Privacy Policy

Personal data we collect

Depending on how you interact with us, we may collect:

• Identification & membership information — name, username/password, date of birth, membership tier and number
• Contact information — postal address, email address and phone number
• Payment & delivery details — billing information and payment confirmation (processed by our payment providers)
• Membership & purchase details — memberships, orders and transactions
• Referral details — your referral code and the M-Pesa or bank details you provide for payouts
• Marketing preferences — the consents you have given us
• Device & usage information — IP address, device/browser type and how you use our Websites
• Correspondence — your communications with us and survey responses
• Sensitive data — only in limited circumstances and only with a lawful basis under the Act (for example your explicit consent)

Data we receive from third parties

We may receive data from payment and mobile-money providers (confirming a payment), from social platforms if you register using a social account, and from partners or authorities where relevant and lawful.

Why we process your data and our lawful basis

We only process your personal data where the Act allows. Our lawful bases include:

• Consent — for example for marketing communications and non-essential cookies, which you can withdraw at any time
• Performance of a contract — to provide and manage your membership and process your orders and referral payouts
• Compliance with a legal obligation — for example accounting, tax and safeguarding requirements
• Legitimate interests — to run, secure and improve the club and our Websites, balanced against your rights

Who we share your data with

We may share your personal data with:

• Payment and mobile-money processors (for example card providers, M-Pesa and PayPal)
• Trusted service providers who host and support our Websites and systems, under data-sharing agreements
• Our professional advisers (such as legal and accountancy firms)
• Public authorities or law enforcement, where we are required to do so by law
• A purchaser or successor, if our business is sold or reorganised

International transfers

Some providers may process data outside Kenya. Where this happens, we take steps required by the Act to ensure your data remains protected, including appropriate safeguards or transfer conditions. A copy of the relevant safeguard can be provided on request.

How long we keep your data

We keep personal data only for as long as necessary. We retain membership data for as long as your account is active and for a limited period afterwards. We keep transaction records for the period required by legal and accounting obligations, and we keep a record of any request not to receive marketing so we can respect it.

Your rights under the Act

Under the Data Protection Act, 2019 you have the right to:

• Be informed about how your data is used
• Access your personal data and request a copy
• Have inaccurate or incomplete data corrected (rectification)
• Request deletion or erasure of your data
• Object to processing, including direct marketing
• Restrict processing in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Withdraw your consent at any time where processing is based on consent

Children's data

We do not knowingly process the personal data of a child (under 18) without the consent of their parent or guardian, as required by section 33 of the Data Protection Act, 2019. Junior memberships and youth programme registrations must be made and managed by a parent or guardian. Where we process children's data, we do so in a manner that protects and advances the rights and best interests of the child.

How to contact us and exercise your rights

To exercise any of your rights, or for any privacy query, contact us at privacy@fcnairobi.com. We will respond within the timelines set by the Act and its Regulations (for example, access requests within 7 days and rectification within 14 days).

You can also write to: Data Protection Contact, FC Nairobi Ltd, Principal Place, School Lane, Westlands, Nairobi, Kenya.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

Changes to this policy

We may update this policy from time to time. The latest version will always be available on our website. Please check back for updates.