Privacy,
protected.

Who we are and when this policy applies

AAM is the data controller for personal data collected through this website, membership and volunteer processes, party offices, events, campaigns, communications, and authorised field systems. This policy applies whether information is collected digitally or on paper.

Political affiliation and political opinions may constitute sensitive personal data. We therefore apply enhanced controls and process such information only with an appropriate lawful basis, including explicit consent or a requirement of Kenyan law.

Personal data we may collect

Depending on how you engage with AAM, we may collect:

• Identity details, including your name, date of birth, national ID or passport details where legally required.
• Contact details, including telephone number, email and postal address.
• Normalized email addresses and telephone numbers used to prevent duplicate membership records and reconcile a member's verified payments across protected registers.
• Kenyan national identification or Kenyan passport number, date of birth and citizenship required for secure AAM movement-membership review.
• Whether a member declares a disability and, where applicable, the NCPWD number used for inclusion and accommodation. We do not ask for the type of disability or impairment.
• Location and branch details, including county, constituency and ward.
• Membership, volunteer, official, candidate, nomination and participation records.
• Recruitment applications, screening answers, work and education information, interview records and CVs supplied for a vacancy.
• Information required to demonstrate regional and ethnic diversity, gender balance, disability inclusion, youth status, or representation of special-interest groups, where lawful and necessary.
• Membership-fee and transaction references. We do not intentionally store full payment-card credentials.
• Public support pledges, including a supporter's name, unique telephone number, declaration of support and a separate preference about receiving campaign and policy updates.
• Community proposals, donation-confirmation details, messages, enquiries, consent records, event attendance and communication preferences.
• Technical and security information such as IP address, device type, access logs and fraud-prevention signals.
• First-party website analytics such as page path, anonymous session identifier, referral host, campaign tag, member or visitor audience type, device class, browser family, operating system, browser language, time zone and approximate country where available. This analytics register does not store raw IP addresses or raw browser user-agent strings.

We collect data directly from you wherever practicable. Where information comes from an authorised public record, electoral body, party official or another lawful source, we will handle it under this policy and applicable law.

How and why we use personal data

We use personal data to streamline AAM's operations and deliver an accountable, secure and legally compliant political organisation. This includes:

• Receiving and reviewing membership applications and maintaining an accurate membership register.
• Verifying eligibility, identity, consent and membership status.
• Organising members, volunteers, branches, meetings and programmes at ward, constituency, county and national levels.
• Communicating about membership, party activities, elections, policies, events, volunteer opportunities and service notices.
• Recording statements of public support separately from membership and separately from optional contact consent, while publishing only the aggregate number of active supporters.
• Assessing recruitment applications, arranging interviews, documenting accountable human decisions and contacting successful or unsuccessful applicants.
• Managing fees, receipts, internal administration, audit trails and financial accountability.
• Reviewing community policy proposals and keeping them separate from membership records.
• Reviewing donation confirmations and keeping them separate from membership applications.
• Producing aggregate or anonymised public donation-transparency reporting without publishing donor contact details or transaction-reference codes.
• Administering nominations, candidates, agents, elections, dispute processes and legally required records.
• Protecting members, systems and records from misuse, fraud, unauthorised access and security threats.
• Producing aggregated or anonymised operational insights that do not identify individuals.
• Understanding which pages and public information are useful, how visitors reach the website and broad technical or geographic patterns so we can improve access and communication.
• Complying with lawful duties imposed on political parties.

Recruitment screening is used only to organise applications for human review. It does not make a final hiring or volunteer appointment decision, and an applicant is not automatically rejected solely by the website.

Our lawful bases may include your consent, steps requested by you before membership, performance of the membership relationship, compliance with legal obligations, legitimate organisational interests balanced against your rights, and public-interest duties recognised by law. You may withdraw consent where processing relies on consent, without affecting processing already carried out lawfully.

When we disclose or share personal data

We may also disclose the minimum necessary information to the Independent Electoral and Boundaries Commission, a court, regulator, law-enforcement body or other public authority only where a valid legal requirement, court order or lawful electoral process requires it.

Public donation-transparency reporting will use verified totals, categories and anonymised information. We will not publish a donor's telephone number, email address, M-PESA receipt code or other identifying information without separate, informed permission or a lawful requirement.

Carefully selected technology and professional service providers may process data strictly on our documented instructions to host, secure, communicate, audit or support AAM systems. They are not permitted to use member data for their own purposes and must be subject to appropriate confidentiality, security and data protection obligations. Current core hosting providers include Supabase and Netlify. Where activated, a contracted email delivery provider processes the minimum information needed to deliver intake and membership notifications.

These contracted providers are data processors, not recipients who may use the information independently. Apart from this limited processing and disclosures required by Kenyan law, AAM will not disclose supporter names or contact details to third parties.

Security, international processing and retention

We use reasonable and appropriate technical and organisational safeguards, including access controls, least-privilege database rules, encryption in transit, controlled administrative access, audit records, backups, monitoring and staff confidentiality obligations. No digital service can promise absolute security, but we commit to protecting personal data and responding to incidents in accordance with Kenyan law.

Some contracted infrastructure may process or back up information outside Kenya. Where this occurs, we will use legally recognised safeguards, assess the processor's protections, limit the data transferred and obtain consent where Kenyan law requires it.

We keep identifiable personal data only for as long as necessary for the stated purpose and applicable electoral, accounting, audit, dispute and legal obligations. When membership ends, we update the active register and retain only records that must lawfully be preserved. When retention is no longer required, information is securely deleted or anonymised.

Recruitment CVs are stored in private, access-controlled storage and are available only through short-lived authorised links. Recruitment records are retained only for the active process, reasonable audit and dispute periods, or longer where the applicant separately agrees to consideration for future opportunities.

First-party website analytics use a random identifier that lasts only for the browser tab session. We honour browser Do Not Track and Global Privacy Control signals, do not use an advertising cookie, and delete event-level analytics after a rolling 13-month period. Administrators see aggregates rather than a visitor-by-visitor activity feed. We do not infer age, gender, ethnicity or other sensitive demographics from browsing.

If a personal-data breach creates a real risk of harm, we will investigate, contain and document it, and notify the Office of the Data Protection Commissioner and affected persons where and within the period required by law.

Your data-protection rights

Subject to applicable law, you may ask us to:

• Explain how your personal data is being used.
• Provide access to personal data held about you.
• Correct inaccurate, incomplete, false or misleading information.
• Object to or restrict particular processing.
• Delete information where there is no lawful reason to retain it.
• Provide portable data in a structured, commonly used format where applicable.
• Record withdrawal of consent or a change in communication preferences.
• Withdraw a public support pledge and stop campaign or policy updates.
• Update or end your AAM movement membership through our protected member or administration process.

We may need to verify your identity before acting on a request. Some requests may be limited where continued processing or retention is required by law, but we will explain the applicable reason.

You may lodge a complaint with the Office of the Data Protection Commissioner if you believe your data-protection rights have been infringed.

Children, automated decisions and policy updates

AAM membership is intended for eligible Kenyan citizens aged eighteen years or older. We do not knowingly recruit children through the membership service.

We do not make a legally significant membership, nomination or disciplinary decision solely through automated processing without the human review and safeguards required by law.

We may update this policy when our operations, technology or legal obligations change. The current version and effective date will remain available on this page, and material changes will be communicated through an appropriate channel.

Contact and privacy requests

Send privacy questions or rights requests with enough information for us to understand and verify the request. Do not send copies of identity documents by ordinary email unless an authorised AAM representative provides a secure submission method.

This policy should be read alongside AAM's membership forms, consent notices, constitution, rules and any activity-specific notice presented at the point of collection.