Privacy Notice

Effective: 16 October 2026 · Consent-text version: v1-2027-10

1. Who we are (the data controller)

The Mike Power Maingi Campaign (""we", "us") is the data controller for personal information collected through mikepower.ke and our offline campaign canvases. Our data-protection contact is privacy@mikepower.ke.

2. What we collect — and what we don't

We collect the minimum a ward campaign actually needs:

• Tunaskia Desk (listening post) — your issue, its ward and category. The descriptive text is stored and may be published on the public voice board. Name and phone are optional: provide them only if you want a response. If you leave both out, the submission is anonymous and stores no personal data.
• Jitolee (volunteers) — full name, phone (M-Pesa/WhatsApp), ward, estate/polling station, and role. No email, no national ID, no payment details.
• General contact — the details you choose to send by email, phone, or WhatsApp.
• Technical data — standard server logs (IP, timestamps) kept briefly for security and abuse prevention (rate limiting).

We do not collect: national ID or voter card numbers, bank/M-Pesa PINs, biometrics, precise location tracking, or special-category data (health, religion, ethnicity, political opinion) through forms. Donations go through the official M-PESA paybill and the campaign does not receive your banking credentials.

3. Why we process it (purposes)

• To log, track, and respond to resident issues raised on the Tunaskia Desk.
• To organise volunteer coverage across the five wards (canvassing, barazas, polling-station work, digital outreach).
• To publish anonymised or first-name voice-board entries so residents can see action being taken.
• To comply with the law — including the Elections Act and campaign-finance rules (Office of the Registrar of Political Parties; IEBC), which may require contribution record-keeping.
• To keep the site safe (rate limiting, abuse prevention).

We do not sell your data, and we never use campaign data for commercial advertising.

4. Consent and withdrawal

Every form that collects personal data carries a specific consent statement, and we log the consent timestamp plus the version of the notice text on the submission. You may withdraw consent at any time by contacting privacy@mikepower.ke (or by telling any ward coordinator). Withdrawal does not affect the lawfulness of processing already carried out. Where processing rests on a legal obligation (campaign-finance records), we will explain what must be kept and for how long.

5. Publication of submissions

Voice-board entries are published with the ward, category, body text, and status. If you submitted your name, the public entry shows at most your first name — never your phone number. Anonymous entries render as "Anonymous". The desk may unpublish or edit body text (e.g. to remove personal details about third parties, or defamatory or inciting content) while keeping your issue tracked.

6. Sharing

We share personal data only with:

• our own ward coordinators and secretariat staff, on a need-to-know basis;
• service providers that host and deliver this site (hosting: Cloudflare; database and email: Convex / AWS SES) under contract;
• regulators or courts where the law compels disclosure; and
• anyone you direct us to (e.g. escalating your issue to a county office with your details).

7. Retention

• Voice-board issues: kept for the campaign period and up to 12 months after the election, then deleted or anonymised.
• Volunteer records: kept for the campaign period; erasure on withdrawal of consent where the law permits.
• Contribution records: kept for the period the campaign-finance rules require.
• Security logs: short retention (days to weeks).

8. Security

Data is transmitted over TLS and stored in a managed database with access restricted to the secretariat. Access to personal data is least-privilege and logged. No system is perfectly secure; if a breach likely causes real risk of harm, we will notify the Office of the Data Protection Commissioner and affected individuals as the Act requires.

9. Your rights

Under the Data Protection Act, 2019 you may:

• be informed of the data we hold about you (access);
• request correction of inaccurate data;
• request deletion (erasure) of your data;
• object to processing, or withdraw consent;
• not be subjected to automated decision-making (we do none);
• lodge a complaint with the Office of the Data Protection Commissioner (odpc.go.ke).

To exercise any right, email privacy@mikepower.ke — include the name or ticket reference the data was collected under. We respond within the statutory window (three days to acknowledge; seven days to fulfil, extendable where the request is complex).

10. Children

The site is not directed at children; forms are for adults. Bursary matters concerning minors are tracked without publishing a child's identity (initials only).

11. Changes

Material changes to this notice will be posted here with an updated "Effective" date, and the consent text on the forms will be re-versioned.

12. Contact

Mike Power Maingi Campaign
Attn: Data Protection Desk
Roysambu Constituency, Nairobi County
Email: privacy@mikepower.ke