Privacy Policy

1. Introduction

Open Budget Kenya ("we", "us", "our" or "the Platform") is an independent public-interest initiative that promotes transparency, accountability and public participation in the management of public finances in Kenya.

Our website provides access to publicly available information relating to national and county government budgets, public expenditure, development projects, public debt, budget allocations and other public financial information.

We recognise the importance of protecting personal information and respecting the privacy of everyone who visits or uses our website.

This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, when it may be shared, and the rights available to individuals whose personal information we process.

We are committed to handling personal information in accordance with applicable Kenyan data protection laws, including the Data Protection Act, 2019, and its subsidiary regulations.

By using our website, you acknowledge that you have read this Privacy Policy.

2. Scope of This Policy

This Privacy Policy applies to:

Visitors browsing Open Budget Kenya.
Users who create accounts using Google or Facebook authentication.
Individuals who contact us through the website or other communication channels.
Users who participate in discussions, submit information or use interactive features, where available.
Individuals whose personal information may be incidentally contained in publicly available government documents or datasets presented on the Platform.

This policy applies to information collected directly by Open Budget Kenya and information collected automatically through your use of the website. It does not govern the privacy practices of external websites, government institutions or third-party services linked from our Platform.

3. Public Information and Government Data

A central purpose of Open Budget Kenya is to make public financial information accessible, searchable and understandable. The Platform may collect, organise, process, analyse and publish information obtained from publicly accessible sources, including:

National government budget estimates and budget implementation reports.
County government budgets and budget implementation reports.
Development project information.
Public procurement and expenditure information.
Public debt reports and related financial disclosures.
Government publications, official reports and other public records.
Information published by government ministries, departments, agencies and public institutions.

We generally publish this information for transparency, research, civic education and public accountability purposes.

3.1 Publicly Available Information

Information that has lawfully been made publicly available by government institutions or other authorised sources may be reproduced, organised or presented on the Platform. However, the fact that information is publicly accessible does not automatically mean that it is outside the scope of data protection laws.

Where publicly available information contains personal data, we will consider applicable legal requirements and the principles of lawful, fair and transparent processing.

3.2 Accuracy and Source Attribution

We endeavour to preserve the integrity of information obtained from official sources and, where practical, identify the source of published data. Information may be reorganised, summarised, categorised or presented through charts, tables and other visualisations to make it easier to understand.

We do not guarantee that all information is complete, current or free from errors. Users should consult the relevant original government publications when making decisions that require authoritative or legally binding information.

3.3 Public Data Does Not Mean User Data

Government budget information and public financial records displayed on Open Budget Kenya are distinct from personal information collected about website visitors. We do not make a user's private account information publicly available merely because the Platform publishes public government data.

4. Information We Collect

Depending on how you use the Platform, we may collect the following categories of information.

4.1 Account Information

If you choose to sign in using Google or Facebook, we may receive information made available by the authentication provider, including:

Your name.
Your email address, where the provider makes it available and you authorise its disclosure.
Your provider-specific account identifier.
Your profile information made available through the authentication service.

We use this information to identify your account, authenticate your access and maintain your user session. We do not ask users to create a separate password when using Google or Facebook authentication. We do not receive your Google or Facebook password.

4.2 Technical and Usage Information

When you visit the website, certain technical information may be collected automatically, including:

Internet Protocol (IP) address.
Browser type and version.
Device type and operating system.
Date and time of access.
Pages visited and features used.
Referring website or source.
General website usage and diagnostic information.

This information may be used to maintain website functionality, diagnose technical problems, improve performance and protect the Platform against abuse.

4.3 Information You Provide Directly

We may collect information that you voluntarily provide when you contact us through email or contact forms, submit feedback or suggestions, report incorrect or outdated information, request assistance, or participate in interactive features introduced on the Platform.

Such information may include your name, email address, message and any other details you voluntarily provide. Please avoid submitting sensitive personal information unless it is necessary for your request.

5. How We Use Your Information

We process personal information for legitimate and specific purposes, including:

Account authentication: To verify your identity through Google or Facebook and provide access to account-related features.
Account management: To create, maintain and manage user accounts.
Website operation: To ensure that the Platform functions properly and remains accessible.
Security: To detect, prevent and investigate unauthorised access, suspicious activity, fraud and misuse.
Communication: To respond to enquiries, feedback and support requests.
Website improvement: To understand how visitors use the Platform and improve its design, functionality and accessibility.
Data integrity: To review reports of inaccurate or outdated public information.
Legal compliance: To comply with applicable laws, regulations and lawful requests from competent authorities.

We will not use personal information for purposes that are incompatible with the purposes for which it was collected without an appropriate lawful basis.

6. Legal Basis for Processing

Under the Kenya Data Protection Act, 2019, personal information must be processed lawfully, fairly and transparently. Depending on the nature of the processing, Open Budget Kenya may rely on one or more of the following lawful bases:

Consent: Where you voluntarily authorise the collection or use of information for a specified purpose.
Contractual necessity: Where processing is necessary to provide an account-related service you have requested.
Legitimate interests: Where processing is necessary for legitimate interests such as maintaining website security, preventing abuse and improving the Platform, provided these interests do not override your rights and freedoms.
Legal obligation: Where processing is necessary to comply with applicable legal requirements.

Where we rely on consent, you may withdraw that consent, subject to any legal consequences or other lawful basis for continued processing.

7. Google and Facebook Authentication

Open Budget Kenya allows users to authenticate using third-party identity providers, including Google and Facebook. When you select one of these options, you are redirected to the relevant provider to complete authentication.

The provider may share information with us according to the permissions you grant and its own privacy policies. We may store the following information in our database:

Authentication provider (Google or Facebook).
Unique identifier assigned to your account by the provider.
Name.
Email address, where supplied.
Account creation and update timestamps.

We use the provider-specific identifier to recognise returning users. We do not use your Google or Facebook password, and we do not have access to it. We do not automatically combine separate Google and Facebook accounts solely because they share an email address.

Your use of these authentication services is also subject to their respective privacy policies:

You may revoke Open Budget Kenya's access through the relevant provider's account settings.

8. Cookies and Similar Technologies

Open Budget Kenya may use cookies and similar technologies to support website functionality. These technologies may be used to:

Maintain authenticated user sessions.
Remember certain website preferences.
Support website security.
Understand website traffic and usage patterns, where analytics tools are implemented.

Some cookies are essential for the operation of the website, particularly those required for authentication and session management. Where non-essential cookies or tracking technologies require consent under applicable law, we will seek that consent.

You may manage or disable cookies through your browser settings. However, disabling certain cookies may affect website functionality, including the ability to remain signed in.

9. Sharing and Disclosure of Information

We do not sell, rent or trade users' personal information to third parties. We may share personal information only where necessary and appropriate, including:

9.1 Service Providers

We may use third-party service providers to support website hosting, infrastructure, security, analytics, authentication and technical maintenance. Such providers may process personal information on our behalf and are expected to apply appropriate safeguards and use the information only for authorised purposes.

9.2 Authentication Providers

When you use Google or Facebook login, the relevant provider processes information in accordance with its own privacy policy and terms.

9.3 Legal and Regulatory Requirements

We may disclose information where required by law, a valid court order or a lawful request from a competent authority.

9.4 Protection of Rights and Security

We may disclose relevant information where reasonably necessary to investigate suspected fraud, address security incidents, enforce applicable terms or protect the rights and safety of users and the Platform. We do not share private user account information as part of the public budget datasets displayed on the website.

10. Data Retention

We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, including legal, security and operational requirements.

Account information is retained while your account remains active.
Technical and security logs are retained for periods appropriate to security and operational requirements.
Enquiry and support information is retained for as long as necessary to address the relevant matter and maintain appropriate records.
Information may be retained for longer where required by law or necessary to establish, exercise or defend legal claims.

When personal information is no longer required, we will take reasonable steps to securely delete, anonymise or otherwise dispose of it.

11. Data Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. These measures may include:

Secure website connections using HTTPS.
Access restrictions for administrative systems.
Secure authentication and session management.
Protection of database credentials and application configuration.
Regular software maintenance and security updates.
Appropriate database and infrastructure safeguards.

Although we take reasonable steps to protect information, no website, internet transmission or electronic storage system can be guaranteed to be completely secure. Users should also take reasonable precautions to protect their own devices and third-party authentication accounts.

12. International Data Transfers

Some of our hosting, authentication, analytics or other technology providers may process information outside Kenya. Where personal information is transferred outside Kenya, we will take appropriate steps to ensure that such transfers comply with the Kenya Data Protection Act, 2019, and applicable regulations.

These steps may include ensuring that appropriate safeguards, contractual protections or other legally recognised transfer mechanisms are in place.

13. Your Data Protection Rights

Subject to applicable law, you may have the following rights in relation to your personal information:

13.1 Right to Be Informed

You have the right to understand how your personal information is collected and used.

13.2 Right of Access

You may request confirmation of whether we process your personal information and request access to that information.

13.3 Right to Rectification

You may request correction of inaccurate, incomplete or outdated personal information.

13.4 Right to Erasure

You may request deletion of your personal information where the law provides for that right.

13.5 Right to Object

You may object to certain forms of processing of your personal information, including processing based on legitimate interests, subject to applicable law.

13.6 Right to Restriction

You may request restriction of processing in circumstances recognised under applicable data protection law.

13.7 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

13.8 Right to Data Portability

Where applicable, you may request your personal information in a structured, commonly used and machine-readable format.

13.9 Right to Complain

You may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya if you believe that your personal information has been handled unlawfully.

Website: https://www.odpc.go.ke/

To exercise your rights, contact us using the details provided in Section 18. We may need to verify your identity before responding to certain requests. We will handle requests within the periods prescribed by applicable law.

14. Public Information and Requests for Removal

Open Budget Kenya is designed to promote public access to government financial information. If you believe that information published on the Platform contains inaccurate personal information, unlawfully disclosed personal data or information that should not have been made publicly available, you may contact us.

When submitting a request, please provide:

The relevant webpage or dataset.
A description of the information concerned.
The reason for your request.
Supporting information where appropriate.

We will review the request and take appropriate action where justified under applicable law. A request for removal will not automatically result in the removal of information that is lawfully required to remain publicly accessible or whose publication is otherwise justified by law.

15. Third-Party Websites and Services

Our website may contain links to external government websites, public institutions, research organisations and other third-party services. These websites operate independently and have their own privacy policies and practices.

Open Budget Kenya is not responsible for the privacy, security or content practices of external websites. We encourage users to review the privacy policies of external services before providing them with personal information.

16. Children's Privacy

Open Budget Kenya is a public information platform and is not specifically directed at children. We do not knowingly collect personal information from children in circumstances where parental or guardian consent is required and has not been obtained.

Where we become aware that personal information has been collected unlawfully from a child, we will take appropriate steps in accordance with applicable law.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our website functionality, data processing practices, technology, operational requirements or applicable laws. When changes are made, the revised policy will be published on this page together with an updated revision date.

We encourage users to review this page periodically.

18. Contact Information

If you have questions about this Privacy Policy, wish to exercise your data protection rights or want to raise a concern about information published on Open Budget Kenya, please contact us:

Open Budget Kenya
Website: https://openbudget.or.ke
Email: [Insert official contact email]

We will make reasonable efforts to respond to privacy enquiries within the timeframes required by applicable law.

Open Budget Kenya

Promoting transparency, accountability and public participation in public finance management.

Open Budget Kenya