Who's in charge of what
The club is in charge of its members' information (the data controller). The Boys Club Alliance (TBCA) keeps it for the club (the data processor), and only does with it what this agreement says.
What we do with it
We use it only to run the platform for the club, as the club's settings and officials direct. Never for our own purposes.
Who on our side can see it
Only the staff who need to, to set the club up, help when it asks or fix a fault. Each of them is bound to keep it confidential.
How it's kept safe
- The club's records sit in their own part of the database.
- Everything travels encrypted. Passwords are scrambled, and the club's keys are encrypted and never shown again.
- Receipt open only for the member who sent them and the officials who check them.
- Changes and confirmations are kept with who made them.
Other services we use
- The company that hosts our server, and the service that delivers our emails.
- A mobile money or text service the club connects is the club's own supplier, on the club's own account.
We'll tell the club before we add a new service that would see its members' information.
If something goes wrong
If the club's information is lost, seen by someone who shouldn't see it, or changed without permission, we tell the club's officials within 48 hours of finding out: what happened, what it touches, and what we're doing. We help the club tell its regulator and its members where the law asks it to. In Kenya a regulator must be told within 72 hours.
Members' requests
When a member asks to see, correct or delete their information, we help the club answer, inside the time the law gives.
When the club leaves
We give the club a copy of its records, then delete them within 90 days. They leave our backups within a further 30 days.
Checking on us
We answer a club's reasonable questions about how its information is handled, and show how these promises are kept.