Who this policy covers
This policy applies to eco-foundation.online. “Eco Foundation” is the editorial name of the website. No legal company name, registration number or tax identifier has been provided, so this policy does not invent one. Privacy enquiries may be sent to [email protected] or to the contact address at Kimathi Street, Starehe, Nairobi, Kenya.
Kenyan privacy framework
The site is designed with Kenya's Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021 in mind. The Office of the Data Protection Commissioner (ODPC) oversees data-protection implementation in Kenya. This policy is a practical transparency document and is not a claim that every possible statutory registration obligation has been assessed for every future processing activity.
Data you actively submit
The contact form asks for name, email address, subject and message. A consent checkbox records that you understand the stated purpose of the form. We deliberately do not request diagnosis, blood-glucose readings, medical records, prescriptions, national ID numbers, payment information or other medical data.
Health information
Health status is sensitive personal data under Kenyan data-protection practice. Because this website is not a medical service, users are asked not to place health records or detailed medical information in the free-text message field. If you voluntarily include such information, it may be received as part of the email generated by the form; please avoid doing so.
Technical and server data
Like most web hosting, the server may automatically process technical request data such as IP address, requested URL, timestamp, browser or user-agent information, referrer and error logs for security, debugging and reliable delivery. Exact hosting retention depends on the hosting environment selected by the site owner.
Purpose of processing
Contact data is used to read and answer enquiries, handle correction requests, respond to privacy questions, investigate website problems and maintain a basic record of correspondence where reasonably necessary. Technical logs are used for security, service reliability and troubleshooting.
Lawfulness and fairness
Processing should be limited to explicit and legitimate purposes and should be proportionate to those purposes. Where consent is used, it should be informed and capable of being withdrawn where applicable. Certain limited processing may also be necessary for site security or to respond to a user-initiated communication.
Data minimisation
We request only the fields needed to answer a website enquiry. The form includes a honeypot anti-spam field that is not intended to collect information from genuine users. We do not create health profiles from contact messages.
Local storage
The site uses browser localStorage only to remember that the storage notice has been closed. The key is named eco_storage_notice. This preference remains in the browser until it is cleared. It is not designed to identify you across websites.
Cookies
No first-party analytics, advertising or affiliate-tracking cookies are intentionally set in this release. The site does not load GA4, Google Tag Manager, Cookiebot or reCAPTCHA because real configuration IDs or keys were not provided. If those services are enabled later, this policy and the cookie notice should be updated before or at deployment.
Affiliate tracking
The declared business model is affiliate publishing, but no active affiliate partner, network or destination URL has been supplied. This release therefore contains no commission-generating affiliate destination and does not intentionally set affiliate-tracking cookies. Future affiliate links must be disclosed and any tracking technology must be reflected in this policy.
Google services
GA4, GTM, Cookiebot, reCAPTCHA, Google Maps and Search Console verification are not active unless real identifiers are inserted in config/integrations.php. Search Console verification, if later added, is site-ownership verification and does not by itself require a visitor-facing tracking script.
Recipients
Contact messages are sent to [email protected] using the server's email capability. Depending on the hosting and email providers selected by the site owner, those service providers may process data to deliver the website or email. No specific hosting or email vendor is named because none was provided.
International transfers
Where a hosting, email or future analytics provider processes personal data outside Kenya, applicable transfer safeguards under Kenyan law should be considered. The Data Protection (General) Regulations, 2021 include requirements concerning cross-border transfers and appropriate safeguards.
Retention
Contact correspondence should be retained only as long as reasonably needed to respond, handle follow-up, resolve disputes or meet applicable legal obligations. The site does not set an invented fixed retention period where the actual mail-hosting setup has not been supplied. Server logs follow the retention configured by the hosting provider.
Security
The site uses input validation, a honeypot field and no client-side storage of contact-form content. Production deployment should use HTTPS, supported PHP, appropriate server permissions, secure email configuration, updates and backups. No website can promise absolute security.
Your rights
Kenyan data-protection law provides data subjects with rights including being informed about use of their personal data, access, objection to processing, correction of false or misleading data, and deletion of false or misleading data. The exact right available can depend on the circumstances and applicable law.
How to make a request
Email [email protected] with “Privacy request” in the subject. We may need enough information to locate the relevant correspondence and verify that a request relates to you. Do not send more identity information than necessary.
Complaints
If you believe personal data has been handled contrary to Kenyan data-protection law, you may have the right to raise the matter with the Office of the Data Protection Commissioner. This website does not reproduce or invent an ODPC case procedure; current official guidance should be used for formal complaints.
Children
The website is written for a general adult audience and the contact form is not intentionally designed to collect children's information. Parents and guardians should avoid submitting children's health details through a general editorial contact form.
Third-party links
This release does not contain active commercial affiliate destinations. If third-party links are added later, the destination's privacy practices will be separate from this policy.
Changes
This policy may be revised when site functions, service providers, integrations or legal requirements change. Material changes should be reflected in the page content and review date.
Contact
Email: [email protected]. Phone: +254 740 168 723. Address: Kimathi Street, Starehe, Nairobi, Kenya.