KWTRP WEB PRIVACY NOTICE
PURPOSE OF THIS NOTICE
The KEMRI Wellcome Trust Research Programme (“we”, “our”, “us” or “KWTRP”) collects and processes personal information. This notice describes how we collect and use your personal information in accordance with the Kenya Data Protection Act (2019), the Kenya Data Protection Regulations, 2021 and applicable regulations such as the EU General Data Protection Regulation (GDPR).
It is important that you read this notice so that you are aware of how and why we are using such information and to understand your rights.
Unless otherwise indicated, KWTRP is the organisation responsible (or “data controller”) for processing your personal information described in this Privacy Notice.
DATA PROTECTION PRINCIPLES
We will comply with the relevant data protection laws and regulations. This says that the personal information we hold about you must be:
- Used in accordance with your right to privacy.
- Used lawfully, fairly, and in a transparent way.
- Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
- Relevant and adequate to the purposes we have told you about and limited only to those purposes.
- Accurate and kept up to date with an assurance that inaccuracies are erased or rectified without delay.
- Kept only as long as necessary for the purposes we have told you about.
- Kept securely and only transferred outside Kenya with adequate safeguards and your consent.
INFORMATION WE COLLECT ABOUT YOU
“Personal data”, or “personal information”, is defined as any information about a living individual from which that person can be identified. We collect, store, and use the following categories of personal information:
Information You Provide:
Contact us forms:
- First name, last name
- Email address,
Application forms (Engagement subsite):
- First, last and other names
- Email address
- KCPE Index number
- KCSE Index number
- Mobile phone number (student and parent/guardian)
- Village name
Application forms (Career Webinar Series):
- First name, surname
- Email address
- I’m a Scientist Kenya Teacher Application
- First and last name
- School name and address
- I’m a Scientist Kenya Scientist Application
- First and last name
- Email address
- Name and address of place of work
- SLAS Students page; name, residence, primary school, secondary school, favourite school subject, career aspirations, hobbies and personal blog
You may decline to provide us with your personal information, but please note that we may not be able to provide the services you have requested without certain personal information. For example, if you do not provide required registration information then we will not be able to register you for a course or review your application.
Information indirectly collected from the website:
- type of device (and its unique device identifier) you use to access our site,
- Internet protocol (IP) address used to connect your device to the Internet,
- your login information (username and password),
- browser type and version,
- time zone setting,
- browser plug-in types and versions,
- operating system,
- mobile network information and platform;
Information about your visit to our site:
- full Uniform Resource Locators (URL),
- clickstream to, through and from the website (including date and time),
- pages you viewed,
- page response times,
- download errors,
- length of visits to certain pages,
- page interaction information (such as scrolling, clicks, and mouse-overs),
- methods used to browse away from the page.
What are cookies?
A cookie is a small file downloaded on to and/or read by a device (for instance a computer or smartphone) when a user accesses a website. Cookies typically enable websites to work or work more efficiently. They can also be used to recognise a user’s device.
The information collected by cookies on our websites is used for various purposes, including the following:
Functional: These technical cookies are essential for the operation of our website and for enabling you to use its features, for example logging into secure areas.
Analytics and Performance: these cookies are used to analyse the frequency of visits to our websites and what visitors do on our websites. This helps us to improve the way our websites work, for example, by ensuring that you can find what you are looking for easily, or that our websites remain up and running.
Various types of cookies
- Authentication cookies: WordPress uses authentication cookies to verify the identity of logged-in users and grant them access to restricted areas of the website.
- Session cookies: These cookies are used to keep track of user sessions on the website. They are typically deleted when the user logs out or closes the browser.
- Comment cookies: When users leave comments on a WordPress website, their name, email, and website may be stored in cookies for so they don’t have to re-enter the information every time they leave a comment.
- Analytics cookies: WordPress websites may use analytics cookies to collect data on how users interact with the website, such as which pages they visit and how long they stay on each page.
Which cookies does KWTRP use?
- Performance cookies: These cookies are used to collect data on website usage, such as which pages are visited most frequently, to improve website performance and user experience.
- Analytics cookies: These cookies are used to collect data on website traffic and user behaviour, such as how long users stay on the site and what pages they visit.
Which cookies do third parties set on our websites?
How can you manage your cookie settings?
In case you decide to turn off cookies we have these helpful links below for you. Please select your browser and click on the respective link. You will be transferred to the browsers help page for instructions concerning your cookie settings.
Changes to this Cookies Policy
Third party access to your personal information:
- Third party access tools used on our website are:
- WordPress plugins and themes
- Google Analytics
- Social Media plugins: Twitter, YouTube, LinkedIn
NOTICE TO PARENTS
To help guard children’s online safety and privacy, we encourage parents and/or guardians to educate their children about safe and responsible use of their Personal Information while using the Internet.
KWTRP School engagement Programme www.KEMRI-Wellcome.org/SEP publishes content that is targeted to children. However, if you are concerned about your children providing KWTRP any personal information without your consent, KWTRP offers a Kids account. This allows parents to give parental consent for the collection, use and sharing of children’s (ages 12 and under) personal information online.
HOW WE USE YOUR PERSONAL INFORMATION
We will only use your personal information when the law allows us to. Most commonly, we will use your personal information for the following purposes:
Information provided by you:
Contact us; respond to questions and your message
Application information; personal information you provide is used to;
- Register you, to create an account from which you can manage your applications,
- To review your suitability for a job, training position as advertised,.
- To deliver information about training courses and the follow up activities after the course.
- Newsletter subscription; to send you KWTRP emails and newsletters.
Information collected indirectly:
We process your data for purposes arising from your use of the website in order to:
- Ensure that we understand who and how our site is used
- Improve our site and ensure it is secure.
We will only use your data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another related reason and that reason is compatible with the original purpose. If we need to use your data for an unrelated purpose, we will notify you of that new purpose where applicable.
We will use your personal information when we have a valid legal basis, including when:
- We need to take steps at the request of applicants prior to providing training programs.
- You have consented by subscription to our use of your personal information, for example to send you newsletters.
- We need to comply with a legal obligation.
- We or a third party have a legitimate interest (or those of a third party) and those interests are not outweighed by your interests and fundamental rights.
We may share your data with third parties in or outside Kenya to comply with our legal or contractual requirements or to pursue our legitimate interests in connection with the use of our website. Where such personal information is transferred out of Kenya this will be done with your consent or with the permission of the Data Protection Commissioner.
If such a recipient is located in a country that does not have laws that ensure an adequate level of data protection, we will implement appropriate measures to ensure that your personal information remains protected and secure when it is transferred outside of Kenya, in accordance with applicable data protection and privacy laws.
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed to unauthorised parties or individuals. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have an authorised role in using your personal information. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.
We may share your data with third parties, this includes research collaborators and training partners providing courses. All our third-party service providers are required to take appropriate security measures to protect your data in line with our policies. All 3rd parties are also required to abide by the Data protection Act 2019 and are not allowed to use/process this data for any other purpose than was initially consented for by us.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
You also have a significant role in protecting your information. No one can see or edit your personal information without knowing your username and password, so do not share these with others.
Data is stored in password-controlled servers with limited access. Your information will be stored and processed in KWTRP
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.
Some of the cookies will last only for the duration of your browsing session while others may persist for longer periods of time based on your browser settings or the installed website plugins.
In the following circumstances, your personal information will be retained for longer than the specified periods:
- as required by law or court order;
- as needed to defend or pursue legal claims.
In certain circumstances we will anonymise your personal information so that it can no longer be associated with you, in which case we use such information without further notice to you. We will retain and securely destroy your personal information in accordance with the applicable laws and regulations.
Form Data – This refers to any data that a user submits through forms on the website, such as contact forms or subscription forms. The data is stored on GoDaddy where the KWTRP website is hosted. The data is kept for 3 years duration and deleted thereafter.
Data from School Leaver’s Attachment Scheme form, I’m a Scientist Kenya Teacher Application, I’m a Scientist Kenya Scientist Application and SLAS profile pages is kept for 3 years duration and deleted thereafter.
Data – This refers to any data that a user submits through a job application form on the website. The data is stored on KWTRP servers and is kept for xx duration and deleted thereafter.
YOUR RIGHTS OF ACCESS, OBJECTION, CORRECTION, AND DELETION
Your rights in connection with personal information
Under certain circumstances, by law you have the right to:
- Request access to your personal information. This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- Object to the processing of all or part of your personal information.
- Request correction and/or deletion of the personal information.
- Request receipt or transmission to another organisation, in a machine-readable form, of the personal information that you have provided to us.
We need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it. Please contact DPContact@kemri-wellcome.org for data access requests.
RIGHT TO WITHDRAW CONSENT
If you have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact DPContact@kemri-wellcome.org. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
ENQUIRIES ABOUT THIS NOTICE
In the event that you wish to make a complaint about how we process your personal information, please contact DPContact@kemri-wellcome.org and we will endeavour to deal with your request as soon as possible.
You have also the right to complain directly to the Office of the Data Protection Commissioner (ODPC) or any other relevant data protection authority.
The ODPC’s address:
Office of the Data Protection Commissioner
PO Box 30920-00100
Telephone numbers: +254796954269 or +254752896867
To file a complaint: https://www.odpc.go.ke/file-a-complaint/
CHANGES TO THIS NOTICE
We reserve the right to update this notice at any time without prior notice, and we will notify you when we make any material updates.
Please contact us at: DPContact@kemri-wellcome.org