Your Data & Rights

Privacy Policy

1. Information We Collect

We collect the following personal information when you become a Guardian:

  • Your full name (as it appears on your Certificate of Guardianship)
  • Your email address (for order confirmation and certificate delivery updates)
  • Your phone number (for M-Pesa payment processing and SMS notifications)
  • Your country of residence
  • Your postal address (for physical certificate delivery)

If you are purchasing a guardianship as a gift, we also collect the recipient's name.

2. How We Use Your Information

Your information is used exclusively for:

  • Processing your charitable donation and issuing your Certificate of Guardianship
  • Registering your name in the Guardians of Magdala public Registry
  • Sending you confirmation emails, SMS notifications, and certificate delivery updates
  • Fulfilling physical certificate printing and postal delivery

We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not use your data for automated decision-making or profiling.

3. The Public Registry

The Guardians of Magdala Registry is a public, transparent record of every Guardianship. When someone verifies a Certificate by unique identifier, they will see:

  • The certificate name on the guardianship
  • The unique identifier (MIG-X-XXXXX format)
  • The issue date of the guardianship

No contact information, email address, phone number, or postal address is ever displayed publicly. The Registry exists so that anyone can verify the authenticity of a Certificate of Guardianship.

4. Payment Processing

Payments are processed through:

  • M-Pesa (Safaricom) — for Kenyan Shilling donations via M-Pesa STK Push
  • Paystack — for card payments in multiple currencies

Your payment card details are never stored on our servers. Paystack handles all card data securely and is licensed by the Central Bank of Kenya. M-Pesa transactions are processed directly through Safaricom's Daraja API.

We receive confirmation of your payment but do not have access to your M-Pesa PIN or full card number.

5. Data Retention

Your personal information is retained indefinitely as part of the permanent Guardians of Magdala Registry. This is necessary because:

  • Guardianship is a permanent connection — your record must remain verifiable
  • Certificate reissues and name changes require identity verification against the original record
  • The charitable donation record must be maintained for financial auditing

You may request a correction to your personal data at any time by contacting us. Name changes on certificates are processed within 30 days of the original issue for a $5.00 fee.

6. Your Rights

Under the Kenya Data Protection Act (DPA 2019) , you have the right to:

  • Access your personal data
  • Request correction of inaccurate data
  • Request deletion of your data (subject to the permanent Registry requirement)
  • Object to processing of your data
  • Data portability

For international donors, GDPR and other privacy regulations may also apply. Contact us at the email below to exercise any of these rights.

7. Cookies & Tracking

Our website uses:

  • Essential session cookies — for admin authentication (NextAuth.js). These are required for the admin portal to function and are not used for tracking.
  • Cloudflare Turnstile — for bot protection on public forms. Turnstile does not use cookies and is privacy-preserving.

We do not use Google Analytics, Facebook Pixel, or any third-party tracking services. We do not display advertising.

8. Contact Us

For privacy-related questions, data access requests, or to exercise your rights:

Data Controller: Migdal Heritage Kenya Ltd.

This Privacy Policy was last updated on July 1, 2026.