Privacy Policy

Last updated: 12 August 2026

This policy explains what personal data the Kenya American Football Federation collects through americanfootballinkenya.com, why we collect it, who else can see it, and what you can do about it. We have tried to write it in plain language rather than legal boilerplate.

Who we are

The Kenya American Football Federation ("KFAF", "we", "us") is the governing body for American football in Kenya. We operate this website and are the data controller for the personal data described below.

You can reach us at info@kenyanfl.com or through our contact page.

What we collect when you choose to give it

Newsletter subscription

If you subscribe we store your email address. It is saved in our own database and also sent to Mailchimp, the service we use to send the newsletter. We use it only to send you KFAF news. Every newsletter includes an unsubscribe link.

Contact form

We store the name, email address, phone number, subject and message you submit, so we can reply and keep a record of the conversation.

Match ticket requests

When you request tickets for a fixture we store your name, email address, phone number, the number of tickets requested and any message you add. We use this to arrange your tickets and to contact you about that match. You receive a confirmation email, and our ticketing team is notified.

Donations

When you donate we store your name and email address, so that we can send you a receipt and answer questions about your gift afterwards. If you pay by M-Pesa we also store the phone number the payment prompt was sent to. You may tell us your country, which helps us understand where our support comes from.

We store what you gave, when, in which currency, and the reference numbers our payment provider gives us. We keep these because a donation is a financial record: we have to be able to account for every shilling, and to find your payment again if you ever query it.

We never see your card details. Card and PayPal information is entered on our payment provider's own systems and is never sent to, stored on, or seen by this website.

Your name is published on our supporters' board only if you tick the box asking us to. It is off unless you choose it. If you do, you decide how your name appears, and you may add a short message, which we read before it is shown. We never publish what anyone gave — not the amount, not a bracket, nothing that would let a reader work it out. Donors who do not opt in are counted in our totals but never named.

You can ask us to take your name off the board at any time, and we will. That does not undo the donation or remove the financial record, which we still have to keep.

If you set up a monthly donation, you can cancel it yourself from the link in every receipt. No account, no login, and no asking us first.

Players, coaches and officials

If you register with an affiliated club we hold the registration details that club submits to us — typically name, contact details, identification number and a profile photograph — for the purpose of running competitions, verifying eligibility and meeting safeguarding obligations. This data is not published on this website.

What we collect automatically

Article view counts

When you read a news article, knowledge base entry or resource, we record that it was read, so we can see which content is useful and stop producing what nobody reads.

To count each reader only once per day, we take your IP address, combine it with a secret key held only on our server, and store only the resulting one-way hash. Your actual IP address is never written to our database and cannot be worked backwards out of what we store — including by us. We also record the date, whether the request came from a mobile device, and the website that linked you to us, if any.

Before your IP address is hashed away, we use it to look up which country you are in, and store only the two-letter country code. This tells us whether our readers are in Kenya, the region or the diaspora. Country is the most precise location we keep — we do not record your city, your coordinates, or anything that could identify where you are. The lookup is done on our own server against an offline database, so your address is not sent to any location service.

Country lookups use the GeoLite2 database created by MaxMind, which incorporates GeoNames data made available under the Creative Commons Attribution 4.0 licence.

We do not use Google Analytics or any similar third-party tracking service, and we do not build profiles of individual readers.

Server logs

Like any website, our web server keeps standard access logs, which include IP addresses. These are used for security and diagnosing faults.

Cookies

We use three cookies, all of them our own. None are advertising cookies.

• csrftoken — a security cookie that protects forms on this site against cross-site request forgery. Essential.
• sessionid — keeps you signed in, if you have an account on this site. Essential, and only set when you log in.
• kfaf_cookie_notice — remembers that you have seen the cookie notice so we stop showing it. Expires after one year.

Other companies your browser contacts

Some parts of this site are loaded from other companies' servers. When that happens, those companies can see your IP address and which page you were on, under their own privacy policies rather than ours.

• Google Fonts — the site's typefaces are loaded from fonts.googleapis.com and fonts.gstatic.com on every page.
• Cloudflare (cdnjs) and jsDelivr — icon and layout files are loaded from their content delivery networks on every page.
• jQuery (code.jquery.com) — a script library loaded on every page.
• YouTube — where we show match highlights, the thumbnail images are loaded from YouTube when the page opens. The video player itself is not loaded until you click play, so YouTube does not set its cookies unless you choose to watch a video.

How long we keep it

• Article view records: deleted automatically after 180 days. The total view count shown on an article is a running tally, kept indefinitely, but it is only a number and is not linked to anyone.
• Newsletter subscriptions: until you unsubscribe.
• Contact messages and ticket requests: kept while they are operationally useful, then deleted.
• Registration records: kept for as long as you are registered, and afterwards where competition or safeguarding records require it.
• Donation records: kept as part of our accounts. We cannot delete these on request in the way we can delete a newsletter subscription — a federation that takes public donations has to be able to show where the money came from and where it went. Your name can still be removed from the public board at any time.

Who we share it with

We do not sell your personal data, and we do not share it with third parties for their own marketing. We share it only with:

• Mailchimp, which delivers our newsletter on our behalf;
• PayPal, when you donate by card or PayPal. They take the payment and hold your card details; we never see them. Our PayPal account is registered in the United States, so a donation made this way is processed there.
• our hosting and email providers, which process data as part of running the site;
• competition partners or authorities, where we are required to for eligibility, safeguarding or by law.

Some of these providers are based outside Kenya, which means your data may be stored or processed abroad. For donations paid by card or PayPal this is not incidental — the payment itself is handled in the United States, under that provider's own privacy terms as well as this policy.

Children and young people

We run youth programmes and tryouts. Where we collect data about anyone under 18, we do so through their club with the consent of a parent or guardian, and we apply our safeguarding policy to it. This website is not designed to collect data directly from children.

Your rights

Under Kenya's Data Protection Act 2019 you have the right to be told how your data is used, to get a copy of the data we hold about you, to have inaccurate data corrected, to have your data deleted, to object to how we use it, and to withdraw consent at any time. To exercise any of these, email info@kenyanfl.com.

One honest limitation: because article view records are stored as irreversible hashes, we genuinely cannot identify which of them relate to you, so we cannot retrieve or delete them individually. They delete themselves after 180 days.

A second, on donations: we will remove your name from the supporters' board the moment you ask, and stop a monthly donation immediately. But we cannot delete the record that the donation happened. A federation asking the public for money owes the public an account of it, and that obligation does not end because one donor would prefer the entry gone. We would rather say so plainly than promise a deletion we will not make.

If you are not satisfied with how we have handled your data, you can complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

Changes to this policy

If we change how we handle your data we will update this page and the date at the top. Significant changes will be announced through our newsletter.