Your data, your rights
Privacy notice
Last updated:
This notice is a draft and is awaiting the campaign’s confirmation.
This notice explains, in plain language, what personal data this website collects, why we collect it, who can see it, and the rights you have under Kenya’s Data Protection Act, 2019.
Who we are
This website is run by the #FormNiKujituma campaign of Hon. Gitonga Mukunji. The campaign is responsible for the personal data collected here.
Data controller details, including registration with the Office of the Data Protection Commissioner (ODPC): to be confirmed by the campaign.
What we collect
When you join through the volunteer form, we collect:
- your name
- your phone number
- your constituency and ward
- your polling station (optional)
- how you would like to help
- your message to Hon. Mukunji (optional)
- your consent for us to contact you
- a scrambled (hashed) form of your IP address, usually deleted after about 10 minutes and in any case within two days, to limit repeated sign-ups
When you vote in the poll, we collect:
- your choice
- a random device identifier, stored in a cookie on your device
- a scrambled (hashed) form of your IP address, usually deleted after about 10 minutes and in any case within two days, to limit repeated votes
We use the poll data only to allow one vote per device and to stop abuse.
When you report an issue, we collect:
- the topic and your ward
- your description of the issue
- a photo, if you add one (it is shrunk and its location data removed on your phone before it is sent)
- your phone number, only if you want a call back
- your consent for us to use the report
- a scrambled (hashed) form of your IP address, usually deleted after about 10 minutes and in any case within two days, to limit repeated reports
When you ask Mukunji a question, we collect your question and, if you choose, your ward. We do not ask for your name or phone. Questions are read by the team before anything is published, and are published without your name. To limit repeated questions and upvotes, we also keep a scrambled (hashed) form of your IP address, usually deleted after about 10 minutes and in any case within two days.
When you tap “I’ll be there” on an event, we keep a scrambled (hashed) form of your device identifier, so that each device is counted once, and, to limit repeated taps, a scrambled form of your IP address, usually deleted after about 10 minutes and in any case within two days. We do not ask for your name or phone.
The photo frame tool works entirely on your device: your photo is never uploaded to us.
Why we use it
We use your data only to:
- contact you about the #FormNiKujituma activities you signed up for;
- organise volunteers by ward and polling station;
- count one poll vote per device.
Our legal basis
We rely on your consent to contact you and to organise you as a volunteer. You can withdraw your consent at any time; withdrawing it does not affect what we did with your data before you withdrew it. To keep the forms, the poll, upvotes and event counts fair, we also process your device identifier and a scrambled form of your IP address because we have a legitimate interest in preventing abuse and repeated submissions or votes. Legal basis to be confirmed by the campaign’s data protection adviser.
Who can see it
Only a small number of authorised campaign staff can see your data. We do not sell your data.
Our website hosting provider, name to be confirmed by the campaign, stores and processes this data on our behalf and may store it outside Kenya; safeguards to be confirmed by the campaign.
We protect your data with encrypted (HTTPS) connections and by limiting access to authorised staff. Further security measures to be confirmed by the campaign.
How long we keep it
How long we keep volunteer and poll data: to be confirmed by the campaign.
Your rights
Under the Data Protection Act, 2019, you have the right to:
- be told how your personal data is used;
- see the personal data we hold about you;
- have false or misleading data about you corrected;
- have your data deleted;
- object to the use of all or part of your data;
- withdraw your consent at any time.
To use any of these rights, contact the campaign:
Contact details to be confirmed by the campaign.
Complaints
If you are not happy with how we handle your data, you can complain to the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke (opens in a new tab).
Cookies
This site itself sets only two cookies:
mk_voterholds the random device identifier that allows one poll vote, one upvote per published question and one “I’ll be there” per event, per device. It is set only when you vote, upvote or tap “I’ll be there” and expires after about 13 months (400 days). We store only a scrambled (hashed) form of it.NEXT_LOCALEremembers whether you are reading in English or Kiswahili. It is removed when you close your browser.
If you turn on low-data mode, your browser remembers that choice in its own storage (mk-low-data). It never leaves your device.
Content embedded from other sites, such as posts from X or Facebook, follows those sites’ own privacy policies and may set their own cookies.
We do not use advertising cookies. Any analytics tool will be confirmed in this notice before the site launches.

