Privacy Policy
Privacy Policy
Scientists of Kenya Association (SCOKA) · Effective date: 19 August 2026 · Last updated: 19 August 2026
SCOKA is registered with the Office of the Data Protection Commissioner (ODPC) as a Data Controller under the Kenya Data Protection Act, 2019. Registration ID: 676-8639-BBDF · Serial No.: 25470 · Certificate valid: 19 August 2026 – 19 August 2028.
1. Who We Are
The Scientists of Kenya Association (SCOKA) is a duly registered association under the Societies Act, Cap 108 Laws of Kenya. We are a professional scientific association that brings together scientists, researchers, students, innovators and professionals from diverse scientific disciplines to advance science, research, technology and innovation in Kenya.
- Data Controller:
- Scientists of Kenya Association (SCOKA)
- Website:
- scoka.co.ke
- Email:
- info@scoka.co.ke
- ODPC Registration ID:
- 676-8639-BBDF
This Privacy Policy explains how we collect, use, store, share and protect your personal data, and sets out your rights as a data subject under the Kenya Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021.
2. What Personal Data We Collect and Why
We only collect personal data that is necessary for a specific, legitimate purpose. The table below summarises the categories of data we collect, the purpose, and the lawful basis under Section 30 of the Data Protection Act.
| Data collected | Collection point | Purpose | Lawful basis |
|---|---|---|---|
| Full name, gender, date of birth, nationality | Membership application | Creating and managing your SCOKA member account | Contract / consent |
| Email address, phone number | Membership application, contact form, newsletter sign-up, event registration | Communications, membership correspondence, event logistics | Contract / consent |
| National ID number | Membership application | Identity verification as required for official registration | Legitimate interests / legal obligation |
| Educational qualification, scientific speciality, department, employer | Membership application | Determining membership category; connecting members with relevant programmes | Contract / consent |
| Passport photograph, certificate scans, ID document scans | Membership application (file uploads) | Identity verification; issuing membership credentials | Contract / consent |
| M-Pesa transaction reference, payment amount | Membership application, membership renewal | Verifying payment and issuing membership | Contract / legal obligation |
| MyScoka password (hashed) | Membership application | Securing your member portal account | Contract |
| Name, email address, message | Contact form | Responding to your enquiry | Legitimate interests / consent |
| Email address | Newsletter subscription | Sending SCOKA news, events and updates you subscribed to | Consent |
| Name, email address, event-specific details | Event registration | Processing event participation; logistics and communications | Contract / consent |
| IP address, browser type, pages visited, session data | Automatically — website cookies & analytics | Understanding how visitors use the site; improving content and performance | Legitimate interests (GA4, production only) |
We do not collect special categories of personal data (health, biometric, racial/ethnic origin, political opinion, religious belief, etc.) unless expressly required and with your explicit consent.
For the SCOKA Science Run, optional medical notes are collected only for authorised safety staff, with your acknowledgement, and are not printed on the ticket.
3. Cookies and Analytics
Our website uses Google Analytics 4 (GA4) on the live site (scoka.co.ke) to collect anonymised usage data — page views, session duration, device type and approximate location (country/city level). GA4 uses first-party cookies. No analytics tracking runs on local/development environments.
We also use a session cookie to keep you logged in to the MyScoka member portal. This cookie is strictly necessary and does not track behaviour across other websites.
You may disable cookies through your browser settings. Disabling analytics cookies will not affect your ability to use the website. Disabling the session cookie will prevent you from staying logged in to the member portal.
4. How We Use Your Personal Data
We use your personal data only for the purposes for which it was collected. Specifically:
- To process and manage your SCOKA membership application and renewal
- To create and secure your MyScoka member portal account
- To communicate with you about membership, events, programmes and SCOKA activities
- To send the SCOKA newsletter and updates (only to subscribers who have opted in)
- To process event registrations and facilitate participation
- To respond to enquiries submitted through our contact form
- To verify payments and issue membership credentials
- To analyse website usage and improve our services (via anonymised analytics)
- To comply with our legal obligations as a registered association and data controller
We will not use your data for automated decision-making or profiling that produces significant legal effects on you without your explicit consent.
5. Lawful Basis for Processing
Under Section 30 of the Data Protection Act, 2019, we rely on the following lawful bases:
- Consent — where you have freely, specifically and informedly agreed (e.g. newsletter subscription, analytics). You may withdraw consent at any time.
- Contract — where processing is necessary to deliver the membership services or event registration you have requested.
- Legitimate interests — where we have a genuine need to process data (e.g. responding to contact form enquiries, basic site analytics) and that need is not overridden by your rights.
- Legal obligation — where processing is required by Kenyan law (e.g. record-keeping for a registered society).
6. Who We Share Your Data With
We do not sell, rent or trade your personal data. We share data only where necessary:
| Recipient | Purpose | Safeguards |
|---|---|---|
| Brevo (Sendinblue) | Sending transactional and newsletter emails on our behalf | Data Processing Agreement in place; GDPR-compliant |
| Google LLC (GA4) | Anonymised website analytics | Google Ads Data Processing Terms; data minimisation enabled |
| Safaricom (M-Pesa) | Payment processing (STK push & paybill verification) | Licensed payment provider under CBK; regulated by Kenyan law |
| Web hosting provider | Server infrastructure on which the site and database run | Access-controlled servers; data stored within compliant infrastructure |
All third-party processors are required to handle your data only on our documented instructions and to maintain appropriate security measures. Where data is processed outside Kenya, we ensure adequate safeguards are in place as required by Section 48 of the Data Protection Act.
7. How Long We Keep Your Data
| Data type | Retention period | Reason |
|---|---|---|
| Member account data (name, email, ID, qualifications) | For the duration of membership + 3 years after lapse | Membership records for a registered society; legal obligation |
| Payment records (transaction references) | 7 years | Financial record-keeping in line with Kenyan tax and accounting law |
| Uploaded documents (ID scans, certificates, photos) | Duration of membership + 1 year | Membership verification; deleted upon confirmed account closure |
| Newsletter subscribers | Until you unsubscribe | Consent-based; list cleaned periodically |
| Contact form submissions | 12 months | For reference; deleted in routine data purges |
| Event registration data | 2 years after the event | Programme records; reporting |
| Website analytics (GA4) | 14 months (GA4 default) | Performance monitoring |
When data is no longer required, it is securely deleted or anonymised.
8. How We Protect Your Data
We take data security seriously and implement appropriate technical and organisational measures, including:
- HTTPS encryption — all data in transit between your browser and our server is encrypted via TLS
- Password hashing — member passwords are hashed using strong cryptographic algorithms; we never store plain-text passwords
- Access controls — the member portal and administrative areas are access-restricted; the dashboard is blocked from search-engine indexing
- Rate limiting — login attempts and password-reset requests are rate-limited to reduce the risk of brute-force attacks
- Input validation and sanitisation — all user inputs are validated and sanitised before processing or storage
- CSRF protection — forms are protected with CSRF tokens
- File upload restrictions — uploaded documents are validated, stored outside the public web root where appropriate, and access-controlled
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware, and will notify affected individuals without undue delay, as required by Section 43 of the Data Protection Act.
9. Your Rights as a Data Subject
Under the Data Protection Act, 2019 (Sections 26–35), you have the following rights:
- Right to be informedTo know what data we collect and how it is used — this Privacy Policy fulfils that obligation.
- Right of accessTo request a copy of the personal data we hold about you.
- Right to rectificationTo have inaccurate or incomplete data corrected.
- Right to erasureTo request deletion of your data where we no longer have a lawful basis to hold it.
- Right to objectTo object to processing based on legitimate interests, or to unsubscribe from marketing at any time.
- Right to withdraw consentWhere processing is based on consent, you may withdraw it at any time without affecting prior processing.
- Right to data portabilityTo receive your data in a structured, commonly used format where technically feasible.
- Right not to be subject to automated decisionsWe do not use automated decision-making with significant legal effects on individuals.
To exercise any of these rights, contact us at info@scoka.co.ke with your full name and the nature of your request. We will respond within a reasonable time and, where required by law, free of charge.
If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC):
Website: odpc.go.ke
Email: info@odpc.go.ke
10. Newsletter and Marketing Communications
We send newsletters and updates only to people who have explicitly subscribed. Science Run registration does not opt you in; marketing consent is a separate, optional checkbox. Each newsletter includes a clearly visible unsubscribe link. You may also unsubscribe at any time by emailing sciencerun@scoka.co.ke or info@scoka.co.ke.
Unsubscribing from the newsletter does not affect other communications related to your membership or event registrations.
11. Children's Data
SCOKA membership and services are intended for individuals aged 16 and above. We do not knowingly collect personal data from children under 16 without verifiable parental consent. If you believe a child's data has been submitted to us without appropriate consent, please contact us immediately at info@scoka.co.ke and we will delete it promptly.
12. Links to Third-Party Websites
Our website may contain links to external websites, partner organisations, events and social media platforms. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before providing any personal data to them.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services or legal obligations. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically.
Continued use of our website or services after changes are posted constitutes acceptance of the updated policy.
14. Contact Us
For any privacy-related questions, requests, or concerns, please reach out to us:
Scientists of Kenya Association (SCOKA)
Email: sciencerun@scoka.co.ke (Science Run) · info@scoka.co.ke
Phone: +254 711 846349
Website: scoka.co.ke