1. Introduction
Football Kenya Federation Nairobi West Branch ("the Branch", "we", "us" or "our") respects your privacy and processes personal data in accordance with Kenya’s Data Protection Act, 2019 and applicable regulations issued by the Office of the Data Protection Commissioner (ODPC).
This policy applies when you browse fkfnairobiwest.ke, use an officials or administration account, submit football records or documents, place a store order, or otherwise interact with a service offered through this website.
Data controller: FKF Nairobi West Branch, 1st Floor, Wing B, Shalom House, Ngong Road, Nairobi, Kenya · info@fkfnairobiwest.ke · +254 745 197 371
2. Personal data we collect
The information we collect depends on the service you use. We aim to collect only what is reasonably necessary for branch operations.
- Store and order data: name, phone number, optional email, delivery or collection details, order notes, selected payment method, M-Pesa contact number, products, personalisation and order history.
- Account data: email address, authentication identifiers, assigned role and records of authorised activity for administrators, team accounts and match officials.
- Football administration data: player and official names, photographs, team details, appointments, match sheets, disciplinary records, reports, course information, certificates and supporting documents.
- Technical data: IP address, browser and device information, request logs, security events and authentication-session information generated when the Platform is used.
- Audience measurement by the Branch: for each page opened, the page address, the referring website’s domain, a device category, the browser and operating-system family, a two-letter country code, and whether the browser identifies itself as automated (such as a search crawler or a headless browser). That last point is worked out in your browser and only the yes or no answer is sent; the browser’s full identifying string is never stored. A short-lived random session reference groups pages opened in one sitting; it is held only in browser session storage, is not a cookie, is not linked to any account and is discarded when the tab closes. No IP address is stored in this record.
- Measurement by the hosting platform: page views and page-speed readings collected by a script the hosting platform adds to every page, grouped by a random thirty-minute session cookie. This is a separate measurement the Branch does not operate; the Cookie Policy describes it in full.
- Local device data: store bag contents, saved products, recently viewed products and promotional-code state saved in your browser.
- Communications: information you include when you email, telephone or otherwise contact the Branch.
The current checkout does not collect or store bank-card details. If a payment provider is introduced, its own privacy notice will explain how it processes payment credentials.
3. Why we process personal data
| Purpose | Typical data | Legal basis |
|---|---|---|
| Deliver website and account services | Account, session and device data | Contract; legitimate interests |
| Run branch competitions | Registration, fixture, official and disciplinary data | Legal obligation; public task; legitimate interests |
| Process store orders | Contact, delivery, order and payment-choice data | Contract; legal obligation |
| Protect users and systems | Logs, identifiers and security events | Legitimate interests; legal obligation |
| Respond to enquiries | Contact details and message content | Consent; legitimate interests |
| Publish football information | Names, teams, results, statistics and approved media | Legitimate interests; consent where required |
| Measure how the website is used | Aggregated page, referrer, device and country statistics | Legitimate interests |
| Keep the website fast, available and protected from abuse | Page-speed readings, release and bot-management signals | Legitimate interests |
4. Sharing and service providers
We do not sell personal data. Access is limited to authorised Branch personnel and service providers that need the information to perform a defined function.
- Supabase, for database hosting, authentication and file storage.
- Lovable, the platform this website is built and hosted on, and Tinybird, the analytics provider Lovable uses to record page views and page-speed readings on its behalf.
- Cloudflare, for network delivery and protection against automated abuse.
- Email, delivery and payment providers used to operate the Platform or fulfil an order.
- Football Kenya Federation and, where required, football governing bodies for registration, integrity, disciplinary and competition administration.
- Regulators, courts and law-enforcement bodies where disclosure is required by law or necessary to protect rights, safety or football integrity.
- YouTube and other linked media platforms when you choose to view or open their content.
5. International transfers
Some technology providers or football governing bodies may process data outside Kenya. Where this occurs, we use the safeguards required by Kenyan law, including appropriate contractual, organisational and security measures, and assess whether the transfer is necessary and proportionate.
6. Retention
We keep personal data only for as long as it is needed for the purpose collected, to maintain an accurate football record, resolve disputes, enforce agreements, and satisfy tax, safeguarding, employment, competition or other legal obligations.
| Category | Usual approach |
|---|---|
| Browser bag and preferences | Until you clear browser storage or the stored item is replaced |
| Account and role records | While the account is active, then for a reasonable audit period |
| Orders and financial records | For the statutory accounting and dispute period |
| Competition and disciplinary records | For the life of the relevant sporting record and any required archive period |
| Uploaded certificates and documents | While required for verification, service or a legal obligation |
| Audience measurement | Page-view records for as long as the measurement needs them. Daily totals built from them hold no session reference and are kept indefinitely as the site’s history |
| Security logs | For a limited period appropriate to investigation and system protection |
7. Your rights
Subject to the Data Protection Act, 2019, you may ask to exercise the following rights. Some rights may be limited where we must retain a record by law or for the integrity of a competition.
- Be informed about how your personal data is used and request access to it.
- Ask us to correct inaccurate or incomplete personal data.
- Object to or request restriction of certain processing.
- Request erasure of personal data where there is no lawful reason to retain it.
- Receive eligible personal data in a portable format.
- Withdraw consent at any time where consent is the basis for processing.
- Complain to the Office of the Data Protection Commissioner at odpc.go.ke.
8. Children and player data
Grassroots football includes children. We process a minor’s data only where it is necessary for legitimate football administration and with the authority of a parent, guardian, club or other person permitted by law.
The public register on this website shows each player’s name, photograph, club, position and shirt number, and, from the player’s 16th birthday, their date of birth. For players under 18 this is published with the written consent of a parent or guardian, which the Branch holds for every registered minor. Profile pages of players aged 16 and over can appear in search engine results; a player under 16 has no public date of birth and their page is kept out of search engines. A minor’s injuries are not published.
A player’s FKF registration number is never shown on public pages, and nor is the date of birth of a player under 16. Both appear only to Branch officers who keep the register, the player’s own club, the referee appointed to the player’s match from one hour before kick-off, and anyone who scans the club’s current squad pass, which match officials use to verify players at the pitch.
A parent or guardian may withdraw consent at any time by writing to info@fkfnairobiwest.ke. The Branch will then promptly remove the minor’s photograph and name from public pages; the player stays registered.
9. Security
We use proportionate technical and organisational safeguards, including encrypted connections, managed authentication, access controls, restricted administrative roles, backups and service monitoring. No internet service is completely secure, so users must also protect passwords and promptly report suspected unauthorised access.
10. External services
The Platform links to independent websites and social or video services. Their privacy practices are controlled by their operators. Review their notices before providing information to them.
11. Changes to this policy
We may update this policy when our services, providers or legal duties change. The revised version will be posted here with a new last-updated date. We will provide additional notice where a change materially affects registered users.
12. Contact us
To ask a privacy question or exercise a data-protection right, contact the Data Protection Lead, FKF Nairobi West Branch, at info@fkfnairobiwest.ke or +254 745 197 371. Please describe the request clearly. We may need to verify your identity before disclosing or changing personal data.