Privacy Policy

1. Introduction & Who We Are

Thrive Line Connections ("we", "us", "our") operates the website thrivelineconnections.com and the Thrive Line Mentees Portal (the "Platform"). We are committed to protecting the privacy of all users, including mentees, mentors, and visitors, in accordance with the Kenya Data Protection Act, 2019 (DPA 2019), the EU General Data Protection Regulation (GDPR) where applicable, and other relevant international data protection frameworks.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data. By accessing the Platform or creating an account, you agree to the terms of this Policy.

2. Data We Collect

3. Legal Basis for Processing (Kenya DPA 2019 & GDPR)

We only process your personal data where we have a lawful basis to do so:

• Consent : where you have explicitly agreed, e.g., marketing communications or optional profile data
• Contract performance : to operate your account and deliver social impact services
• Legal obligation : to comply with Kenyan law, tax regulations, or court orders
• Legitimate interests : to improve our services, ensure platform security, and prevent fraud

4. How We Use Your Information

We use your personal data for the following purposes:

1. To register and manage your account on the Mentees Portal
2. To match mentees with suitable mentors
3. To communicate with you about your programme, sessions, and updates
4. To send newsletters or event invitations (with your consent; unsubscribe at any time)
5. To process registrations and payments for events and programmes
6. To monitor and improve platform performance and user experience
7. To comply with legal and regulatory obligations under Kenyan law
8. To detect, investigate, and prevent fraud or security incidents

5. Photography and Video at Events

At Thrive Line Connections events, we may capture photographs and video footage for promotional and archival purposes, including use on our website, social media, newsletters, and marketing materials.

By attending an event, you acknowledge you may be photographed or recorded. If you do not wish to appear in such materials, please notify us at the event or contact us at the email below, and we will make reasonable efforts to accommodate your request.

6. Sharing Your Information

We do not sell your personal data. We may share data only in the following circumstances:

• With mentors or programme coordinators as necessary to facilitate social impact matching
• With trusted service providers (e.g., email platforms, hosting, payment processors) under strict confidentiality obligations
• With regulators, courts, or law enforcement where required by law (including the Office of the Data Protection Commissioner, Kenya)
• In connection with a business merger, acquisition, or restructuring you will be notified in advance

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by Kenyan law:

• Active account data: retained for the duration of your use of the Platform plus 2 years
• Financial records: retained for 7 years per Kenyan tax law
• Event registration data: retained for 3 years after the event
• Marketing data: retained until you withdraw consent

Upon deletion of your account, we will erase or anonymise your data within 30 days, unless retention is legally required.

8. Data Security

We implement industry-standard technical and organisational security measures to protect your personal data, including:

• Encrypted data storage and HTTPS-secured data transmission
• Restricted access controls — only authorised personnel may access personal data
• Regular security audits and vulnerability assessments
• Secure login systems including password hashing

Despite these measures, no internet transmission is completely secure. You access the Platform at your own risk. In the event of a data breach, we will notify affected users and the Office of the Data Protection Commissioner (ODPC) within the timelines required by the DPA 2019.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience, analyse usage, and personalise content. Types of cookies we use:

• Essential cookies — required for Platform functionality (e.g., login sessions)
• Analytics cookies — help us understand how users interact with the Platform
• Preference cookies — remember your settings and preferences

You may disable non-essential cookies via your browser settings. Disabling essential cookies may impair Platform functionality.

10. Children's Privacy

Our Platform is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we hold data from a person under 18 without appropriate consent, we will delete it promptly. If you believe we have collected data from a minor, contact us immediately.

11. International Data Transfers

Your data may be processed in countries outside Kenya where our service providers operate. We ensure such transfers comply with the DPA 2019 and that adequate protections are in place, including standard contractual clauses or equivalent safeguards.

12. Your Rights Under the Kenya Data Protection Act 2019

As a data subject, you have the following rights:

• Right to be informed — to know how your data is collected and used
• Right of access — to request a copy of your personal data
• Right to rectification — to correct inaccurate or incomplete data
• Right to erasure — to request deletion of your data ('right to be forgotten')
• Right to restrict processing — to limit how we use your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — at any time, without affecting prior processing

To exercise any of these rights, contact us at the details below. We will respond within 30 days as required by the DPA 2019. You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

13. Third-Party Links

The Platform may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before sharing personal information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Any material changes will be communicated via email or a prominent notice on the Platform. Continued use of the Platform after changes constitutes acceptance of the updated Policy.

15. Contact Us & Data Protection Officer

For questions, requests, or concerns about this Privacy Policy or our data practices: