When you apply to the Boardroom or take a seat, you trust us with your information. We take that seriously. This policy explains what personal data we collect, why we collect it, who sees it, how long we keep it and what rights you have. Please read it alongside our Terms and Conditions.

1Who we are

1.1The Boardroom is run by The Boardroom Innovation ("we", "us", "our"). We decide why and how your personal data is used, which makes us the data controller.

1.2In this policy, "Boardroom Innovation" means The Boardroom Innovation and every company it owns or controls. Other words, such as Boardie, Boardie Agreement, Sitting, Genba (ገንባ) and AGM, have the meanings given in our Terms and Conditions.

1.3If you need this policy in another format, for example because of a disability, email us at boardroominnovation@gmail.com.

2Who this policy covers

2.1This policy covers everyone whose personal data we handle, whether you visit our website, read our emails, follow our social media accounts, apply for a seat, take part in the Boardroom, contact us about someone who does, or work with us.

2.2This policy does not cover the websites or services of other organisations, even if we link to them.

3What we collect

3.1Depending on how you deal with us, we collect:

(a)contact details: your name, email address, phone number and the country you live in;

(b)application and seat details: your confirmation of your age and of the ticket price, the seat you chose, the contents of your application and, if you take a seat, your signed Boardie Agreement;

(c)an age check record: a copy of the identity document you give us to confirm your age, and when we checked it;

(d)payment details: the amount, the date and the payment reference. Card and mobile money details are handled by our payment provider, and we do not see or keep them;

(e)programme records: attendance, the work you produce, feedback, assessment notes and records of any concern raised under our Terms and Conditions or your Boardie Agreement;

(f)photographs and videos: recordings of online sessions, which we keep for teaching and our records, and other photographs and videos only with your consent;

(g)communications: the contents of the emails and messages you send us;

(h)for faculty, guest speakers and others who work with us: what we need to engage you, pay you and describe your role, as set out in your agreement with us; and

(i)technical information, such as your IP address and browser type, which the providers that run our website record to keep it working and secure.

3.2We do not use analytics or advertising cookies.

3.3We do not ask anyone for sensitive personal data, such as information about health, religion or ethnic origin. If you choose to share some, for example to ask us to adjust something because of a disability, we use it only for that purpose and only with your consent.

3.4If you take part in Genba (ገንባ), your Genba (ገንባ) agreement will tell you which company handles your personal data there.

4Why we use it, and our lawful basis

4.1We use personal data only for the purposes below, each on the lawful basis shown:

(a)replying to applications and offering seats: taking steps you asked for before entering into a contract with you;

(b)checking that applicants meet the age requirement, and keeping a record of that check: taking steps you asked for before entering into a contract with you, and our legitimate interest in being able to show that every Boardie is an adult;

(c)taking payment, issuing receipts and keeping financial records: performing our contract, and complying with tax law;

(d)running the Sitting, including schedules, materials, attendance and feedback: performing our contract with you;

(e)recording online sessions, so that Boardies can revisit them and we keep a record of what was taught: performing our contract with you;

(f)deciding which Boardies to invite to Genba (ገንባ): our legitimate interest in choosing who goes forward, which you can object to at any time;

(g)if you are invited to Genba (ገንባ), sharing your details with those involved in it: our legitimate interest in placing Boardies well, and your agreement when you accept;

(h)engaging and paying faculty and guest speakers: performing our contract with them, and complying with tax law;

(i)describing our faculty on our website without naming them: our legitimate interest in explaining who teaches each course;

(j)naming faculty, or using their photographs, in our materials or advertising: their consent, which they can withdraw at any time;

(k)replying to parents, guardians and anyone else who contacts us: our legitimate interest in answering questions about the Boardroom;

(l)keeping sessions safe and handling complaints and conduct concerns: our legitimate interests, and complying with the law where it applies;

(m)using photographs or videos of Boardies on our website or in our materials: your consent, which you can withdraw at any time;

(n)telling you about future Sittings: your consent, which you can withdraw at any time;

(o)keeping our website secure: our legitimate interest in protecting the website and its users; and

(p)making, defending or responding to legal claims: our legitimate interests, and complying with the law.

4.2Decisions about seats, Genba (ገንባ) and anything else that affects you are made by people. We do not make decisions about anyone by automated means.

4.3If we want to use your personal data for a purpose this policy does not cover, we will tell you first and, where the law requires, ask for your consent.

4.4We may turn personal data into anonymous statistics, such as how many Boardies come from each sector, and use or share them. They will never identify you.

5Who we share it with

5.1We share personal data only with those who need it to run the Boardroom, such as our faculty, other companies within Boardroom Innovation and our service providers, and with authorities when the law requires us to. Everyone we share it with is bound to protect it.

5.2Boardies are adults. We do not discuss a Boardie's application, attendance or progress with a parent or guardian unless the Boardie agrees.

5.3If someone takes over all or part of the Boardroom, personal data may pass to them, and they must protect it as this policy does. We will tell you before that happens.

5.4We do not sell personal data.

6Sending data outside Kenya

Some of the people we work with, including Boardies, faculty and service providers, may be outside Kenya. When personal data goes outside Kenya, we transfer it only as the law allows. Wherever your data is processed, we apply the protections in this policy.

7How long we keep it

7.1We keep personal data only for as long as we need it for the purpose we collected it for, or for as long as the law requires, for example for tax records.

7.2When we no longer need personal data, we delete it or make it anonymous.

7.3Deleted data may remain in backup copies for a short time before it is removed.

8Keeping it safe

8.1Only the people who need personal data can see it, and everyone who can is bound by a duty of confidentiality. Our service providers are bound to protect it too. No system is completely secure, but we work to keep your data safe and review how we protect it.

8.2If something goes wrong and personal data is put at risk, we will tell the Office of the Data Protection Commissioner, and the people affected where the law requires, as quickly as we can.

9Your rights

9.1You have the right to:

(a)be told how your data is used, which is what this policy is for;

(b)see the data we hold about you and get a copy;

(c)have anything wrong or misleading corrected;

(d)have your data deleted where we no longer have a reason to keep it;

(e)object to our use of your data, including consideration for Genba (ገንባ), although if a Boardie objects to that we will not be able to consider them;

(f)ask us to limit how we use your data while a concern is looked into;

(g)receive data you gave us in a format you can take elsewhere;

(h)withdraw any consent you have given, without affecting what we did before; and

(i)complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.

9.2To use any of these rights, email boardroominnovation@gmail.com. We may ask you to confirm who you are. Most requests are free, and we will respond within the time the law allows.

9.3Someone you authorise in writing, such as a parent or guardian, may make a request on your behalf. Without your written authority, no one else can.

9.4You can stop our news about future Sittings at any time by replying to any of our emails or writing to boardroominnovation@gmail.com.

10Age

Our programme is for people aged 18 to 22. We do not knowingly collect personal data from anyone under 18, other than what a parent or guardian chooses to tell us when contacting us. If we learn that we hold an under 18 applicant's data, we will delete it. If you think someone under 18 has sent us personal data, please tell us at boardroominnovation@gmail.com.

11If you live outside Kenya

If you live outside Kenya, the data protection law of your country may also apply to how we handle your personal data, and you may be able to complain to the data protection authority there. If you are in the European Union or the United Kingdom, this includes the GDPR.

12Changes to this policy

We will update this policy when our practices change and show the date at the top. If a change is significant, we will tell Boardies and faculty directly.

13Contact us

If you have any questions or comments about this policy, the ways in which we collect and use your personal data, or your choices and rights regarding that collection and use, please do not hesitate to contact us at boardroominnovation@gmail.com or +254 739 129 949.