Privacy Policy

SHENA Companion Welfare Association ("SHENA", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information provided by members, applicants, agents, and visitors of our website and services.

By registering as a member, submitting a form on our website, or otherwise interacting with our services, you consent to the practices described in this policy.

We collect the following categories of personal information:

a) Identity & Contact Information

• Full legal name (as per National ID)
• National ID number
• Date of birth and gender
• Residential address
• Phone number (M-Pesa registered)
• Email address (optional)

b) Beneficiary & Dependent Information

• Names, ID numbers, and dates of birth of registered dependents
• Relationship to the primary member

c) Financial Information

• M-Pesa transaction codes and payment references
• Contribution history and membership package tier

d) Claims & Document Data

• Death certificates, burial permits, and other legally required documents uploaded during claims
• Hospital admission letters and mortuary records

e) Technical Data

• IP addresses and browser information (for security logging only)
• Session data for authenticated member portal access

SHENA processes personal data for the following lawful purposes:

• Membership registration and management — to verify eligibility, allocate member numbers, and maintain your account
• Payment processing — to record contributions, issue receipts, and reconcile M-Pesa transactions
• Claims processing — to assess and approve Last Respect Service claims on behalf of covered members
• Service delivery — to coordinate hearse, mortuary, casket, and other funeral services for claimants
• Notifications — to send SMS and email reminders regarding contributions, policy updates, or claim status
• Compliance & governance — to meet reporting obligations under Kenyan law and welfare association governance requirements
• Security — to detect, prevent, and investigate fraud, unauthorized access, or misuse of services

We do not sell, rent, or trade your personal information to third parties for commercial purposes.

We may share information with:

• Service providers — mortuary facilities, casket suppliers, hearse service operators, and burial coordinators engaged to fulfill claims
• M-Pesa / Safaricom — for payment verification through their official API
• SMS and email providers — solely for delivering authorized notifications to members
• Legal authorities — where required by court order, warrant, or applicable Kenyan law
• SHENA agents — authorized agents accessing only the minimum information needed to support their assigned members

All third-party service providers are bound by confidentiality obligations.

We implement the following safeguards to protect your personal information:

• Passwords are stored using PHP's password_hash() with bcrypt — never stored in plain text
• Role-based access controls ensure staff see only data necessary for their duties
• All form submissions include CSRF protection tokens
• Production systems operate over HTTPS with secure session cookies
• Sensitive uploads (e.g. ID documents) are stored outside web-accessible directories
• Activity logs are maintained for audit and security review purposes

While we apply industry-standard protections, no method of electronic transmission or storage is 100% secure. We will notify affected members promptly in the event of a confirmed data breach.

• Active member data is retained for the duration of membership and for 7 years after termination (consistent with Kenyan tax and financial record requirements).
• Claim documents are retained for a minimum of 10 years to support audit and dispute resolution.
• Deceased or lapsed accounts are archived and access is restricted after 2 years of inactivity.
• Contact form submissions are retained for 12 months, then deleted.

Under applicable data protection principles, you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request that inaccurate or outdated information be corrected
• Deletion — request erasure of your data where retention is no longer legally required
• Objection — object to processing for purposes other than those listed above
• Portability — request your data in a structured, machine-readable format

To exercise any of these rights, contact us via the channels listed on the Contact page. We aim to respond to all requests within 30 days.

Membership is open to individuals aged 18 and above. Dependent children may be registered under a parent's or guardian's account; however, minors cannot independently register or access the member portal. We do not knowingly collect personal data directly from children under the age of 18 without parental consent.

Our website uses essential session cookies to maintain your login state on the member portal. We do not use third-party advertising cookies or tracking pixels. Session data expires when you log out or after the configured session timeout period.

We may update this Privacy Policy from time to time to reflect changes in our services or applicable law. The updated version will be posted on this page with a revised "Last Updated" date. Where changes are material, we will notify registered members via SMS or email.

For privacy-related enquiries, corrections, or complaints, please contact: