Privacy Statement

1. Introduction

The Civic Progress Party (CIPA)(“CIPA”, “the Party”, “we”, “us”) is committed to protecting the privacy and personal data of our members, volunteers, and website visitors. This Privacy Statement explains what personal information we collect, why we collect it, how we use it, and what rights you have in relation to your data.

This statement applies to all personal data collected through our website (cipaparty.co.ke), our membership registration system, and any other direct interactions with the Party.

We comply with the Data Protection Act, 2019 (Kenya) and the Political Parties Act, 2011 (Kenya). By using our website or submitting a membership application, you acknowledge that you have read and understood this Privacy Statement.

2. Data Controller

The data controller responsible for your personal information is:

3. Data We Collect

Depending on your interaction with us, we may collect the following categories of personal data:

Membership Registration Data (PPM1 Form)

When you register as a CIPA member, we collect the following as required by the Political Parties Act, 2011 and the ORPP:

• Surname and other names
• National Identity Card (ID) or Passport number
• Date of birth
• Sex
• County of residence
• Constituency
• Ward
• Polling station / Polling centre
• Mobile phone number
• Email address
• Occupation
• Ethnic community
• Religion
• Special interest group (Youth, Women, Person with Disability)
• NCPWD registration number (if applicable)
• Membership category selected

Volunteer Application Data

• Full name
• Phone number
• Email address
• County
• Constituency
• Volunteer interests

Website Usage Data

• IP address and browser type (server logs)
• Pages visited and time spent
• Device type and operating system

4. How We Use Your Data

We use personal data for the following purposes:

• Processing and managing your party membership application
• Submitting your membership registration to the Office of the Registrar of Political Parties (ORPP) for official certification as required by law
• Verifying your eligibility to join the party (e.g., you are not already a member of another registered political party)
• Communicating with you about party activities, events, and announcements
• Administering elections to party offices and party nominations
• Coordinating volunteer activities and grassroots mobilization
• Maintaining the official CIPA membership register as required under Section 34 of the Political Parties Act, 2011
• Complying with our statutory obligations under Kenyan law
• Improving our website and services

5. Legal Basis for Processing

We process your personal data on the following legal bases under the Data Protection Act, 2019:

6. Sharing Your Data

We do not sell your personal data. We may share your information in the following circumstances:

• With the Office of the Registrar of Political Parties (ORPP) — mandatory statutory disclosure under the Political Parties Act, 2011, to maintain the official national membership register
• With the Independent Electoral and Boundaries Commission (IEBC) — for electoral verification purposes as required by law
• With service providers who process data on our behalf (e.g., hosting providers, email delivery services) — subject to appropriate data processing agreements
• With law enforcement or regulatory authorities — where required by law or court order
• In the event of a merger, acquisition, or restructuring of the party — members will be notified in advance

We do not transfer your personal data outside Kenya except where required by law or with your explicit consent, and only where the receiving country has adequate data protection standards.

7. Data Retention

We retain membership data for as long as your membership is active. Upon resignation, your record is marked as resigned in our system, and your core membership data is retained for a minimum of 7 years to comply with our statutory obligations under the Political Parties Act and for audit purposes.

Website usage logs are retained for a maximum of 12 months. Volunteer application data is retained for 2 years from submission.

After the applicable retention period, personal data is securely deleted or anonymized.

8. Your Rights

Under the Data Protection Act, 2019, you have the following rights regarding your personal data:

To exercise any of these rights, please contact our Data Protection Officer at civicprogressparty@gmail.com. We will respond within 21 days as required by law.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, alteration, or disclosure. Our security measures include:

• Encrypted HTTPS connections for all data transmission
• Email verification (5-character code) for all new member profile creation
• Email verification for membership resignation requests
• Password hashing for all administrative accounts
• Access controls limiting staff access to personal data on a need-to-know basis
• Regular backups and secure storage

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Office of the Data Protection Commissioner within 72 hours of becoming aware of the breach.

10. Cookies

Our website uses the following types of cookies and local storage:

• Session cookies — essential for maintaining your login session if you use the admin portal
• Accessibility preferences (localStorage) — stores your chosen accessibility settings (text size, modes) locally on your device; this data never leaves your browser
• No third-party advertising or tracking cookies are used

You can control cookies through your browser settings. Disabling essential cookies may affect the functionality of the admin portal.

11. Contact Us

If you have any questions about this Privacy Statement or wish to exercise your data rights, please contact us:

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), P.O. Box 41079-00100, Nairobi. Website: odpc.go.ke.