Cookie & Consent Notice

1. Purpose and relationship with the Privacy Policy

This Data Processing and Consent Notice explains how CareFund obtains, records and manages consent where consent is the appropriate lawful basis for processing personal data. It supplements the CareFund Privacy and Data Protection Policy and should be read together with that Policy, the CareFund Terms and Conditions and, for beneficiary organisations, the CareFund Beneficiary Platform and SaaS Agreement.

CareFund is a product/platform operated by WezaCare Solutions, a Kenyan non-profit company limited by guarantee. CareFund is not a separate legal person.

This Notice is deliberately not a single blanket consent form. CareFund obtains consent contextually at the point where the relevant optional processing occurs. Acceptance or acknowledgement of this Notice does not constitute consent to every processing activity described in it.

2. Consent is only one lawful basis

CareFund will identify an appropriate lawful basis for each processing activity. Personal data may be processed where necessary to perform a contract, comply with a legal obligation, protect vital interests, pursue a legitimate interest permitted by law, establish or defend legal claims, perform a task authorised by law, or on another lawful basis available under applicable law.

Where consent is relied upon, CareFund will seek a freely given, specific, informed and unambiguous affirmative indication appropriate to the particular purpose. CareFund will not manufacture consent by making an unnecessary optional processing activity a condition of accessing the core service.

Silence, inactivity, pre-ticked boxes or mere continued use of the Platform will not be treated as consent where affirmative consent is required.

3. Information provided before consent

Before asking a person to consent, CareFund will provide sufficient information, in clear and accessible language, for the person to understand the processing for which consent is requested. Depending on the activity, this may include:

• the identity of WezaCare/CareFund and, where relevant, another controller or recipient;
• the particular categories of personal data concerned;
• the specific purpose for which the data will be processed;
• any intended disclosure to a beneficiary organisation, payment provider or other relevant third party;
• whether the information will be publicly displayed;
• any material cross-border transfer implications where relevant;
• the voluntary nature of the consent and any genuine consequence of refusing it; and
• the right and practical method to withdraw the consent.

4. Contextual consent architecture

CareFund will present a consent choice only when the user reaches a feature or activity for which that consent is actually relevant. This avoids consent fatigue, prevents unrelated permissions from being bundled together and allows CareFund to demonstrate precisely what the data subject agreed to.

For example, a person need not consent to public display of a donor name merely to register an account. That choice arises when the person makes a donation. Similarly, optional cookie consent is obtained through the cookie banner and Cookie Settings, not through account registration or acceptance of this Notice.

5. Account registration

At account registration, CareFund may require the user to accept the applicable Terms and Conditions and acknowledge that the Privacy and Data Protection Policy and this Notice have been made available. Those actions record contractual acceptance and receipt/acknowledgement of privacy information; they are not blanket consent to every optional use of personal data.

Core account information may be processed on the lawful basis appropriate to establishing, administering, securing and providing the requested account and Platform services. Optional marketing or other consent-based uses must be presented separately where applicable.

6. Donor processing and donation checkout

When a donor makes a donation, CareFund may process identity, contact, transaction, campaign, receipt, fraud-prevention and related information on the lawful basis applicable to administering and securing the transaction and complying with legal obligations.

Any optional donor-facing choice should be presented at the point of donation. For example, a donor may be asked whether their name or donor message may be displayed publicly, or whether they wish to receive optional fundraising or platform updates. Refusal of an optional choice must not, by itself, prevent an otherwise lawful donation.

A choice to donate publicly as 'Anonymous' concerns public display. It does not require CareFund, Paystack or another authorised payment provider to erase or disregard transaction identity information that they lawfully require for processing, security, fraud prevention, accounting, dispute handling or regulatory compliance.

7. Beneficiary organisations and representatives

Beneficiary onboarding will distinguish between information required to establish organisational identity, authority, KYB, settlement, safeguarding and compliance, and any optional processing for which consent is the appropriate basis.

An authorised representative submitting information about another person must have a lawful basis and authority to do so. Acceptance of the Beneficiary Platform and SaaS Agreement does not convert unlawfully obtained third-party personal data into lawfully obtained data.

8. Campaign content, images and personal stories

Where campaign content identifies an individual, CareFund and the beneficiary organisation must establish the lawful basis for collecting, sharing and publishing that information. Where consent is the appropriate basis, it should be obtained specifically for the relevant campaign use and retained as evidence.

Consent or authority to process information for case management, service delivery, healthcare, safeguarding or internal beneficiary records does not automatically authorise public fundraising publication. Repurposing such data for a CareFund campaign requires a separate lawful basis and appropriate notice.

9. Children and vulnerable persons

Personal data relating to children and vulnerable persons receives enhanced protection. Where consent is relied upon for a child's data, CareFund or the responsible beneficiary must obtain consent from a parent, guardian or other legally authorised person as required by applicable law, verify the authority to an appropriate degree, and ensure that the processing is in the child's best interests.

Campaign publication involving identifiable children should be subjected to the enhanced safeguarding and data-protection review in the CareFund SOPs. CareFund may decline publication even where consent has been produced if publication is considered unnecessary, excessive, unsafe or inconsistent with the child's best interests.

10. Direct marketing and optional communications

Consent to optional newsletters, fundraising appeals, platform promotions or comparable direct marketing should be obtained separately from registration, donation and acceptance of the Terms. The choice should not be pre-selected.

A person may withdraw marketing consent or object to direct marketing using the unsubscribe facility, account preferences or CareFund's privacy contact channel. Necessary operational communications, including security alerts, receipts, account administration and transaction notices, are distinct from optional marketing.

11. Cookies and similar technologies

Cookie consent is obtained separately through the CareFund cookie banner and Cookie Settings. Acceptance of the Terms, acknowledgement of the Privacy Policy, acceptance of this Notice, registration, donation or continued use of the Platform does not itself constitute consent to optional cookies.

Strictly necessary cookies and comparable technologies may be used where required to operate or secure the Platform, maintain a session, authenticate a user, preserve consent preferences, support checkout or prevent fraud.

If a user accepts optional cookies through the cookie banner or Cookie Settings, CareFund may use only the categories accepted by that user and only for the purposes disclosed when the choice is made. If the user rejects non-essential cookies, those technologies should remain disabled unless and until the user later changes the preference.

The cookie interface should provide Accept All, Reject Non-Essential and Manage Preferences options, together with a persistent Cookie Settings control through which the user can later change or withdraw the choice.

12. Cross-border processing

Where personal data is processed or stored outside Kenya, CareFund will identify and implement the transfer mechanism or safeguard required by applicable law. Consent will be used as the transfer basis only where legally appropriate. Where specific consent is relied upon, the relevant transfer information will be presented at the point at which that consent is sought.

13. Withdrawal of consent

A data subject may withdraw a consent at any time through the mechanism provided for that processing activity, including account preferences, unsubscribe controls, Cookie Settings or CareFund's privacy contact channel. Withdrawal should be as reasonably accessible as the mechanism used to give consent.

Withdrawal does not affect the lawfulness of processing undertaken before withdrawal. It also does not require CareFund to erase information that it is required or otherwise lawfully entitled to retain under another lawful basis. CareFund will, however, cease future processing that depended solely on the withdrawn consent as soon as reasonably practicable.

14. Storage and retention

Personal data will be retained in accordance with the CareFund Privacy and Data Protection Policy and the applicable retention schedule. Consent records may themselves be retained for so long as reasonably necessary to demonstrate compliance, resolve disputes or establish the lawful basis on which processing occurred.

CareFund should not retain personal data indefinitely merely because consent was once given. Retention must remain connected to a lawful purpose.

15. Consent records and audit trail

CareFund will maintain a central consent and preference record capable of showing, where relevant:

• user, account, transaction, campaign or device reference;
• the processing purpose or consent category;
• the exact choice made;
• the version of the notice or interface presented;
• the date and time of the affirmative action;
• the source of the consent, such as checkout, campaign submission, account preferences or cookie banner;
• any later modification or withdrawal; and
• the current status of the consent or preference.

The consent record should be protected against unauthorised alteration and be capable of being produced for internal audit, complaint handling or regulatory review.

16. Data-subject rights

The rights available to a data subject are described in the CareFund Privacy and Data Protection Policy and applicable law. These may include rights to be informed, access personal data, object to processing, seek correction or deletion where applicable, withdraw consent and exercise rights concerning qualifying automated processing.

17. Changes to this Notice

CareFund may update this Notice where the Platform, processing activities, law or regulatory guidance changes. Where a change materially alters a processing activity for which consent is required, CareFund will obtain fresh consent where required rather than relying merely on continued use.

18. Contact

Questions, consent withdrawals and data-protection requests should be directed through the current privacy contact channel published by WezaCare Solutions/CareFund in the Privacy and Data Protection Policy and on the Platform.