Legal
Privacy Policy
County Government of Nyeri — Department of Agriculture
Coffee Licensing System — Effective Date: 1 January 2026
This Privacy Policy is issued in compliance with the Data Protection Act, 2019 (Kenya) and its subsidiary legislation. The County Government of Nyeri is registered as a Data Controller with the Office of the Data Protection Commissioner (ODPC).
1. Who We Are (Data Controller)
The data controller responsible for your personal data under this Privacy Policy is:
County Government of Nyeri
Department of Agriculture
Nyeri Town, Nyeri County, Kenya
Email: agriculture@nyeri.go.ke
Website: /coffee-licensing/public/
For data protection enquiries, please contact our designated Data Protection Officer at the address above, marking your correspondence "For the attention of the Data Protection Officer."
2. Scope of This Policy
This Privacy Policy applies to all personal data collected, processed, and stored by the County Government of Nyeri through the Coffee Licensing System. It applies to:
- Individuals who register as applicants on the System
- Directors, officials, and authorised officers whose details are submitted as part of a licence application
- County Government officers who use the System in an administrative capacity
3. Personal Data We Collect
We collect the following categories of personal data, depending on how you use the System:
| Category | Data Elements | Source |
|---|---|---|
| Account data | Full name, email address, phone number, password (stored as a cryptographic hash — never in plain text) | Provided by you on registration |
| Business profile | Organisation name and type, date of incorporation, registration number, subcounty, ward, physical address, postal address, LR/plot number, email, mobile number | Provided by you on the profile page |
| Directors / officials | Full name, physical address, occupation of each director or authorised officer | Provided by you |
| Supporting documents | National ID or Passport copy, Certificate of Incorporation, List of Directors, Title Deed or Lease Agreement, Insurance Policy, payment receipts | Uploaded by you |
| Application data | Licence type, application-specific field values, submission dates, status history, rejection reasons | Generated during application process |
| Technical data | IP address, browser type and version, operating system, session identifiers, login timestamps | Collected automatically when you access the System |
| Communications | Content of notifications sent to you through the System and by email | Generated by the System |
We do not knowingly collect data from persons under the age of 18. If you believe a minor's data has been submitted without consent, please contact us immediately.
4. Legal Basis for Processing
Under Section 30 of the Data Protection Act, 2019, personal data may only be processed on a lawful basis. We rely on the following bases:
| Processing Activity | Legal Basis (DPA 2019, s.30) |
|---|---|
| Processing licence applications | Performance of a public function — licensing is a statutory function of the County Government under the Agriculture, Fisheries and Food Authority Act (Cap. 318) and the County Governments Act, 2012 |
| Account registration and authentication | Consent — obtained when you create your account and agree to these terms |
| Sending notifications about your application | Legitimate interests — keeping you informed about your application status |
| Fraud prevention and security monitoring | Legitimate interests — protecting the integrity of the licensing system and public funds |
| Audit logging of officer actions | Legal obligation — maintaining accountability records as required under the Public Finance Management Act and county accountability frameworks |
| Retention of issued licences and records | Legal obligation — statutory record-keeping requirements |
5. How We Use Your Personal Data
We use your personal data for the following purposes:
- To verify your identity and manage your account
- To process and adjudicate your coffee licence application
- To communicate decisions, requests for information, and licence status updates to you
- To generate and issue your digital licence certificate
- To verify the authenticity of licences when queried by authorised persons
- To maintain statutory records of all licence applications and decisions
- To detect and prevent fraudulent applications or abuse of the System
- To improve the System's functionality and user experience
- To comply with legal and regulatory obligations applicable to the County Government
6. Sharing of Personal Data
We do not sell, rent, or trade your personal data. We may share your personal data in the following circumstances:
- Within the County Government — your data is accessible to authorised Subcounty Officers, County Officials, and Administrators involved in processing your application
- Regulatory and law enforcement bodies — where required by law, court order, or to prevent, detect, or investigate fraud or criminal activity
- Audit and accountability bodies — such as the Controller of Budget, Kenya National Audit Office, or county audit committees, where required for oversight purposes
- System service providers — where necessary for the operation of this System (e.g., hosting providers), who are contractually bound to process data only on our instructions and in accordance with the DPA 2019
We will not share your personal data with any third party for commercial or marketing purposes.
7. Your Rights Under the Data Protection Act, 2019
As a data subject under the DPA 2019, you have the following rights in relation to your personal data:
7.1 Right of Access (Section 26)
You have the right to request confirmation of whether we hold personal data about you and to obtain a copy of that data, together with information about how it is being processed.
7.2 Right to Rectification (Section 27)
You have the right to request correction of personal data that is inaccurate or incomplete. You may update most of your information directly through the System. For data that cannot be self-corrected, contact us using the details in Section 13.
7.3 Right to Erasure (Section 38)
You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and there is no other legal basis for processing), or where the data has been unlawfully processed. This right does not apply where we are required by law to retain the data (e.g., statutory licensing records).
7.4 Right to Restriction of Processing (Section 28)
You may request that we restrict the processing of your personal data in certain circumstances, such as where you contest its accuracy or where you have objected to processing and a determination is pending.
7.5 Right to Object (Section 34)
You have the right to object to processing of your personal data carried out on the basis of legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
7.6 Right to Data Portability (Section 35)
Where processing is based on your consent and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
7.7 Right Not to Be Subject to Solely Automated Decision-Making (Section 33)
Licensing decisions made through this System are not made by automated means alone. All decisions are reviewed and made by authorised human officers of the County Government.
To exercise any of these rights, please submit a written request to our Data Protection Officer (see Section 13). We will respond within 21 days as required by the DPA 2019.
8. Data Retention
We retain personal data for the following periods, after which data is securely deleted or anonymised:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account data (active accounts) | For the duration of the account plus 3 years after closure | Legitimate interests / legal obligation |
| Licence application records (approved) | 10 years from date of issue | Statutory record-keeping requirement |
| Rejected application records | 5 years from date of final rejection | Legal obligation / audit purposes |
| Payment receipts | 7 years | Public Finance Management Act requirements |
| Audit logs | 7 years | Legal obligation / accountability |
| Technical / session data | 90 days (rolling) | Security monitoring |
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include:
- Encryption in transit — all data transmitted between your browser and our servers is encrypted using HTTPS/TLS
- Password hashing — passwords are stored using bcrypt, a one-way cryptographic hash function; we never store passwords in plain text
- Access controls — role-based access ensures that officers can only access data relevant to their function; all officer actions are logged in an audit trail
- File security — uploaded documents are stored outside the publicly accessible web directory and are not accessible by direct URL
- Session security — sessions are protected with CSRF tokens, secure session identifiers, and an idle timeout of 30 minutes
- Two-factor authentication — available to all users as an additional layer of account security
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner within 72 hours in accordance with Section 43 of the DPA 2019, and will notify affected data subjects without undue delay where required.
10. International Data Transfers
Your personal data is stored and processed within the Republic of Kenya. We do not transfer your personal data to third countries outside Kenya. If this position changes, we will update this Privacy Policy and ensure that any transfer is subject to appropriate safeguards as required by Section 48 of the DPA 2019.
11. Cookies and Technical Data
The System uses the following types of cookies and similar technologies:
- Session cookies — strictly necessary to maintain your logged-in state during a browsing session. These are deleted when you close your browser.
- Security cookies — used to prevent cross-site request forgery (CSRF) attacks. These are strictly necessary for the secure operation of the System.
We do not use advertising cookies, tracking cookies, or analytics cookies from third-party services. No cookie consent banner is required for strictly necessary cookies; however, you may disable cookies in your browser settings, which will prevent you from logging in to the System.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in applicable law, our data practices, or the features of the System. The revised policy will be published on the System with an updated effective date. We will notify registered users of material changes by email or through the in-system notifications. Your continued use of the System after the effective date of any changes constitutes your acceptance of the updated policy.
13. How to Contact Us and Exercise Your Rights
To exercise your rights under the DPA 2019, or to raise a concern about how we handle your personal data, please contact:
Data Protection Officer
Department of Agriculture
County Government of Nyeri
Nyeri Town, Nyeri County, Kenya
Email: agriculture@nyeri.go.ke
14. Right to Lodge a Complaint
If you believe that we have not handled your personal data in accordance with the DPA 2019, you have the right to lodge a complaint with the supervisory authority:
Office of the Data Protection Commissioner (ODPC)
Kenya Re Towers, Upper Hill, Nairobi, Kenya
P.O. Box 30756-00100, Nairobi
Email: info@odpc.go.ke
Website: www.odpc.go.ke
We would appreciate the opportunity to address your concern directly before you approach the ODPC, so please contact us in the first instance.
Last updated: October 2026