Your privacy, dignity and trust matter to us.

This Privacy Policy explains how Kuwongola Initiative collects, uses, stores, shares and protects personal information when you:

• Visit or use this website;
• Contact us through an online form, email, telephone or WhatsApp;
• Subscribe to news, stories, opportunities or organisational updates;
• Apply for a vacancy, internship, consultancy or volunteer opportunity;
• Submit a supplier, partnership, quotation or request-for-quotation response;
• Access resources through our online library;
• Make, confirm or enquire about a donation; or
• Otherwise interact with our programmes, services or personnel.

By submitting information through this website, you acknowledge that it will be handled in accordance with this Policy and applicable laws in Malawi.

The information we collect depends on how you interact with us.

2.1 Contact and enquiry information

• Name, email address, telephone or WhatsApp number;
• Subject, message and nature of the enquiry;
• Any other information voluntarily included in the submission.

2.2 Newsletter and subscription information

• Name and email address, where requested;
• Subscription date, status and communication preferences;
• Unsubscribe requests and related administrative records.

2.3 Volunteer application information

• Full name, country of residence, age and gender;
• Email address, telephone number and WhatsApp contact;
• Occupation, field of study, skills, experience and languages;
• Preferred volunteering mode, team, availability, time zone and duration;
• Motivation statement, professional links and any supporting documents;
• Curriculum vitae, résumé or portfolio where uploaded.

2.4 Recruitment and opportunity applications

• Identity and contact information;
• Education, employment history, qualifications and professional experience;
• References, cover messages, CVs and supporting documents;
• Information required to assess suitability for the opportunity.

2.5 Supplier, RFQ and partnership information

• Contact person and organisation or company details;
• Proposal, quotation, service, supplier or partnership information;
• Supporting documents and correspondence concerning the submission.

2.6 Donation-related information

• Donor name and contact details;
• Donation amount, date, method and transaction reference;
• Purpose or designation of the donation;
• Information required for acknowledgement, reconciliation, reporting or receipt preparation.

2.7 Website and library usage information

• Internet Protocol address, browser, device and operating-system information;
• Date and time of access, pages viewed and referring page;
• Website errors, security events and general usage data;
• The number of times a library resource is opened or viewed.

Where reasonably possible, website and library statistics are used in aggregated or anonymised form.

The website may use essential cookies or session identifiers required for security, administrative logins, form protection, user preferences and normal website functionality.

We do not use essential cookies to create advertising profiles. Should non-essential analytics, advertising or tracking technologies be introduced, this Policy and the website's consent controls will be updated.

You may manage or delete cookies using your browser settings. Disabling essential cookies may prevent some parts of the website from working correctly.

We may use personal information to:

• Respond to enquiries, feedback, complaints and requests;
• Review and manage volunteer, employment, internship and consultancy applications;
• Assess quotations, RFQ responses, supplier submissions and partnership proposals;
• Communicate about programmes, services, events and opportunities;
• Manage volunteers, applicants, donors, suppliers, partners and supporters;
• Send communications that you requested or subscribed to receive;
• Process, acknowledge and reconcile donations;
• Maintain financial, administrative, programme and accountability records;
• Produce internal, donor, audit and programme reports;
• Operate and improve the online library and website;
• Prevent spam, fraud, misuse and unauthorised access;
• Investigate security incidents or complaints;
• Comply with applicable legal, regulatory and contractual requirements; and
• Protect the rights, safety and legitimate interests of the organisation and its stakeholders.

We will not use personal information for a materially incompatible purpose unless there is an appropriate lawful basis or additional consent has been obtained.

Depending on the circumstances, we may process personal information on one or more of the following grounds:

• Consent: where you voluntarily agree to a specific use of your information.
• Steps requested by you: where processing is necessary to respond to an application, proposal, enquiry, donation or request.
• Performance of an agreement: where information is required to manage an established relationship.
• Legal obligation: where information must be processed or retained to comply with applicable law.
• Legitimate organisational interests: where processing is reasonably necessary for administration, security, record keeping, programme improvement, communication or fraud prevention and does not unfairly override your rights.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal will not affect processing that was lawful before the withdrawal.

We send newsletters, stories, announcements or promotional updates where you have subscribed, requested the information or where another lawful basis permits the communication.

You may unsubscribe through the link included in a general mailing or by contacting us. Unsubscribing from general updates does not prevent us from sending necessary administrative messages concerning an application, donation, request, agreement or ongoing relationship.

We may retain limited suppression information after an unsubscribe request to help ensure that the address is not accidentally added back to a mailing list.

Kuwongola Initiative does not sell or rent personal information.

Information may be disclosed where reasonably necessary to:

• Authorised staff, board members, volunteers or administrators who require access for their duties;
• Personnel responsible for recruitment, volunteer management, procurement, finance or programmes;
• Website hosting, email delivery, backup, document storage and technical-support providers;
• Banks, mobile-money services or online payment providers involved in donations;
• Auditors, accountants, legal advisers and other professional advisers;
• Donors or programme partners where reporting is required, normally using aggregated or anonymised information;
• Regulators, courts, law-enforcement bodies or public authorities where disclosure is legally required;
• An organisation involved in a lawful restructuring or programme transfer, subject to appropriate safeguards.

Anyone given access to personal information must use it only for an authorised purpose and protect its confidentiality.

The website may link to payment providers, social-media platforms, partner websites or other external services. Those organisations may process information according to their own privacy policies and terms.

Kuwongola Initiative is not responsible for the privacy, security or content practices of independent third-party websites. You should review their privacy information before submitting personal or payment information.

Some hosting, email, backup, payment or communication providers may process information on systems located outside Malawi.

Where personal information is transferred internationally, reasonable steps will be taken to ensure that the transfer is lawful, the recipient provides appropriate protection, information is used only for the authorised purpose and suitable contractual, organisational or technical safeguards are applied.

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, unlawful disclosure, alteration, accidental loss, destruction, malware and other misuse.

Measures may include:

• Restricted and password-protected administrative access;
• Authentication, session controls and form-protection measures;
• File-upload restrictions and validation;
• Access controls for submitted documents and administrative records;
• Secure server configuration, backups and security rules;
• Confidentiality obligations and periodic access reviews.

No internet transmission or electronic storage system can be guaranteed to be completely secure. Users should avoid submitting unnecessary highly sensitive information through general website forms.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, financial, safeguarding, reporting, audit and accountability obligations.

• Contact enquiries: normally up to 24 months after the matter is concluded.
• Unsuccessful volunteer or recruitment applications: normally up to 12 months after the selection process, unless a longer period is agreed.
• Successful applicants and active volunteers: for the relationship and any additional legally or operationally required period.
• Supplier, RFQ and partnership records: for the process and applicable procurement, audit and record-keeping periods.
• Donation and financial records: for applicable accounting, tax, audit and donor-reporting periods.
• Newsletter records: until the subscriber unsubscribes or the list becomes inactive, subject to limited suppression records.
• Security logs: for a limited operational and security period.
• Anonymised statistics: may be retained for historical reporting because they no longer directly identify a person.

Information may be retained longer where required for an investigation, dispute, safeguarding issue, legal claim, audit or lawful instruction. When no longer required, information will be securely deleted, anonymised or destroyed.

Our programmes and educational resources may serve children and young people. However, application, donation, supplier, subscription and general contact forms should normally be completed by adults or by young people with appropriate parent or guardian involvement.

Children should not submit personal information, photographs, CVs or other documents without the knowledge and assistance of a parent, guardian or responsible adult.

Where we need to collect information concerning a child, appropriate consent, safeguarding procedures and data-protection measures will be applied. A parent or guardian who believes that a child submitted information without appropriate permission should contact us for review and, where appropriate, deletion.

We may publish photographs, videos, testimonials and stories about programmes and community activities. Identifiable content will be published only where there is an appropriate lawful basis, authorisation or consent.

For children, appropriate permission should be obtained from a parent, guardian or authorised responsible person, together with the child's agreement where appropriate.

Consent for public communications may be withdrawn, although it may not always be possible to remove material already printed, lawfully archived or independently shared by third parties.

We do not intend to make recruitment, volunteer, supplier, partnership or service decisions solely through automated processing.

Applications and submissions are reviewed by authorised personnel. Security tools may automatically identify spam, suspicious activity or potentially harmful submissions, but significant organisational decisions should involve human review.

Subject to applicable law and the circumstances of the request, you may have the right to:

• Ask whether we hold personal information about you;
• Request access to or a copy of your information;
• Request correction of inaccurate or incomplete information;
• Request deletion of information that is no longer required;
• Request restriction of certain processing activities;
• Object to certain uses of your information;
• Request portability of information provided electronically;
• Withdraw consent where processing is based on consent;
• Object to direct-marketing communications;
• Raise a concern about how your information has been handled; and
• Lodge a complaint with the competent data-protection authority in Malawi.

These rights may be subject to lawful limitations. For example, some information may need to be retained for financial, safeguarding, contractual or legal reasons.

To protect your information, we may request reasonable proof of identity before responding to a request.

If we become aware of a personal data breach, we will take reasonable steps to investigate, contain and correct the incident, reduce possible harm, recover or secure affected information, review relevant controls and notify affected persons or authorities where required by law.

Privacy questions or complaints should first be submitted to us using the contact details below. We will review the concern and communicate the outcome or the steps being taken.

You may also lodge a complaint with the competent data-protection authority in Malawi where you believe your information has been processed unlawfully or your rights have not been respected.

We may update this Policy when website services, forms, programmes, data-handling practices, service providers or legal requirements change.

The revised version will be published on this page with an updated effective date. Material changes may also be communicated through the website or other appropriate channels.

For privacy questions, access requests, corrections, withdrawals of consent or complaints, please contact us: