Privacy Policy

The Collective Solidarity of Women Alliance (COSWA) is a feminist, community-led network registered in Kenya, working to protect and expand the rights, well-being, and resilience of vulnerable women and girls across Kenya's Coast region. Our registered secretariat is located in Mombasa, Coast Region, Kenya. For all privacy enquiries, contact: privacy@coswa.or.ke

We collect personal data only when you voluntarily provide it. The categories of data we may collect include:

Donors & supporters: Name, email address, phone number, postal address, payment information (processed securely by our payment gateway — COSWA does not store card or M-Pesa details on our servers), donation history, and communication preferences.

Newsletter subscribers: Name and email address.

Volunteers & interns: Name, email, phone, professional background, county, and area of interest.

Contact form enquiries: Name, email, organisation, subject, and message content.

GBV service users & case management: Sensitive personal data including names, contact details, case details, and health information, collected in accordance with strict confidentiality protocols and informed consent. This data is stored offline in secure, access-restricted systems and is never shared without explicit consent except where required by law to protect life.

COSWA processes personal data for the following purposes:

• Processing and acknowledging donations, and sending tax receipts where applicable
• Sending newsletters, impact reports, and campaign updates — only with your explicit consent
• Responding to enquiries, volunteer applications, and partnership requests
• Recruiting, onboarding, and managing volunteers and interns
• Providing or coordinating GBV support services and referrals
• Conducting monitoring, evaluation, and learning activities
• Improving our website, programs, and communications
• Complying with legal and regulatory obligations

We will never sell, rent, trade, or otherwise share your personal data with third parties for commercial purposes.

COSWA processes personal data on the following legal bases under the Kenya Data Protection Act (2019):

Consent: For newsletters, marketing, and non-essential communications — you may withdraw consent at any time.

Contract: For processing donations, volunteer placements, and service agreements.

Legitimate interests: For improving our services, preventing fraud, and maintaining organisational security.

Legal obligation: Where required by Kenyan law or court order.

Vital interests: In emergency situations involving risk to life — including GBV crisis response.

COSWA implements appropriate technical and organisational safeguards to protect personal data from unauthorised access, loss, or disclosure. Key measures include:

• Encrypted storage and transmission of website data
• Access controls limiting data to authorised staff on a need-to-know basis
• Offline, password-protected storage for GBV case files
• Regular staff training on data protection and digital security
• Secure deletion of data when no longer required

We retain personal data only as long as necessary for the purpose it was collected, or as required by law. Donor records are retained for 7 years for financial audit purposes. GBV case records are retained in accordance with our Case Management Policy.

Under the Kenya Data Protection Act (2019), you have the following rights regarding your personal data:

Right of access: Request a copy of personal data we hold about you.

Right to rectification: Request correction of inaccurate or incomplete data.

Right to erasure: Request deletion of your personal data, subject to legal obligations.

Right to object: Object to processing based on legitimate interests or for direct marketing.

Right to withdraw consent: Withdraw consent for newsletter or marketing communications at any time — via the unsubscribe link in any email or by contacting us directly.

To exercise any of these rights, contact: privacy@coswa.or.ke. We will respond within 30 days.

Our website uses only essential session cookies necessary for core website functionality (such as form security tokens). We do not use tracking, advertising, or analytics cookies. You can disable cookies in your browser settings — note that this may affect some website functionality.

COSWA applies the highest standards of confidentiality to all data involving survivors of gender-based violence or any individual who discloses abuse. We follow the principles of informed consent, do-no-harm, and survivor-centred care in all case management activities. Survivor data is never disclosed to third parties — including law enforcement — without explicit informed consent from the survivor, except in situations involving imminent risk to life. Our staff and volunteers receive mandatory training in data protection as part of GBV case management induction.

COSWA's website may link to external sites. We are not responsible for the privacy practices of third-party websites. Our payment processing is handled by trusted, PCI-DSS compliant payment providers. We do not store card numbers or full M-Pesa transaction details on our servers.

COSWA may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or operational needs. We will notify registered users of significant changes by email and post the updated policy on this page with a revised date.

For any privacy-related enquiries, data subject rights requests, or concerns, contact our Data Protection Officer at:

Email: privacy@coswa.or.ke
Phone: +254 700 000 000
Post: COSWA Secretariat, Mombasa, Coast Region, Kenya

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya at www.odpc.go.ke.