Privacy Policy & Data Protection Notice
How the Coastal Universities and Colleges Adventists Students Organization (CUCASO) collects, secures, processes, and protects your personal information under the laws of the Republic of Kenya.
1. Data Controller & Statutory Framework
The Coastal Universities and Colleges Adventists Students Organization (CUCASO), operating as an autonomous regional umbrella body under the auspices of the Seventh-day Adventist Church in Kenya, is the Data Controller as defined by the Kenya Data Protection Act, 2019 (Act No. 24 of 2019).
Our regional Secretariat is located in Mombasa, Kenya. We are committed to upholding the constitutional rights to privacy enshrined in Article 31(c) and (d) of the Constitution of Kenya, 2010, and complying with the statutory directives issued by the Office of the Data Protection Commissioner (ODPC).
2. Information We Collect
To coordinate student ministry, rallies, capitation, and governance, CUCASO collects:
- Chapter Registration Data: Institution name, chapter executive officers (Chairperson, Secretary, Treasurer, Patron), contact phone numbers, and official emails.
- Rally & Event Delegate Information: Full legal names, national/student identification numbers, gender, academic departments, emergency contact names, and special dietary/accommodation requirements.
- Financial & Remittance Data: Safaricom M-Pesa transaction reference codes, sender phone numbers, amounts remitted, and timestamps. Note: CUCASO never requests, stores, or accesses your personal M-Pesa PIN or mobile wallet credentials.
- Minor (Under-18) Records: Verified guardian consent declarations, parent emergency contacts, and institutional authorization endorsements.
- Chaplaincy & Prayer Requests: Submitter name, contact, and spiritual prayer petitions submitted voluntarily.
3. Legal Basis for Processing (KDPA §30)
CUCASO processes personal data exclusively under the following lawful grounds:
Facilitating student accreditation, venue logistics, catering badges, and participation in annual coastal rallies.
Obtained during voluntary chapter affiliation, donor STK Push remittance, newsletter subscriptions, and prayer request submissions.
Processing sensitive data (religious affiliation) as an authorized religious student ministry in accordance with Section 47 of the KDPA.
Emergency medical contacts and guardian notifications for delegates during inter-county travel and encampments.
4. Technical & Organizational Security
All credentials stored within the CUCASO platform are protected using industry-standard cryptography, including Argon2id password hashing, HTTP-Only secure SameSite session cookies, and TLS 1.3 encryption in transit.
Payment webhooks from Safaricom Daraja are validated via encrypted cryptographic tokens to prevent replay attacks and fraudulent credit attempts.
5. Your Rights (KDPA Part IV)
As a registered user, delegate, patron, or supporter, you have the right to:
- Access: Request a copy of your personal data held in the CUCASO database.
- Rectification: Request prompt correction of inaccurate or incomplete contact or chapter records.
- Erasure: Request the deletion of non-statutory personal data when processing is no longer necessary.
- Objection: Object to automated processing or promotional SMS/Email dispatch.
Questions or Data Requests?
Contact the CUCASO Data Protection Liaison and Secretariat at cucaso2025@gmail.com or secretariat@cucaso.org.