1. Who We Are
1.1 ISKCON Nairobi, also known as Sri Sri Radha Bankebihari Temple, operates https://iskcon-nairobi.vercel.app from Hare Krishna Close, Parklands / West Ngara, Nairobi, Kenya.
1.2 If ISKCON Nairobi publishes additional registered entity details, registration numbers, or statutory status information, those details will be read together with this Policy.
1.3 For personal data collected through this website, ISKCON Nairobi acts as the data controller unless a third-party service states otherwise.
1.4 We process personal data in accordance with Kenya's Data Protection Act, 2019 and its subsidiary regulations, as administered by the Office of the Data Protection Commissioner.
1.5 Privacy contact: iskconnairobi@gmail.com.
2. Personal Data We Collect
| Category | Examples | Source |
|---|---|---|
| Identity data | Full name and, where relevant for children's programmes, date of birth. | Provided directly by you. |
| Contact data | Email address, phone number, physical address, or postal address. | Provided directly by you. |
| Transaction data | Donation or seva amount, payment reference, payment method metadata, order or booking history. | Generated through website use or payment processors. |
| Account data | Username, password credentials where accounts exist, and account preferences. | Provided directly by you. |
| Engagement data | Event RSVPs, course applications, volunteer sign-ups, newsletter subscriptions, and programme interests. | Provided directly by you. |
| Communications | Messages, prayer requests, testimonials, support queries, and contact-form submissions. | Provided directly by you. |
| Media data | Photographs, video, livestream footage, audio recordings, testimonials, and public event images. | Captured at Temple programmes or submitted by you. |
| Technical data | IP address, browser type, device information, cookie data, and usage or analytics data. | Collected automatically when you browse. |
| Children's data | Parent or guardian contact details, emergency contacts, age/date of birth where needed, programme attendance, and relevant medical or allergy notes. | Provided by a parent, guardian, or authorized programme contact. |
| Sensitive data | Religious interest inherent to the website's purpose and, only where voluntarily provided, dietary, allergy, health, prayer, pastoral, or safeguarding information relevant to a service request. | Provided directly by you or by a parent/guardian with consent. |
3. How We Collect Data
3.1 We collect data directly from you when you submit forms, register interest, make an enquiry, request prayer or blessings, sign up to volunteer, subscribe to updates, book an event, apply for a course, or contact us.
3.2 We may collect data from a parent or guardian where a child is enrolled in a youth programme, class, festival service, retreat, or other supervised activity.
3.3 We may collect photographs, video, audio, and livestream footage during Temple programmes, festivals, kirtans, classes, processions, community service, and other public events.
3.4 We may collect limited technical data automatically through cookies, analytics, logs, and similar technologies when you browse the website.
3.5 We may receive confirmation data from third parties such as payment processors, registration forms, email tools, messaging platforms, or social media services when you choose to use those services.
4. Legal Basis and Purpose of Processing
| Purpose | Legal Basis |
|---|---|
| Processing donations, seva payments, bookings, and orders | Performance of a contract, consent, or legitimate interest. |
| Managing accounts or login features | Performance of a contract. |
| Sending event, festival, programme, and newsletter updates | Consent or legitimate interest for existing engaged users, with opt-out available. |
| Responding to enquiries, prayer requests, and support messages | Consent or legitimate interest. |
| Improving and securing the website | Legitimate interest, subject to cookie preferences where required. |
| Maintaining accounting, tax, and compliance records | Legal obligation. |
| Preventing fraud, abuse, or unauthorized access | Legitimate interest and legal obligation. |
| Photographing, filming, livestreaming, or archiving public Temple events | Legitimate interest, consent where required, and religious/community purpose. |
| Managing children, youth, safeguarding, and emergency information | Consent, explicit consent where needed, vital interests, legitimate interest, and legal obligation. |
| Processing sensitive or special-category data | Explicit consent or voluntary public disclosure where applicable. |
5. Payment Data
5.1 We do not store complete debit or credit card numbers, CVV codes, M-Pesa PINs, or other full payment credentials on this website.
5.2 Where payments are enabled, they are processed through third-party providers such as mobile money, card, bank-transfer, or other payment gateways. Those providers apply their own security standards, terms, and privacy policies.
5.3 We may retain transaction metadata such as amount, date, purpose, payer contact information, and transaction reference for receipts, accounting, donor records, fraud prevention, and legal compliance.
5.4 If a transaction appears fraudulent, unauthorized, reversed, or disputed, we may retain related records and share necessary information with payment processors, banks, mobile-money providers, law enforcement, regulators, or professional advisors.
6. How We Share Data
7. Data Retention
7.1 We retain personal data only for as long as necessary for the purposes described in this Policy, including legal, accounting, reporting, dispute-resolution, and security requirements.
7.2 Donation and financial transaction records may be retained according to Kenyan financial and tax record-keeping requirements, generally for at least five to seven years where applicable.
7.3 Account data is retained while an account is active and for a reasonable period after closure. Marketing and newsletter data is retained until you unsubscribe or withdraw consent.
7.4 Prayer requests, pastoral communications, allergy notes, child programme details, safeguarding information, and other sensitive communications are retained only as long as needed for their purpose, then deleted, anonymized, or securely archived where legal or safeguarding obligations require retention.
7.5 Media files may be retained for religious, historical, archival, educational, reporting, or promotional purposes unless removal is requested and removal is practical, lawful, and proportionate.
8. Your Rights
8.1 Under Kenya's Data Protection Act, 2019, you have the right to be informed of how your personal data is used, access personal data we hold about you, object to processing, request correction of false or misleading data, request deletion of false or misleading data, and withdraw consent where processing is based on consent.
8.2 To exercise these rights, contact iskconnairobi@gmail.com. We will respond within the timeframe required by law.
8.3 You may opt out of direct marketing messages through the unsubscribe link, reply instructions, or by contacting us. Service, safety, transaction, event-change, or legal notices may still be sent where necessary.
8.4 Parents and guardians may contact us about personal data relating to their children, subject to verification and applicable safeguarding or legal retention duties.
8.5 If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner in Kenya.
9. Cookies and Tracking Technologies
10. Data Security
10.1 We apply reasonable technical and organizational measures appropriate to the risk, including HTTPS encryption in transit, access controls, and restricted internal access to personal data on a need-to-know basis.
10.2 We may preserve access logs, transaction records, form submissions, and security information where reasonably necessary to investigate fraud, cyber abuse, unauthorized access, safety incidents, safeguarding concerns, or legal claims.
10.3 No digital system is completely secure. If a data breach is likely to result in risk to your rights, we will notify the Office of the Data Protection Commissioner and affected users as required by applicable Kenyan law.
11. Children's Data
11.1 Where the website supports programmes for minors, such as Sunday school, youth programmes, training classes, retreats, transport, or festival service, we collect only the personal data necessary for that programme and require consent from a parent or legal guardian where required.
11.2 Children's data may include emergency contacts, medical or allergy notes, attendance records, pick-up permissions, media consent preferences, and safeguarding information where necessary.
11.3 Parents or guardians may contact us to review, correct, or request deletion of a minor's personal data, subject to records we are legally required to retain or must retain for safeguarding reasons.
12. International Users
12.1 Although this website is operated from Kenya, it may be accessed by devotees, guests, and supporters outside Kenya.
12.2 If you access the website from outside Kenya, your data may be processed in Kenya and in jurisdictions where our service providers operate, in accordance with this Policy and applicable safeguards.
13. Changes to This Policy
13.1 We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements.
13.2 The Last Updated date at the top of this Policy shows the most recent revision. Material changes may be communicated through a website notice or by email where appropriate.
14. Media, Public Events, and Consent
14.1 Temple programmes and public events may be photographed, filmed, livestreamed, or recorded for religious, archival, educational, reporting, fundraising, and promotional purposes.
14.2 If you do not want to appear in identifiable close-up media, you should notify the organizer where practical. We will make reasonable efforts to respect such requests, but wide crowd images, public processions, livestreams, and incidental appearances may not always be avoidable.
14.3 Close-up promotional use of identifiable children should be based on parent or guardian consent unless another lawful basis applies.