Privacy Policy

Lapid Leaders Africa Website: https://www.lapidleaders.africa/ Effective date: 12 October 2026 Last updated: 12 October 2026

1. Introduction

Lapid Leaders Africa (“Lapid Leaders”, “we”, “us” or “our”) is committed to protecting the privacy of the young leaders, parents and guardians, mentors, partners, donors, volunteers and visitors who engage with us. This Privacy Policy explains how we collect, use, share, store and protect personal data when you visit https://www.lapidleaders.africa/, apply to or take part in our programmes, attend our events, subscribe to our updates, donate, or otherwise communicate with us (together, the “Services”).

We process personal data in line with the Constitution of Kenya, the Data Protection Act, 2019 (the “DPA”) and its regulations, and other applicable laws. By using the Services you acknowledge that you have read this Policy. If you do not agree with it, please do not use the Services or submit personal data to us.

If you sign in with Google or connect a Google account to any Lapid Leaders Africa service, Section 16 explains exactly which Google user data we access, how we use it, and the limits we follow.

2. Who We Are and How to Contact Us

For the purposes of the DPA, Lapid Leaders Africa is the data controller of the personal data described in this Policy.

• Address: Waiyaki Way, Nairobi, Kenya
• Telephone: +254 706 829 247
• General enquiries: info@lapidleadersafrica.com
• Data protection enquiries: operations@lapidleaders.africa
• Registration: We maintain our registration with the Office of the Data Protection Commissioner of Kenya as required by the Data Protection Act, 2019

3. Personal Data We Collect

We collect only the data we need for the purposes set out in this Policy. Depending on how you interact with us, this may include:

Data you give us directly

• Identity and contact details: name, email address, telephone number, county or country of residence, and social media handles;
• Programme application and enrolment data: age or date of birth, gender, education level, university or institution, employment or business details, leadership experience, motivation statements, references and any supporting documents you upload;
• Participation data: attendance records, progress and feedback, assessments, mentoring and coaching notes, alumni updates, impact and outcome information (for example employment, entrepreneurship or revenue changes) that you choose to share with us;
• Event data: registration details, dietary or accessibility requirements, emergency contacts, and photographs or video recordings taken at events;
• Communications: messages you send through contact forms, email, phone or social media, and your newsletter preferences;
• Stories and testimonials: content you choose to share for publication, including images, quotes and videos;
• Donation data: the fact and amount of a donation and your name and contact details. Payment card or account details are handled by our payment provider and are not stored by us.

Data we collect automatically

• Device and usage data: IP address, browser type and version, operating system, device identifiers, pages visited, time spent, referring and exit pages, and approximate location derived from your IP address;
• Cookies and similar technologies: see Section 9.

Data from other sources

• Partners and institutions: such as universities, mentors, employers or sponsors who refer or nominate you for a programme or award;
• Public sources and social media: information you make publicly available, for example on LinkedIn, Instagram, Facebook or YouTube, when you tag or engage with us.

Sensitive personal data

We do not ask for sensitive personal data (such as health information, religious or ethnic origin, or biometric data) unless it is necessary, for example to accommodate a disability or dietary need at an event, or where a programme specifically requires it. Where we do, we will ask for your explicit consent and handle it with extra care.

4. Children and Young People

Our work focuses on young people, some of whom may be under 18. We therefore take extra care:

• We process the personal data of a child only with the consent of a parent or legal guardian, or where otherwise permitted by the DPA and in the child’s best interests;
• We collect only the data necessary for the child’s participation and safety;
• We do not publish identifiable images, videos or stories of children without verifiable parental or guardian consent;
• Parents and guardians may contact us at any time to review, correct or request deletion of their child’s data.

The website is not directed at children under 13 and we do not knowingly collect their data directly. If you believe a child has given us personal data without proper consent, please contact us so we can delete it.

5. How and Why We Use Personal Data

We use personal data only for specified, explicit and legitimate purposes, and we rely on a lawful basis under the DPA for each:

Purpose	Examples	Lawful basis
Administering programmes	Processing applications, selecting participants, running Crossroads, the Lapid Experience, the Baobab Leadership Network and UbuntuPulse, mentoring, assessments	Performance of a contract or steps before entering one; legitimate interests
Running events and awards	Registration, logistics, safety, Women of Purpose Summit, Top Purpose Driven Leaders Awards	Contract; consent; legitimate interests
Communicating with you	Responding to enquiries, sending programme updates, newsletters and invitations	Consent; legitimate interests
Impact measurement and reporting	Tracking outcomes, producing anonymised or aggregated statistics for funders and partners	Legitimate interests; consent where identifiable
Fundraising and donor care	Acknowledging gifts, reporting to donors	Legitimate interests; consent
Promotion and storytelling	Publishing stories, testimonials, photographs and videos	Consent
Website operation and security	Analytics, troubleshooting, preventing fraud and abuse	Legitimate interests
Legal and regulatory compliance	Meeting reporting, tax, safeguarding and audit obligations	Legal obligation
Protecting vital interests	Responding to emergencies at events or programmes	Vital interests

Where we rely on consent, you may withdraw it at any time (see Section 12). Withdrawal does not affect processing that took place before it.

We do not sell your personal data. We do not use your data for automated decision-making that produces legal or similarly significant effects on you.

6. Sharing Personal Data

We share personal data only where necessary and with appropriate safeguards:

• Programme partners and institutions: such as partner universities, mentors, coaches and facilitators, to the extent needed to deliver a programme. They are required to keep the data confidential and use it only for that purpose;
• Funders, sponsors and partners: generally in aggregated or anonymised form. We will share identifiable information (for example a participant’s story) only with your consent or where you have been told this is a condition of a funded programme;
• Service providers (data processors): who help us run the Services, such as website hosting and maintenance, email and form providers, event platforms, video platforms and payment processors. They act on our instructions under written agreements;
• Third-party platforms: including PayPal for donations, YouTube for embedded video, and social media platforms such as Facebook, Instagram and LinkedIn. These providers have their own privacy policies and may act as independent controllers of the data they collect;
• Professional advisers and auditors: such as lawyers, accountants and auditors, under duties of confidentiality;
• Authorities: where required by law, court order or to protect the rights, safety or property of Lapid Leaders, our participants or others;
• Organisational changes: if we merge with, or transfer programmes to, another organisation, we will ensure your data continues to be protected and will inform you where appropriate.

7. International Transfers

Some of our service providers and platforms (for example hosting, email, video and social media providers) may store or process data outside Kenya, including in Europe or the United States. We transfer personal data outside Kenya only where permitted by the DPA, such as where the destination provides adequate data protection safeguards, we have your consent, or the transfer is necessary for performing a contract or complying with the law. Where required we use contractual protections to keep your data secure.

8. Data Retention

We keep personal data only for as long as needed for the purposes for which it was collected, including legal, accounting and reporting requirements. As a guide:

• Programme applications (unsuccessful): up to 12 months after the selection process;
• Participant and alumni records: for the duration of the programme and the period of alumni engagement, then reviewed periodically;
• Newsletter subscriptions: until you unsubscribe;
• Contact enquiries: up to 24 months after resolution;
• Donation records: for 7 years, or as required by tax and audit rules;
• Event photographs and videos: for as long as they remain useful for documentation, unless you withdraw consent;
• Website analytics data: typically up to 26 months.

When data is no longer needed, we securely delete it or anonymise it so you can no longer be identified.

9. Cookies and Similar Technologies

Our website uses cookies and similar technologies, which are small files stored on your device. We use them to:

• Make the website work: such as remembering preferences and enabling forms and sliders to function (strictly necessary);
• Understand usage: through analytics tools that show how visitors use the site so we can improve it;
• Enable embedded content: such as YouTube videos and social media links, which may set their own cookies.

You can control or delete cookies through your browser settings, and where we use non-essential cookies we will ask for your consent through a cookie notice. Blocking some cookies may affect how the website works. Third parties such as YouTube, Facebook, Instagram and LinkedIn may use their own cookies, and we encourage you to review their policies.

10. Newsletter and Marketing Communications

If you subscribe to our newsletter or give us your consent, we may send you updates about our programmes, events, stories and opportunities. Every message includes an option to unsubscribe, or you can write to us at any time. We will still contact you with essential service messages, for example about an application or event you have registered for.

11. Data Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration and disclosure. These include access controls limited to people who need the data, secure hosting, encryption of data in transit where available, regular software updates, confidentiality obligations for staff, volunteers and partners, and safeguarding training.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and will inform affected individuals without unreasonable delay where required by law.

12. Your Rights

Under the DPA, you have the right to:

• Be informed about how your personal data is used;
• Access the personal data we hold about you;
• Object to the processing of all or part of your personal data, including for direct marketing;
• Correct inaccurate or incomplete data;
• Delete data that is false, misleading, unlawfully processed or no longer needed;
• Data portability: receive your data in a structured, commonly used format and have it transferred to another controller where technically possible;
• Withdraw consent at any time where we rely on consent;
• Not be subject to automated decisions that have legal or similarly significant effects.

To exercise a right, contact us using the details in Section 2. We may need to verify your identity before acting on a request, and we will respond within the timeframes set by law. We do not charge a fee unless a request is clearly unfounded or excessive and the law permits one. If you are unhappy with how we handle your data, you may lodge a complaint with the Office of the Data Protection Commissioner of Kenya (https://www.odpc.go.ke). We would appreciate the chance to address your concerns first.

13. Photography, Video and Storytelling

We may photograph or film events and programmes and publish stories about our community on our website, social media and reports. We will obtain your consent before publishing material that identifies you where required, and for children we will obtain parental or guardian consent. You can withdraw consent at any time by contacting us, and we will stop future use and remove the material from channels we control. We cannot always retrieve content already shared or republished by third parties.

14. Third-Party Links and Services

The website may contain links to external sites and services, including partner organisations, social media platforms, PayPal and YouTube. This Policy does not apply to those sites. We are not responsible for their content or privacy practices, and we recommend reading their policies before sharing personal data.

15. Changes to This Policy

We may update this Policy to reflect changes in our practices, technology or the law. The “Last updated” date at the top shows when it was last revised. For significant changes we will take reasonable steps to notify you, for example through a notice on the website or by email. Your continued use of the Services after an update means you accept the revised Policy.

16. Google User Data and Google API Services

This section applies where you sign in with Google or authorise Lapid Leaders Africa Mailer (the “App”), operated by Lapid Leaders Africa, to access data from your Google Account. It explains what Google user data we access, why, how we handle it, and how you can remove our access.

16.1 Google user data we access

We request only the permissions (OAuth scopes) the App needs to provide features you can see and use.

Google scope	Data accessed	Why we need it
openid, email	Your Google Account email address	To identify the Google account that authorises the connection and to set the sender address on emails we send
profile	Your name and profile picture	To show the sender name on emails sent from our website
gmail.send (https://www.googleapis.com/auth/gmail.send)	Permission to send email on behalf of the authorised account only. No mailbox content is read.	To deliver website emails such as contact form notifications, programme application and event confirmations, replies to enquiries and newsletter confirmations

We do not request access to your Google data beyond what is listed above. If we ever need additional scopes, we will update this Policy first and ask for your consent through Google’s consent screen.

The App uses the gmail.send permission only to send email. It cannot read, list, search, modify or delete any messages, drafts, contacts or other content in the connected Google mailbox.

16.2 How we use Google user data

We use Google user data only to provide and improve the user-facing features of the App that you have requested, namely sending emails from our website, including contact form notifications, programme application and event confirmations, replies to enquiries and newsletter confirmations. We do not use Google user data for any other purpose.

In particular, we do not:

• Use Google user data for advertising, including personalised, retargeted or interest-based advertising;
• Sell Google user data or transfer it to data brokers, advertising platforms or information resellers;
• Use Google user data to determine credit-worthiness or for lending purposes;
• Use Google user data to develop, improve or train generalised artificial intelligence or machine learning models;
• Allow people to read your Google user data, unless we have your affirmative agreement for specific data, it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or the data is aggregated and anonymised for internal operations.

16.3 How we share Google user data

We do not share Google user data with third parties except:

• With service providers who process it on our behalf to run the App (for example hosting and database providers), under written agreements that restrict them to our instructions and require equivalent protection;
• Where required by law, a court order or a lawful request from a competent authority;
• To protect the rights, safety or security of Lapid Leaders Africa, our users or the public, including detecting and preventing fraud and abuse;
• As part of a merger, acquisition or transfer of programmes, provided the new owner remains bound by this Policy and Google’s requirements; or
• Where you have given us explicit consent.

16.4 How we store and protect Google user data

Google user data is stored on secure servers with access restricted to authorised personnel who need it to operate the App. We protect it with encryption in transit (HTTPS/TLS), access controls, authentication for administrators and regular security updates. OAuth tokens, where we store them, are kept secured and are used only to perform the features described above. Some of our service providers may process data outside Kenya, and we apply the safeguards described in Section 7.

16.5 Retention and deletion

We keep Google user data only for as long as you have an active account or relationship with the App, or as needed to provide the features you use. We delete it, or anonymise it so it can no longer identify you, within 30 days after:

• You delete your account or ask us to delete your data;
• You revoke our access to your Google Account (see Section 16.6); or
• The data is no longer needed for the purpose for which it was collected.

To request deletion, email operations@lapidleaders.africa from the address linked to your Google Account. We may keep limited records where the law requires, for example for audit or safeguarding purposes.

16.6 Revoking access

You can withdraw our access to your Google data at any time at https://myaccount.google.com/permissions by selecting the App and choosing “Remove access”. After you revoke access we stop accessing your Google data and delete what we hold as described in Section 16.5.

16.7 Google API Services User Data Policy (Limited Use)

Lapid Leaders Africa’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

16.8 Questions and complaints

If you have questions about how we handle your Google user data, contact us using the details in Section 17. You also have the rights described in Section 12, including the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

17. Contact Us

If you have questions about this Privacy Policy or want to exercise your rights, please contact:

Lapid Leaders Africa Waiyaki Way, Nairobi, Kenya Telephone: +254 706 829 247 Email: info@lapidleadersafrica.com Data protection enquiries: operations@lapidleaders.africa