Privacy Policy – Malaika Kitchens

Privacy Policy

malaikakitchens.org • Last updated: June 2025

Malaika Kitchens (“we”, “us”, or “our”) is a company limited by guarantee registered in Kenya. We operate the website malaikakitchens.org and are committed to protecting your personal data. This Privacy Policy explains what data we collect, why we collect it, and your rights as a visitor.

Our website is visited by people from across the world, including from the European Union and European Economic Area (EEA). We therefore align this policy with the General Data Protection Regulation (GDPR) as a standard of best practice.

1. Who We Are

The data controller for this website is:

Organisation: Malaika Kitchens (Company Limited by Guarantee, Kenya)
Website: malaikakitchens.org
Contact: info@malaikakitchens.org

For visitors from Germany, the relevant branch is Förderverein von Malaika Kitchens e.V. For visitors from the USA and other international donors, the relevant branch is Friends of Malaika Kitchens Inc. (501c3).

2. What Data We Collect and Why

2.1 Contact Form

When you submit our contact form, we collect:

Your name
Your email address
The content of your message

Legal basis: Article 6(1)(f) GDPR – legitimate interest in responding to your enquiry. Data is not permanently stored beyond what is needed to process and respond to your message.

2.2 Direct Debit / Donation Form (Bank Details)

When you fill in our donation form to set up a Direct Debit, we collect:

Your name
Your bank account details (to process the Direct Debit mandate)
Your contact details (as required for the mandate)

This data is collected solely to facilitate your donation and to complete the Direct Debit mandate. To our best knowledge, bank details entered via this form are transmitted securely and are not permanently stored on our servers beyond what is technically required for the transaction. If you have questions about where your data goes after submission, please contact us at info@malaikakitchens.org.

Legal basis: Article 6(1)(b) GDPR – processing is necessary to carry out the transaction you have requested.

2.3 Donations via Zeffy (US & International)

For US and other international donations, you will be redirected to Zeffy, operated by Friends of Malaika Kitchens Inc. (501c3). Zeffy processes your payment and automatically sends you a tax receipt. Any data you provide on Zeffy is subject to Zeffy’s own Privacy Policy.

2.4 Donations via German Branch

Donations from Germany are processed via Förderverein von Malaika Kitchens e.V. After completion, you will receive a tax receipt. Any data processed through this channel is subject to German data protection law (BDSG) and the GDPR.

2.5 Google Fonts

Our website uses Google Fonts to display the typeface “Comfortaa”. Google Fonts is a service provided by Google LLC. When you visit our website, your browser automatically connects to Google’s servers to load the font. This means your IP address is transmitted to Google.

Google LLC is based in the USA. The transfer is covered by Google’s participation in the EU-US Data Privacy Framework. For more information, see Google’s Privacy Policy at https://policies.google.com/privacy.

Legal basis: Article 6(1)(f) GDPR – legitimate interest in the consistent visual presentation of our website.

2.6 Google reCAPTCHA

Our contact forms are protected by Google reCAPTCHA, a service provided by Google LLC. reCAPTCHA analyses visitor behaviour (including IP address, browser information, and mouse movements) to distinguish humans from automated bots. This data is transmitted to and processed by Google on servers in the USA.

Legal basis: Article 6(1)(f) GDPR – legitimate interest in protecting our website from spam and abuse.

2.7 PDF Generation and Email Delivery of Donation Forms

When you submit the Direct Debit donation form, the data you enter (including your name, contact details, and bank account information) is used to automatically generate a PDF document containing your mandate details. This PDF is then sent by email via our mail server hosted by Hetzner Online GmbH (Germany).

Hetzner Online GmbH is based in Germany and processes data within the EU. Emails are transmitted using TLS encryption where supported by the receiving mail server. We recommend concluding a Data Processing Agreement (DPA) with Hetzner for this purpose.

Legal basis: Article 6(1)(b) GDPR – processing is necessary to carry out the transaction you have requested.

2.8 Cookies and Consent Recording

We use Complianz to manage cookie consent on our website. Complianz sets a necessary cookie to remember your consent preferences. This cookie does not track you.

We do not use analytics, marketing, or advertising cookies.

To comply with our legal obligation to demonstrate valid cookie consent (Article 7 GDPR), we use the “Record of Consent” plugin alongside Complianz. This plugin records the following data each time a visitor interacts with our cookie banner:

Anonymised IP address (last part removed for privacy)
Consent preferences (which cookie categories were accepted or declined)
Technical metadata (browser type, region, timestamp, consent method)
A unique anonymous identifier generated in your browser (stored in localStorage)

This data is stored on our own server, is not shared with third parties, and is used solely as proof of consent. Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation.

3. Data Transfers Outside the EEA

As noted above, two services on this website transfer data to Google LLC in the USA: Google Fonts (section 2.5) and Google reCAPTCHA (section 2.6). Both transfers are covered by Google’s participation in the EU-US Data Privacy Framework, which provides an adequate level of data protection. All other data processing (including email delivery via Hetzner) takes place within the EU. No other data transfers to third countries take place through this website.

4. How Long We Keep Your Data

Contact form data: Retained only as long as necessary to respond to your enquiry, then deleted.
Bank/donation form data: Not permanently stored on our servers beyond what is technically required for the transaction.
Complianz consent cookie: Stored in your browser until you clear your cookies or withdraw consent.

Consent records (Record of Consent plugin): Retained for as long as necessary to demonstrate compliance, typically up to 5 years.

5. Your Rights

Under the GDPR, you have the following rights:

Right of access – You can request a copy of the personal data we hold about you.
Right to rectification – You can ask us to correct inaccurate data.
Right to erasure – You can ask us to delete your data (“right to be forgotten”).
Right to restriction – You can ask us to restrict the processing of your data.
Right to data portability – You can request your data in a structured, machine-readable format.
Right to object – You can object to processing based on legitimate interests.
Right to withdraw consent – Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at: info@malaikakitchens.org

We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

6. Data Security

Our website uses HTTPS (SSL/TLS encryption) to protect data in transit. We take reasonable technical and organisational measures to keep your personal data secure.

7. Third-Party Links

Our website may contain links to third-party websites (e.g. Zeffy, social media). We are not responsible for the privacy practices of these external sites and encourage you to read their privacy policies.

8. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page shows when it was last revised. We encourage you to review it periodically.

9. Contact

For any questions about this Privacy Policy or how we handle your data, please contact us:

Email: info@malaikakitchens.org
Website: malaikakitchens.org