Are you an LLM? Read llms.txt for a summary of the docs, or llms-full.txt for the full context.
Skip to content

Grassroots Economics Foundation Data Protection Policy

Review draft — not yet effective. This English text is available for public review before legal approval and translation. It does not replace an operative GEF policy until an approved version takes effect.

Draft version: 1.0 Draft date: 24 October 2026

1. Purpose

Grassroots Economics Foundation (GEF) respects privacy and handles personal data as a responsibility to the people and communities involved in its work. This Policy establishes minimum standards for personal data processed through GEF systems, programs, research, education, events, partnerships, and operations, including the Cosmo-Local Credit App (CLC App).

This Policy is informed by Kenya's Data Protection Act, 2019, applicable regulations, and current Office of the Data Protection Commissioner guidance. Other laws may also apply where GEF works or where affected people are located.

The CLC App Privacy Notice gives more specific information about App fields, public resources, recipient lookup, and public blockchain records. The Terms of Service govern use of the App.

2. Scope

This Policy applies to GEF trustees, directors, staff, volunteers, interns, contractors, consultants, researchers, and other people processing personal data for or on behalf of GEF. Contracts and partnership arrangements must apply appropriate data-protection duties to service providers and partners.

The Policy covers personal data in digital, paper, audio, visual, research, communications, and other records. It applies whether GEF acts as a controller, joint controller, or processor. A project must identify GEF's role and the roles of other parties rather than assuming that one policy controls every participant.

3. Governing principles

GEF processes personal data in accordance with the following principles:

  1. Lawfulness, fairness, and transparency. People receive understandable information about material processing before or when their data is collected, where practicable and required.
  2. Purpose limitation. Data is collected for specific, explicit, and legitimate purposes and is not reused incompatibly without a lawful basis and appropriate notice.
  3. Data minimization. GEF collects and shares only what is reasonably necessary for the stated purpose.
  4. Accuracy. Reasonable steps are taken to keep material personal data accurate and to correct misleading records.
  5. Storage limitation. Identifiable data is kept only as long as reasonably necessary for its purpose and applicable obligations.
  6. Integrity and confidentiality. Safeguards are proportionate to the data, people, context, and risks.
  7. Accountability. GEF documents important decisions and can demonstrate how these principles are applied.
  8. Participation and dignity. Data practices must respect the agency, safety, culture, and reasonable expectations of affected people and communities.

4. Accountability and responsibilities

GEF's governing and management bodies are responsible for ensuring that privacy risks receive appropriate resources and oversight. They designate accountable roles for privacy coordination, information security, records, research governance, safeguarding, incident response, and data-subject requests.

Responsibility follows the work and authority involved; it is not assigned automatically to a particular department. Everyone working for or on behalf of GEF must:

  • follow this Policy and the procedures relevant to their role;
  • access personal data only when authorized and necessary;
  • report suspected loss, misuse, disclosure, or security weakness promptly;
  • complete required training; and
  • ask the responsible project or privacy lead before starting uncertain or high-risk processing.

GEF maintains appropriate records of processing systems, purposes, data categories, people affected, lawful bases, recipients, transfers, retention, safeguards, and accountable owners.

5. Lawful grounds and consent

Every processing activity must have an applicable lawful ground, such as consent, performance of an agreement, compliance with a legal obligation, protection of vital interests, a task in the public interest where legally available, or a legitimate interest that is not overridden by people's rights.

The responsible team records the ground before collection. Where consent is used, it must be informed, specific, freely given where required, evidenced, and as easy to withdraw as to give. Refusing or withdrawing consent must not result in an undisclosed penalty.

Consent is not the default answer for every activity. GEF must use the ground that accurately describes the processing and provide any additional safeguards required for sensitive data, children, vulnerable people, direct communications, research, or international transfers.

6. Transparency and collection

Before collecting personal data, GEF provides a notice suited to the audience and context. It should explain, as applicable:

  • who is collecting the data and how to make contact;
  • what data is collected and whether it is required or optional;
  • why it is used and the lawful ground;
  • the consequences of not providing required data;
  • who receives it and whether it may be processed internationally;
  • how long it is kept or how retention is decided;
  • material security and confidentiality arrangements;
  • whether information will be published or placed on a public blockchain; and
  • the person's rights and complaint routes.

GEF ordinarily collects data directly from the person. Indirect collection must have a lawful basis, a documented source, and appropriate notice unless a lawful exception applies.

7. Sensitive data and people at heightened risk

Data can create serious risk because of its content, context, combination, or the people involved. This includes health, biometric, genetic, ethnic, religious, political, sexual, financial, precise-location, identification, and safeguarding information, as well as data that could expose someone to discrimination, violence, exclusion, surveillance, exploitation, or loss.

GEF applies heightened safeguards where risk is greater. Measures can include collecting less data, separating identifiers, stronger access restrictions, encryption, shorter retention, safer contact methods, secure transfer, disclosure review, specialist advice, and a documented impact assessment.

Teams must consider local circumstances. A name, community affiliation, map point, Wallet address, photograph, or transaction history can be sensitive even when it is not classified as sensitive data in every law.

8. Children and safeguarding

Processing a child's data requires special care, an applicable lawful ground, age-appropriate information, and any required parental or guardian authorization. The child's best interests are a primary consideration.

GEF minimizes children's data, limits access, avoids unnecessary precise locations or identifying media, and assesses whether publication or digital communication could create foreseeable harm. Data handling must follow the Child Safeguarding Policy.

The CLC App is restricted to adults. This Policy does not create a route for a child to register for the App.

9. Privacy by design and impact assessment

Privacy requirements must be considered when a project or system is designed, not added only after data has been collected. Teams must define the purpose, data flow, visibility, access, retention, deletion, provider, transfer, and incident arrangements before launch.

GEF conducts and records a data-protection impact assessment when processing is likely to create high risk. Relevant triggers include large-scale or systematic monitoring, sensitive or children's data, precise location, new technology, public matching, automated evaluation, combining datasets, or irreversible publication.

Unresolved high risk must be escalated to the accountable management or governance body and, where required, the competent authority before processing begins.

10. Access and security

Access to personal data is limited according to role and need. GEF selects safeguards appropriate to the system and risk, which can include:

  • strong authentication and controlled administrative access;
  • least-privilege permissions and separation of duties;
  • secure transport and appropriate protection of stored data;
  • supported software, patching, configuration review, and vulnerability management;
  • logging, monitoring, rate limits, and abuse detection;
  • protected backups, tested recovery, and service-continuity measures;
  • secure deletion or destruction when retention ends; and
  • contractual confidentiality and security duties for personnel and providers.

Security controls are reviewed when systems, threats, or risk change. Public blockchain records require different safeguards because confirmed records cannot ordinarily be changed or deleted.

11. Service providers, partners, and transfers

Before giving a service provider access to personal data, GEF assesses the purpose, necessity, security, location, onward sharing, deletion, and ability to support legal obligations. Written terms must define permitted processing, confidentiality, security, incident reporting, subprocessing, assistance, return or deletion, and oversight where required.

Partnership does not by itself make every organization a processor. Each arrangement must identify whether the parties act as independent controllers, joint controllers, or controller and processor, and give people accurate information about those roles.

International access or transfer must use an applicable legal basis and appropriate safeguards. Relevant teams document the recipient, destination, purpose, data, risks, and safeguards. Publicly published information and public blockchain data can be accessed globally and require clear notice before publication.

12. Research, statistics, and open data

GEF supports responsible research and open learning. Openness does not mean publishing personal data by default.

Research and public-data work must:

  • define the question, public value, lawful ground, and minimum data required;
  • use aggregation, de-identification, pseudonymization, sampling, or controlled access where appropriate;
  • assess re-identification and group-harm risks, including combinations with public data;
  • avoid presenting de-identified data as anonymous when re-identification remains reasonably possible;
  • document consent, ethics review, community agreement, or another lawful authority where required;
  • set access, reuse, attribution, retention, correction, and withdrawal rules appropriate to the project; and
  • review tables, maps, narratives, images, and small groups for unintended disclosure before publication.

Researchers and recipients must not attempt to re-identify people or use data to harm, discriminate against, exploit, or target a person or community. GEF may restrict, correct, withdraw, or decline a release where risk is not adequately controlled.

13. Accuracy, correction, and provenance

Teams take reasonable steps to keep personal data accurate for the purpose for which it is used. People must have a practical way to report material errors.

Corrections should preserve necessary provenance, audit, or dispute records without continuing to present incorrect information as current. Where a public blockchain or independently controlled copy cannot be changed, GEF will correct the off-chain record it controls and explain the technical limitation where appropriate.

14. Retention and disposal

Each system or activity must have a retention rule based on purpose, legal obligations, contracts, risk, limitation periods, audit, research integrity, and the rights of affected people. A fixed period is not applied to every category merely because a partner or another project uses it.

At the end of retention, GEF securely deletes, destroys, aggregates, de-identifies, or restricts the data. Backup deletion can follow a documented replacement cycle. A legal hold, safeguarding matter, complaint, investigation, or public-interest archive can require limited preservation with restricted access.

GEF cannot delete public blockchain records or copies controlled by independent third parties.

15. Individual rights and complaints

GEF provides a practical process for people to exercise rights available under applicable law, including information, access, correction, objection, restriction, withdrawal of consent, deletion, and portability where applicable.

Requests should be sent to [email protected]. GEF may verify the requester's identity and authority and will respond within the period required by applicable law. If a request cannot be fulfilled completely, GEF explains the reason where permitted and identifies an available complaint route.

People may complain to the Office of the Data Protection Commissioner or another competent authority.

16. Data incidents

Anyone working for or on behalf of GEF must promptly report a suspected loss, unauthorized access, disclosure, alteration, destruction, or misuse of personal data through the designated incident channel or to responsible management.

GEF will contain and investigate the incident, protect affected people, preserve appropriate evidence, assess risk, document decisions, and notify affected people, partners, insurers, or authorities where required. Incident information must be shared only with people who need it for response, accountability, or legal compliance.

17. Training, assurance, and enforcement

Personnel receive privacy and security information appropriate to their role. Higher-risk roles receive additional training. GEF periodically reviews systems, access, notices, providers, retention, incidents, and compliance with this Policy.

Failure to follow this Policy can result in restricted access, corrective action, contractual remedies, disciplinary action, termination of an arrangement, reporting to an authority, or other proportionate action.

No person should suffer retaliation for raising a good-faith privacy or security concern.

18. Review and contact

GEF reviews this Policy at least annually and when material legal, operational, or technical changes occur. Updated versions state their publication and effective dates.

Privacy questions, rights requests, or concerns can be sent to:

Grassroots Economics Foundation
P.O. Box 1659-80108
Kilifi, Kenya
[email protected]