1. Introduction
Football Kenya Federation Nairobi West Branch ("the Branch", "we", "us" or "our") processes personal data in accordance with Kenya’s Data Protection Act, 2019 and the regulations issued by the Office of the Data Protection Commissioner (ODPC).
This policy covers efkf.fkfnairobiwest.ke (the "Portal"): the club portal, the match officials’ area, the course listings and eDisputes. The Branch’s fan site at fkfnairobiwest.ke has its own policy. Both sites run on the same branch database, so a record you create here, such as a team sheet or a match report, may also appear there.
Data controller: FKF Nairobi West Branch, 1st Floor, Wing B, Shalom House, Ngong Road, Nairobi, Kenya · info@fkfnairobiwest.ke · +254 745 197 371
2. Personal data we collect
What we hold depends on the service you use. We collect only what the branch process needs.
- Account data: the email address the Branch issued an invitation to, your sign-in identifiers, the club or official role attached to the account, and a record of the actions taken through it.
- Club data: squad and player records, including names, dates of birth, FKF numbers, photographs and positions; team sheets, late changes, fixture change requests and player-of-the-match votes.
- Match officials’ data: appointments, availability, match reports, substitutions, incidents, disciplinary notes and profile details.
- eDisputes data: the filer’s name, email address and phone number; the parties, the match and the grounds of the case; the documents and evidence you upload; the M-Pesa transaction code and receipt for any filing fee; and every step, notice and ruling in the case.
- Course applications: your full name, national ID number, email address, phone number, social-media profile, licence number, experience and the documents you upload. The Portal passes the application straight to the national eFKF platform, which stores and processes it under the Federation’s own policy.
- Technical data: IP address, browser and device information, request logs and security events produced when the Portal is used, and page-speed readings recorded by the hosting platform (see the Cookie Policy).
- Communications: what you include when you email, call or message the Branch.
The Portal never asks for an M-Pesa PIN, a bank-card number or a password over email or phone. Fees are paid to the branch paybill through M-Pesa; the Portal records only the transaction code you enter.
3. Why we process personal data
| Purpose | Typical data | Legal basis |
|---|---|---|
| Run club and officials’ accounts | Account, role and session data | Contract; legitimate interests |
| Administer branch competitions | Squads, team sheets, appointments, match reports | Legal obligation; public task; legitimate interests |
| Register, hear and decide eDisputes cases | Filer contact details, case documents, fee records, rulings | Legal obligation; public task; legitimate interests |
| Pass course applications to the Federation | Applicant details and uploaded documents | Contract; legitimate interests |
| Send case and matchday notices | Email address, case reference, fixture details | Legal obligation; legitimate interests |
| Verify fees | M-Pesa transaction code and receipt | Contract; legal obligation |
| Protect users and systems | Logs, identifiers and security events | Legitimate interests; legal obligation |
| Keep the Portal fast and available | Page-speed readings, bot-management and release signals | Legitimate interests |
4. Who can see what
- A club sees its own squad, its own fixtures and its own cases. Another club cannot open them.
- A player’s FKF number, and the date of birth of a player under 16, are shown only to Branch officers, the player’s own club, the appointed referee from one hour before kick-off, and anyone who scans the club’s current squad pass at the pitch. The public sees each player’s name, photograph, club, position and shirt number, and their date of birth from their 16th birthday; never their FKF number.
- A case is open to its parties, the Registrar and the committee hearing it. Rulings may be published in line with FKF competition rules.
- Branch officers see what their role requires, and every change they make is recorded.
5. Sharing and service providers
We do not sell personal data. Access is limited to authorised Branch personnel and to providers that need it for a defined task.
- Supabase, for the database, sign-in and file storage behind the Portal.
- Lovable, the platform the Portal is built and hosted on, and Tinybird, the analytics provider Lovable uses for page views and page-speed readings.
- Cloudflare, for network delivery and protection against automated abuse.
- Resend, which delivers the Portal’s email, including case notices and account invitations.
- Football Kenya Federation and its national eFKF platform, which receives course applications and holds course listings and legacy case records, and for registration and disciplinary administration.
- Regulators, courts, football tribunals and law-enforcement bodies where the law requires it or where it is necessary to protect safety or the integrity of the game.
6. International transfers
Some of these providers process data outside Kenya. Where they do, we rely on the safeguards Kenyan law requires, including contractual, organisational and security measures, and we check that the transfer is necessary and proportionate.
7. Retention
We keep personal data for as long as the purpose needs it, to maintain an accurate football record, to resolve disputes and appeals, and to meet legal obligations.
| Category | Usual approach |
|---|---|
| Sign-in session | Until you sign out or the session expires |
| Account and role records | While the account is active, then for a reasonable audit period |
| Squads, team sheets and match reports | For the life of the sporting record and any required archive period |
| eDisputes cases and documents | For the life of the case, every appeal from it, and the archive period competition rules require |
| Fee records | For the statutory accounting and audit period |
| Security logs | For a limited period suited to investigation and protection |
8. Your rights
Subject to the Data Protection Act, 2019, you may ask to exercise the rights below. Some are limited where a record must be kept by law or to protect the integrity of a competition or a case.
- Be told how your personal data is used, and see a copy of it.
- Have inaccurate or incomplete data corrected.
- Object to, or ask us to restrict, certain processing.
- Have data erased where there is no lawful reason to keep it.
- Receive eligible data in a portable format.
- Withdraw consent at any time where consent is the basis for processing.
- Complain to the Office of the Data Protection Commissioner at odpc.go.ke.
9. Children and player data
Grassroots football includes children. We process a minor’s data only where football administration needs it and with the authority of a parent, guardian, club or other person the law permits.
The Branch holds written consent from a parent or guardian for every registered minor to be shown publicly by name and photograph. A minor’s FKF number and injuries are never published, and their date of birth is published only from their 16th birthday; their full record is opened only as section 4 describes.
A parent or guardian may withdraw consent at any time by writing to info@fkfnairobiwest.ke. The Branch will then promptly remove the minor’s photograph and name from public pages; the player stays registered.
10. Security
We use encrypted connections, managed sign-in, row-level access rules in the database, restricted officer roles, backups and monitoring. No internet service is completely secure, so keep your sign-in link and password to yourself and tell the Branch at once if you think someone else has used your account.
11. Changes to this policy
We will update this policy when our services, providers or legal duties change, and post the new version here with a new date. Where a change materially affects account holders, we will also tell them directly.
12. Contact us
To ask a privacy question or exercise a right, write to the Data Protection Lead, FKF Nairobi West Branch, at info@fkfnairobiwest.ke, or call +254 745 197 371. We may need to confirm who you are before we disclose or change any data.