SMART NGCDF

Applicable to all NG-CDF Board publications, websites, digital platforms and applications

1. Introduction

The National Government Constituencies Development Fund Board (“the Board”, “NG-CDF Board”, “we”, “us” or “our”) is a State Corporation established under the National Government Constituencies Development Fund Act, 2015, responsible for the management, administration and oversight of the National Government Constituencies Development Fund across all 290 constituencies in Kenya.

Your privacy matters to us. This Data Privacy Statement (“this Statement”) explains what personal data the Board collects, how and why we collect, use, store, share and protect it, and the rights available to you under the Data Protection Act, 2019 (the “Act”) and its subsidiary regulations.

This Statement applies across all channels through which the Board interacts with the public and its stakeholders, including this document's publication in print and online, the Board's corporate website, the Smart NG-CDF platform (smart.ngcdf.go.ke) and any other digital application, portal or system operated by or on behalf of the Board (collectively, “our Platforms”).

Where this Statement is read together with any specific terms of use, application guidelines or service charter issued by the Board, and a conflict arises regarding the handling of personal data, this Statement shall prevail on matters of data protection.

2. Scope and Application

This Statement applies to the personal data of, among others:

Constituents and members of the general public who apply for or benefit from NG-CDF funded initiatives, including bursary, Social Health Insurance Fund (SHIF) support, climate change and other Monitoring, Evaluation and Learning (M&E) programmes;
Parents and guardians of minor beneficiaries under the NGCDF bursary and related education support programmes;
Members of Project Management Committees (PMCs), NG-CDF Committees (NG-CDFCs), and other constituency-level structures;
Members of the National Assembly and their offices, in their oversight and advisory role over constituency projects;
Employees, interns and job applicants of the Board;
Suppliers, contractors, consultants, dealers and other third parties and stakeholders engaged by the Board;
Visitors to any Board or constituency committee office premises; and
Users of the Board's websites, the Smart NG-CDF platform and other digital applications.

This Statement does not apply to the practices of third-party websites, platforms or service providers that the Board does not own or control, even where our Platforms link to them. We encourage you to review the privacy notices of any third-party service before providing your personal data to it.

3. Definitions

Personal Data: Any information relating to an identified or identifiable natural person, as defined under the Data Protection Act, 2019.
Data Subject: An identifiable natural person whose personal data the Board processes, referred to in this Statement as “you”.
Processing: Any operation performed on personal data, including collection, recording, storage, use, disclosure, alteration, retrieval, or destruction.
Data Controller: The Board, which determines the purpose and means of processing personal data described in this Statement.
Data Processor: A person or entity that processes personal data on behalf of the Board, such as a technology or hosting service provider.
Sensitive Personal Data: Data revealing an individual's health status, ethnic or social origin, biometric data, genetic data, property details, marital status, family details, and similar categories defined under the Act.
Smart NG-CDF / our Platforms: The Smart NG-CDF digital platform (smart.ngcdf.go.ke), the Board's corporate website, and any other Board-operated application, portal or system.
Data Protection Officer: A designated NG-CDF Board staff responsible for overseeing the implantation and enforcement of data protection measures, ensuring compliance with the Act, advising the organization and its employees on data processing requirements, and acting as a primary point of contact with Office of the Data Protection Commissioner regarding data privacy matters.

4. Personal Data We Collect

The categories of personal data we collect depend on your relationship with the Board and the service or platform you are using. These include, but are not limited to:

4.1 Identity and contact information

Full name, national identity card or passport number, birth certificate number (for minors), date of birth, gender, and passport-size photograph;
Physical and postal address, telephone number, email address, and constituency or ward of residence;
Next of kin and emergency contact details.

4.2 Application and beneficiary information

Bursary, SHIF, climate change and other M&E application details, including institution name, admission or index number, academic level, fee balance and household or guardian information;
Vetting, appraisal, approval, and disbursement records associated with a project, proposal or application;
Bank account, mobile money (including M-PESA) and other payment details, used solely to facilitate disbursement of approved funds.

4.3 Governance, committee and employment information

Identification, appointment, qualification and role information for PMC and NG-CDFC members, Field Operations Officers/Fund Account Manager and other constituency committee office holders;
Employment records for Board staff, including recruitment, appraisal, leave, discipline, training, health information land payroll-related data administered under the Board's human resource systems;
Tax and statutory identifiers, such as Kenya Revenue Authority (KRA) Personal Identification Number (PIN).

4.4 Procurement and third-party information

Business registration, tax compliance, banking, and contact details of suppliers, contractors, consultants, dealers and agents engaged by the Board;
Records relating to tender submissions, evaluation, contract performance and payment.

4.5 System and platform usage information

User accounts, role assignments and login records on the Smart NG-CDF platform and related applications, including single sign-on identifiers where such integration is enabled;
Device, browser, Internet Protocol (IP) address, and log data collected automatically when you use our Platforms;
Cookies and similar tracking technologies, as described in Section 12.

4.6 Premises, safety and security information

Visitors register details at Board and constituency committee offices, including name, organization, national identity number, telephone number and vehicle registration;
Closed Circuit Television (CCTV) footage captured at Board premises for security purposes;
Incident and accident reports, including relevant medical information, where these occur on Board premises or during Board-sanctioned activities.

We do not knowingly collect sensitive personal data such as health information, save where it is volunteered in the course of an application (for example, a disability declaration made to support affirmative allocation) or is necessary to respond to an incident on our premises.

5. How We Collect Your Personal Data

We collect personal data directly from you when you, among other actions:

apply for or enquire about a fund, bursary, project or other NG-CDF supported initiative;
register for or use the Smart NG-CDF platform or any other Board application;
apply for employment, or are appointed or nominated to a Board, PMC or NG-CDFC role;
respond to a tender, request for proposal, or supplier registration exercise;
visit a Board or constituency office, or contact the Board by telephone, email, letter or social media;
participate in a survey, public forum, or stakeholder engagement conducted by or on behalf of the Board.

We may also receive personal data from other sources, including learning institutions (for bursary and SHIF verification), national government agencies and databases used for identity or eligibility verification, referees, other government agencies (in the course of official duty), and, in limited circumstances, from publicly available records.

6. Legal Basis for Processing

We process your personal data on one or more of the lawful bases recognised under Section 30 of the Data Protection Act, 2019, namely:

Performance of a public function, task or exercise of official authority vested in the Board under the NG-CDF Act, 2015, the Public Finance Management Act, 2012, and related written law;
Compliance with a legal obligation to which the Board is subject, including procurement, tax, audit, and records management law;
Performance of a contract to which you are a party, or steps taken at your request prior to entering into a contract, for example with suppliers and employees;
Your consent, given freely and for a specific purpose, which you may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal;
The Board's legitimate interests, such as safeguarding our premises, systems and information assets, provided this does not override your fundamental rights and freedoms; and
Protection of your vital interests or those of another person, for example in an emergency or incident on Board premises.
For the purpose of historical, statistical, journalistic, literature and art or scientific research.

7. Purposes for Which We Process Your Personal Data

We use your personal data for purposes that include:

assessing eligibility for, and processing applications relating to, bursary, SHIF, climate change and other M&E initiatives;
processing project allocations, proposals, approvals, codelist generation, Authority to Incur Expenditure, voting, disbursement and payment;
administering user access, roles and permissions on the Smart NG-CDF platform and other Board applications;
managing recruitment, employment, performance, discipline, training and payroll of Board staff;
managing procurement, contracting and payment of suppliers, contractors and consultants;
monitoring, evaluation, audit, reporting and accountability to the National Assembly, the Office of the Auditor-General, the Controller of Budget, the National Treasury and other oversight bodies;
maintaining the safety and security of Board and constituency premises, including through CCTV and visitor registers;
responding to enquiries, complaints and requests for information;
improving our Platforms, services and internal business processes; and
complying with any applicable law, regulation, court order or lawful request by a government agency.

8. Sharing and Disclosure of Personal Data

The Board treats your personal data as confidential and does not sell it. We may, however, share personal data, on a need-to-know basis and subject to appropriate safeguards, with:

national government agencies and oversight bodies, including the National Treasury, the Office of the Auditor-General, the Controller of Budget, the Ethics and Anti-Corruption Commission, Director of Criminal Investigations, Directorate of Public Prosecution and the Kenya Revenue Authority;
law enforcement, investigative or judicial authorities, where required by law or a lawful order;
learning institutions and relevant government verification systems, for the purpose of validating bursary, SHIF and related applications;
financial institutions and licensed mobile money operators, solely to facilitate the disbursement of approved funds;
service providers who process personal data on our behalf under contract, such as hosting, identity and system integration providers supporting the Smart NG-CDF platform, subject to written data processing terms consistent with the Act;
the Office of the Data Protection Commissioner and other regulatory or statutory bodies, where required; and
any other party where you have given consent, or where disclosure is necessary to protect the vital interests of you or another person.

We do not disclose personal data to any party acting beyond its lawful mandate, and we assess each request for information before releasing any personal data.

9. Data Retention

We will retain personal data only for as long as is reasonably necessary to fulfil the purpose for which it was collected, including to satisfy any applicable legal, regulatory, audit, tax or records management requirement, such as those under the Public Finance Management Act, 2012 and the Public Archives and Documentation Service Act.

Where personal data is no longer required, it is securely disposed of or anonymized in accordance with the Board's records management procedures. We may retain personal data for a longer period where necessary to establish, exercise or defend a legal claim, or where an unresolved complaint or investigation relates to that data.

10. Data Security

The Board has implemented appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure or destruction. These measures include access controls and role-based permissions on the Smart NG-CDF platform, information classification, network and system security controls, staff confidentiality obligations, and physical security at Board premises.

While we take reasonable steps to protect your personal data, no system of transmission or storage can be guaranteed to be completely secure. We continuously review and strengthen our security controls as part of the Smart NG-CDF Programme's ongoing development.

11. Cross-Border Transfer of Personal Data

Personal data is generally processed and stored within Kenya. Where the Board engages a service provider whose infrastructure is located outside Kenya, for example a cloud hosting or identity management provider, we will only transfer personal data on that basis where appropriate safeguards required under the Data Protection Act, 2019 are in place, such as contractual clauses, an adequacy decision, or your consent, as applicable.

12. Cookies and Website Usage Data

Our websites and the Smart NG-CDF platform may use cookies and similar technologies to recognise you on subsequent visits, maintain your session, and understand how our Platforms are used so that we can improve them. This may include non-personal information such as your Internet Protocol (IP) address, browser type, and pages visited.

You may configure your browser to notify you before accepting cookies or to refuse them altogether. Doing so may affect the functionality of some features on our Platforms.

13. Children’s and Minors' Data

Certain NG-CDF programmes, particularly bursary, SHIF and related education support, necessarily involve the personal data of learners who are minors. Such data is collected and processed through the learner's parent, guardian or learning institution, and is used solely for the purpose of assessing and administering the relevant support.

We do not knowingly collect personal data directly from a minor for any purpose outside an approved NG-CDF programme. Where a minor's data is collected outside such a programme, this is only done with the consent of a parent or legal guardian.

14. Your Rights as a Data Subject

Subject to the exceptions provided under the Data Protection Act, 2019, you have the following rights in relation to your personal data:

Right to be informed: To know that the Board is collecting and processing your personal data, and for what purpose.
Right of access: To request confirmation of, and access to, the personal data the Board holds about you.
Right to correction: To request that we correct personal data that is inaccurate, out of date, incomplete or misleading.
Right to erasure: To request deletion of personal data that is no longer necessary, unlawfully processed, or where you have withdrawn consent, subject to our legal retention obligations.
Right to object: To object to, and request that we restrict, the processing of your personal data in certain circumstances, and withdraw consent to processing of personal data
Right to data portability: To request your personal data in a structured, commonly used and machine-readable format, where technically feasible.
Right regarding automated decisions: Not to be subject to a decision based solely on automated processing that significantly affects you, without an opportunity for human review.
Right to lodge a complaint: To lodge a complaint with the relevant supervisory authority that is tasked with data protection within the Republic of Kenya.

15. How to Exercise Your Rights

You may exercise any of the rights described above, or raise any query regarding this Statement, by writing to the Board's Data Protection Officer using the contact details in Section 18. To protect your personal data from unauthorized access, we may ask you to verify your identity before actioning your request.

We aim to respond to all legitimate requests within the timelines prescribed under the Data Protection Act, 2019. Where a request is complex or requires additional time, we will notify you and keep you informed of progress.

16. Complaints

If you are dissatisfied with how the Board has handled your personal data, you may lodge a complaint with our Data Protection Officer in the first instance. You also have the right to lodge a complaint directly with the Office of the Data Protection Commissioner (ODPC), Kenya, the independent authority responsible for enforcing the Data Protection Act, 2019.

17. Amendments to this Statement

The Board reserves the right to amend or update this Statement from time to time to reflect changes in law, our operations, or the Smart NG-CDF platform. Any material change will be published on our Platforms with an updated version date, and, where appropriate, communicated directly to affected data subjects. Unless otherwise stated, the current version shall supersede and replace all previous versions of the privacy statements.

18. Contact Us

For any question about this Statement, or to exercise your rights under the Data Protection Act, 2019, please contact:

Data Protection Officer: NG-CDF Board
Email: dpo@ngcdf.go.ke
Postal Address: National Government Constituencies Development Fund Board, P.O. Box 46682-00100, Nairobi, Kenya
Website: https://www.ngcdf.go.ke
Supervisory Authority: Office of the Data Protection Commissioner (ODPC), Kenya: https://www.odpc.go.ke