Privacy,
protected.

Who we are and when this policy applies

AAM is the data controller for personal data collected through this website, membership and volunteer processes, party offices, events, campaigns, communications, and authorised field systems. This policy applies whether information is collected digitally or on paper.

Political affiliation and political opinions may constitute sensitive personal data. We therefore apply enhanced controls and process such information only with an appropriate lawful basis, including explicit consent or a requirement of Kenyan law.

Personal data we may collect

Depending on how you engage with AAM, we may collect:

• Identity details, including your name, date of birth, national ID or passport details where legally required.
• Contact details, including telephone number, email and postal address.
• Normalized email addresses and telephone numbers used to prevent duplicate membership records and reconcile a member's verified payments across protected registers.
• Kenyan national identification or Kenyan passport number, date of birth, citizenship and other-party declarations required for lawful political-party membership review.
• Whether a member declares a disability and, where applicable, the NCPWD number required by ORPP Form PPM1. We do not ask for the type of disability or impairment.
• Location and branch details, including county, constituency and ward.
• Membership, volunteer, official, candidate, nomination and participation records.
• Information required to demonstrate regional and ethnic diversity, gender balance, disability inclusion, youth status, or representation of special-interest groups, where lawful and necessary.
• Membership-fee and transaction references. We do not intentionally store full payment-card credentials.
• Community proposals, donation-confirmation details, messages, enquiries, consent records, event attendance and communication preferences.
• Technical and security information such as IP address, device type, access logs and fraud-prevention signals.

We collect data directly from you wherever practicable. Where information comes from an authorised public record, electoral body, party official or another lawful source, we will handle it under this policy and applicable law.

How and why we use personal data

We use personal data to streamline AAM's operations and deliver an accountable, secure and legally compliant political organisation. This includes:

• Receiving and reviewing membership applications and maintaining an accurate membership register.
• Verifying eligibility, identity, consent and membership status.
• Organising members, volunteers, branches, meetings and programmes at ward, constituency, county and national levels.
• Communicating about membership, party activities, elections, policies, events, volunteer opportunities and service notices.
• Managing fees, receipts, internal administration, audit trails and financial accountability.
• Reviewing community policy proposals and keeping them separate from membership records.
• Reviewing donation confirmations and keeping them separate from membership applications.
• Producing aggregate or anonymised public donation-transparency reporting without publishing donor contact details or transaction-reference codes.
• Administering nominations, candidates, agents, elections, dispute processes and legally required records.
• Protecting members, systems and records from misuse, fraud, unauthorised access and security threats.
• Producing aggregated or anonymised operational insights that do not identify individuals.
• Complying with lawful duties imposed on political parties.

Our lawful bases may include your consent, steps requested by you before membership, performance of the membership relationship, compliance with legal obligations, legitimate organisational interests balanced against your rights, and public-interest duties recognised by law. You may withdraw consent where processing relies on consent, without affecting processing already carried out lawfully.

When we disclose or share personal data

We submit membership details and supporting records to the Office of the Registrar of Political Parties (ORPP), including through the Integrated Political Parties Management Information System (IPPMS), where required for registration, verification, certification, maintenance of the statutory membership register, or another lawful ORPP function under the Political Parties Act, the Elections Act and related law.

We may also disclose the minimum necessary information to the Independent Electoral and Boundaries Commission, a court, regulator, law-enforcement body or other public authority only where a valid legal requirement, court order or lawful electoral process requires it.

Public donation-transparency reporting will use verified totals, categories and anonymised information. We will not publish a donor's telephone number, email address, M-PESA receipt code or other identifying information without separate, informed permission or a lawful requirement.

Carefully selected technology and professional service providers may process data strictly on our documented instructions to host, secure, communicate, audit or support AAM systems. They are not permitted to use member data for their own purposes and must be subject to appropriate confidentiality, security and data protection obligations. Current core hosting providers include Supabase and Netlify. Where activated, a contracted email delivery provider processes the minimum information needed to deliver intake and membership notifications.

Security, international processing and retention

We use reasonable and appropriate technical and organisational safeguards, including access controls, least-privilege database rules, encryption in transit, controlled administrative access, audit records, backups, monitoring and staff confidentiality obligations. No digital service can promise absolute security, but we commit to protecting personal data and responding to incidents in accordance with Kenyan law.

Some contracted infrastructure may process or back up information outside Kenya. Where this occurs, we will use legally recognised safeguards, assess the processor's protections, limit the data transferred and obtain consent where Kenyan law requires it.

We keep identifiable personal data only for as long as necessary for the stated purpose and applicable political-party, electoral, accounting, audit, dispute and legal obligations. When membership ends, we update the active register and retain only records that must lawfully be preserved. When retention is no longer required, information is securely deleted or anonymised.

If a personal-data breach creates a real risk of harm, we will investigate, contain and document it, and notify the Office of the Data Protection Commissioner and affected persons where and within the period required by law.

Your data-protection rights

Subject to applicable law, you may ask us to:

• Explain how your personal data is being used.
• Provide access to personal data held about you.
• Correct inaccurate, incomplete, false or misleading information.
• Object to or restrict particular processing.
• Delete information where there is no lawful reason to retain it.
• Provide portable data in a structured, commonly used format where applicable.
• Record withdrawal of consent or a change in communication preferences.
• Update or end your party membership through the applicable party and ORPP procedure.

We may need to verify your identity before acting on a request. Some requests may be limited where continued processing or retention is required by law, but we will explain the applicable reason.

You may lodge a complaint with the Office of the Data Protection Commissioner if you believe your data-protection rights have been infringed.

Children, automated decisions and policy updates

AAM membership is intended for eligible Kenyan citizens aged eighteen years or older. We do not knowingly recruit children through the membership service.

We do not make a legally significant membership, nomination or disciplinary decision solely through automated processing without the human review and safeguards required by law.

We may update this policy when our operations, technology or legal obligations change. The current version and effective date will remain available on this page, and material changes will be communicated through an appropriate channel.

Contact and privacy requests

Send privacy questions or rights requests with enough information for us to understand and verify the request. Do not send copies of identity documents by ordinary email unless an authorised AAM representative provides a secure submission method.

This policy should be read alongside AAM's membership forms, consent notices, constitution, rules and any activity-specific notice presented at the point of collection.