Data use and deletion

The Women Human Rights Defenders Hub (“the Hub”, “we”, “us”) is the data controller for personal data processed through this website, the WHRD Hub member platform, and the reporting service. That means we determine why personal data is processed and how, and we carry the legal responsibility for it.

We process personal data in accordance with the Data Protection Act, 2019 of Kenya and the Data Protection (General) Regulations, 2021, and we are subject to the oversight of the Office of the Data Protection Commissioner (ODPC). Registration as a data controller with the ODPC is a legal requirement for organisations of our kind, and we maintain that registration.

• Data controller: The Women Human Rights Defenders Hub
• Postal address: P.O. Box 7403 – 00100, Nairobi, Kenya
• Data protection contact: data@whrdhub.org

If you operate this site: replace the address and contact above with your registered details, and add your ODPC registration number here once issued. Do not publish a registration number you have not been granted.

We collect as little as the service can work with. What we hold depends entirely on how you use the platform.

• If you only read the site: nothing that identifies you. Support you give to a post while signed out is stored in your own browser, not on our servers.
• If you hold an account: your name or chosen username, email address, and anything you choose to add — a photograph, a title, a county network, an organisation.
• If you post or publish: the content you write and the media you attach.
• If you file a report: what you tell us about the incident, and only that. You may report without giving your name at all. We do not record the IP address of a report.
• Technical data needed to keep the service up and secure, such as error logs. These are kept briefly and are not used to profile anyone.

A report about violence or abuse is sensitive personal data under the Data Protection Act. We treat it accordingly:

• It is encrypted in transit and at rest.
• It is readable only by the small response team that handles cases, and by you. Other members of the platform can never see it.
• Support services see what they need to help and no more. Your identity is not shared with a service without a referral you are part of.
• We do not sell personal data, we do not use it for advertising, and we do not share it with advertisers or data brokers. Ever.

Under section 30 of the Act, we rely on:

• Your consent — for your account, your profile, and anything you publish. You can withdraw it at any time by deleting your account.
• Vital interests — where acting on a report is necessary to protect someone’s life or safety.
• Legitimate interests — keeping the platform secure and preventing abuse of it, balanced against your rights.

The Data Protection Act gives you the right to:

• be told how your personal data is being used;
• access the personal data we hold about you;
• object to the processing of all or part of it;
• have inaccurate or misleading data corrected;
• have your personal data deleted — see account and data deletion below.

To exercise any of these, email data@whrdhub.org. We respond within seven days and complete the request within thirty days. There is no charge.

You can delete your account and the personal data attached to it at any time. You do not need to give a reason and you do not need our permission.

Deleting it yourself, in the app

1. Sign in at whrdhub.org/login.
2. Open Account from the menu on the left, or go directly to whrdhub.org/dashboard/account.
3. Scroll to Delete your account and choose Delete my account.
4. Type DELETE to confirm. This step exists so it cannot happen by accident.
5. Your account is removed and you are signed out immediately.

Asking us to delete it for you

If you cannot sign in — you have lost the password, or you reported anonymously and no longer have the details — email data@whrdhub.org with the subject line Delete my data. Tell us the email address or username on the account. We may ask one question to confirm the account is yours, so that nobody can delete someone else’s.

We acknowledge within seven days and complete deletion within thirty days.

What deletion removes

• Your profile: name, username, email address, photograph, biography, title.
• Your posts, your published stories and your comments.
• Your femtorship answers and any femtorship connections.
• Your membership of any county network or organisation.
• Reports you filed through your account.

What may remain, and for how long

• Content other people wrote stays. If someone replied to you, their words are theirs.
• Anonymous, aggregate statistics — such as the number of reports from a county in a year — remain. These cannot be traced back to any individual and are not personal data.
• Records we are required by law to keep are retained only for as long as that legal obligation lasts, and for nothing else. Where a case has been referred to a support service or an authority, that organisation holds its own records under its own policy.
• Backups roll forward on a fixed cycle and are fully overwritten within thirty days.

• Account data: for as long as the account is open, and then removed on deletion as set out above.
• Reports: for as long as the case is open, and afterwards only as long as any legal obligation requires.
• Technical logs: a short rolling window, typically thirty days.

• Encrypted in transit (TLS) and at rest.
• Access limited to the people whose role requires it, enforced in the database itself rather than only in the interface.
• Every action on a report is written to an audit trail.
• If a breach ever put your rights at risk, we notify the ODPC within seventy-two hours of becoming aware of it, and we tell you as soon as reasonably practicable.

We use a small number of processors to run the service, each bound by contract to process data only on our instructions: our hosting and database provider, our email provider, and our SMS provider for the USSD reporting service. Some process data outside Kenya; where they do, transfers are made under appropriate safeguards as required by the Act.

We share a report with a support service only through a referral, and only what that service needs in order to help. We do not sell personal data and we never share it for advertising.

If you are unhappy with how we have handled your personal data, tell us first at data@whrdhub.org and we will try to put it right.

You also have the right to complain directly to the Office of the Data Protection Commissioner, and you do not have to come to us first:

• Email: complaint@odpc.go.ke
• Telephone: 020 780 1800
• Address: Britam Towers, 12th Floor, Hospital Road, Upper Hill, Nairobi. P.O. Box 30920 – 00100, Nairobi
• Online: odpc.go.ke

If we change how we handle personal data in a way that affects you, we will update this page and, where the change is significant, tell account holders directly. See also our privacy policy and terms of use.