Last updated: 25 October 2026
Kenya Fans Association ("KFA", "we", "us") is a members' association mobilizing fans to support Kenyan sport. We are a data controller under Kenya's Data Protection Act, 2019 (the "Act") for the personal data we collect through this website and membership system. This policy explains what we collect, why, and how we handle it, in line with the Act and the regulations made under it.
When you register as a member, buy a ticket, or take part in a KFA activity, we may collect:
We don't knowingly collect more than we need for the purpose it's collected for, consistent with the Act's data minimisation principle.
For each piece of information we hold, we rely on one of the lawful bases recognised under the Act - usually your consent (e.g. when you register or tick the agreement box), performance of a contract with you (e.g. fulfilling a ticket order), a legal obligation we're under, or our legitimate interest in running the Association (e.g. keeping membership and meeting records), balanced against your rights.
We use your information to run your membership, verify and badge you, process ticket orders, send you SMS/email updates relevant to your membership (e.g. meeting notices, ticket confirmations), and administer KFA's programmes.
We do not sell your personal data. We only share it with service providers who help us run the Association (e.g. SMS and payment providers) strictly to deliver those services, with other parties where the Act or another law requires it, or where you've consented. Any transfer of your data outside Kenya is only made where the receiving country or organisation has adequate data protection safeguards in place, or another safeguard recognised under the Act applies.
We keep your information only for as long as necessary for the purpose we collected it, for as long as you remain a member, and for any additional period required by law or needed to resolve a dispute. When it's no longer needed, we delete or anonymise it.
Under the Act, you have the right to:
To exercise any of these rights, contact us using the details in the footer of this site. If you're not satisfied with our response, you can complain to the ODPC at odpc.go.ke or info@odpc.go.ke.
We don't knowingly collect personal data from a child (under 18 years) without the consent of their parent or guardian, given in a way that protects and advances the child's best interests, as required under the Act. If you believe a child has provided us with personal data without that consent, please contact us so we can remove it.
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. If a breach occurs that creates a real risk of harm to you, we will notify the ODPC without undue delay (within the timeframe the Act requires) and inform you directly where we're able to identify you and it's practicable to do so.
This site uses only the minimal technical cookies/session data needed to keep you logged in and to remember things like dismissed notices - we don't use third-party advertising trackers.
We may update this policy from time to time. The "last updated" date above will change whenever we do.
Questions about this policy, or to make a data rights request? Reach us using the contact details in the footer of this site.
