collect information from young children.

11. International and diaspora members

Members outside Kenya can register with their country of residence instead of a county. Your information is processed on servers operated for Leadership Sio Kelele; by registering, diaspora members consent to this processing in connection with their membership.

12. Changes to this policy

We may update this policy as the platform and the movement grow. Material changes will be reflected by an updated effective date at the top of this page; continued use of My Account after a change constitutes acceptance of the revised policy.

13. Regulator and contact

Leadership Sio Kelele processes personal data in accordance with Kenya's Data Protection Act, 2019. If you believe we have not handled your information appropriately, you may contact us first at info@leadsioskelele.or.ke, or lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.