LEGAL & COMPLIANCE | FEDERATION OF WOMEN ENTREPRENEURS - KENYA

Privacy Policy

How we collect, manage, and safeguard your personal data in compliance with the Data Protection Act, 2019. Last updated: 23 September 2026.

Statutory Baseline: FOWEK handles personal data in strict alignment with the Constitution of Kenya, 2010, the Data Protection Act, 2019, and the Data Protection (General) Regulations, 2021. Last reviewed on 23 September 2026.

1. Who is responsible for your data

The Federation of Women Entrepreneurs – Kenya (FOWEK) is the data controller. This means we decide why and how your personal data is collected, processed, and safeguarded.

Registered Office: WuYi Plaza, Off Galana Road, Nairobi, Kenya.
Data Protection Contact: The FOWEK Secretariat
Direct Email: secretariat@fowek.org
Official Telephone: +254 798 510 851

2. What we collect

FOWEK collects information through various engagement channels to deliver our services:

When you apply for membership: Your full name, business or organisation name, sector, county, email address, telephone number, membership tier, business registration details where applicable, and payment references.
When you register for an event, webinar, training, or programme: Your name, email address, telephone number, business name, and programme-specific criteria (such as business stage, product readiness, or export profile for incubation and trade missions).
When you contact us or subscribe to updates: Your name, email address, phone number, and any details shared within your enquiry.
When you attend a FOWEK event: Attendance registers, alongside photographs and video recordings taken at public forums.
When you browse this website: Technical analytics collected automatically, including your IP address, browser type, device identifiers, pages visited, session duration, and referral source.

What we do not collect: We do not collect sensitive personal data as defined under the Data Protection Act (such as religious affiliations, health records, or family details). If a specialised enterprise grant or programme requires such data, we will inform you of the statutory reason at the point of collection and request explicit consent separately.

3. Why we use it, and our lawful basis

Section 30 of the Data Protection Act, 2019 requires a lawful basis for every processing activity. Our processing framework is set out below:

Purpose of Processing	Lawful Basis (Data Protection Act)
Processing membership applications and administration	Performance of a contract with you
Collecting subscription fees and issuing receipts	Performance of a contract, and legal obligation
Registering you for events, trainings, and workshops	Performance of a contract with you
Sending member updates, news, and opportunity alerts	Your express consent
Connecting you to B2B matchmaking, buyers, and trade	Your express consent
Nominating you for awards, incubation, or regional trade fairs	Your express consent
Maintaining statutory, tax, and accounting records	Legal obligation
Reporting anonymised metrics to partners, funders, and COMFWB	Legitimate interest in federation reporting
Maintaining website stability, firewalls, and security	Legitimate interest in system protection

Where we rely on your consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.

4. Marketing and updates

We only send promotional communications if you have granted express consent, in strict compliance with Section 37 of the Data Protection Act, which prohibits commercial data use without prior approval.

Every marketing email includes a single-click unsubscribe link.
You can reply directly or email secretariat@fowek.org to opt out at any time. We process opt-out requests promptly and free of charge.
Zero Data Selling: We do not sell, rent, or trade your personal data or contact details to third parties, sponsors, or advertisers.

6. Sending data outside Kenya

Because FOWEK serves as the national chapter for COMFWB and utilizes global cloud software, some data processing occurs across international borders. When data is transferred outside Kenya, we ensure compliance with Sections 48 and 49 of the Data Protection Act by confirming the recipient jurisdiction offers adequate data protection safeguards or by obtaining your explicit consent.

7. How long we keep it

We retain your personal data only as long as necessary for the purpose it was gathered:

Active Membership Records: Retained throughout membership and for seven (7) years following resignation or expiry to satisfy statutory audit requirements.
Uncompleted Applications: 12 months, unless you request earlier deletion.
Event & Webinar Registrations: 24 months for engagement analysis.
General Enquiries: 24 months.
Newsletter Subscriptions: Retained until you unsubscribe.
Website Analytics: Aggregated and anonymised after 26 months.

8. How we protect it

We deploy SSL/TLS encryption across our digital channels, enforce role-based access limits for Secretariat staff, and review systems regularly.

72-Hour Breach Notification: While no online platform can claim absolute invulnerability, in the event of a security incident presenting risk to your rights, we will notify the Office of the Data Protection Commissioner (ODPC) within seventy-two (72) hours pursuant to Section 43 of the Act, alongside notifying affected users directly.

9. Your rights

Under Section 26 of the Data Protection Act, you have the right to:

Information: Be informed how your personal data is collected and used.
Access: Request copies of personal data held about you.
Rectification: Request correction of inaccurate, outdated, or incomplete data.
Erasure: Request deletion of false or misleading data, or data held without continued lawful grounds.
Objection: Object to processing of your data for specific purposes.
Restriction: Request restriction of processing under Section 34 circumstances.
Portability: Receive your data in a structured, usable format under Section 38.
Consent Withdrawal: Revoke consent at any time without negative recourse.

To exercise any of these statutory rights, email secretariat@fowek.org with the subject line “Data Request”. We will respond within the statutory timelines without charging handling fees.

10. If you are not satisfied

If you have any concern regarding our data handling, please contact us first at secretariat@fowek.org so we can address it.

If you remain unsatisfied, you have the right to lodge a formal complaint with the regulator under Section 56 of the Data Protection Act:

Regulator: Office of the Data Protection Commissioner (ODPC)
Location: Britam Towers, 12th & 13th Floors, Hospital Road, Upper Hill, Nairobi
Official Website: www.odpc.go.ke

11. Changes to this policy

We will update this page when operational or legal practices evolve. The date at the top indicates the current version. If changes materially impact how your personal data is handled, registered members will receive direct notice.

Data Protection Contact

FOWEK Secretariat
WuYi Plaza, Off Galana Road, Nairobi

Email: secretariat@fowek.org
Phone: +254 798 510 851

TRANSPARENCY & DATA PRIVACY

Have a Question About Your Personal Data?

Our Secretariat team is here to support any data inquiries, record corrections, or subject access requests promptly.