Privacy Policy

Last updated: 5 August 2026

This policy explains what personal data the Kenya American Football Federation collects through americanfootballinkenya.com, why we collect it, who else can see it, and what you can do about it. We have tried to write it in plain language rather than legal boilerplate.

Who we are

The Kenya American Football Federation ("KFAF", "we", "us") is the governing body for American football in Kenya. We operate this website and are the data controller for the personal data described below.

You can reach us at info@kenyanfl.com or through our contact page.

What we collect when you choose to give it

Newsletter subscription

If you subscribe we store your email address. It is saved in our own database and also sent to Mailchimp, the service we use to send the newsletter. We use it only to send you KFAF news. Every newsletter includes an unsubscribe link.

Contact form

We store the name, email address, phone number, subject and message you submit, so we can reply and keep a record of the conversation.

Match ticket requests

When you request tickets for a fixture we store your name, email address, phone number, the number of tickets requested and any message you add. We use this to arrange your tickets and to contact you about that match. You receive a confirmation email, and our ticketing team is notified.

Players, coaches and officials

If you register with an affiliated club we hold the registration details that club submits to us — typically name, contact details, identification number and a profile photograph — for the purpose of running competitions, verifying eligibility and meeting safeguarding obligations. This data is not published on this website.

What we collect automatically

Article view counts

When you read a news article, knowledge base entry or resource, we record that it was read, so we can see which content is useful and stop producing what nobody reads.

To count each reader only once per day, we take your IP address, combine it with a secret key held only on our server, and store only the resulting one-way hash. Your actual IP address is never written to our database and cannot be worked backwards out of what we store — including by us. We also record the date, whether the request came from a mobile device, and the website that linked you to us, if any.

Before your IP address is hashed away, we use it to look up which country you are in, and store only the two-letter country code. This tells us whether our readers are in Kenya, the region or the diaspora. Country is the most precise location we keep — we do not record your city, your coordinates, or anything that could identify where you are. The lookup is done on our own server against an offline database, so your address is not sent to any location service.

Country lookups use the GeoLite2 database created by MaxMind, which incorporates GeoNames data made available under the Creative Commons Attribution 4.0 licence.

We do not use Google Analytics or any similar third-party tracking service, and we do not build profiles of individual readers.

Server logs

Like any website, our web server keeps standard access logs, which include IP addresses. These are used for security and diagnosing faults.

Cookies

We use three cookies, all of them our own. None are advertising cookies.

• csrftoken — a security cookie that protects forms on this site against cross-site request forgery. Essential.
• sessionid — keeps you signed in, if you have an account on this site. Essential, and only set when you log in.
• kfaf_cookie_notice — remembers that you have seen the cookie notice so we stop showing it. Expires after one year.

Other companies your browser contacts

Some parts of this site are loaded from other companies' servers. When that happens, those companies can see your IP address and which page you were on, under their own privacy policies rather than ours.

• Google Fonts — the site's typefaces are loaded from fonts.googleapis.com and fonts.gstatic.com on every page.
• Cloudflare (cdnjs) and jsDelivr — icon and layout files are loaded from their content delivery networks on every page.
• jQuery (code.jquery.com) — a script library loaded on every page.
• YouTube — where we show match highlights, the thumbnail images are loaded from YouTube when the page opens. The video player itself is not loaded until you click play, so YouTube does not set its cookies unless you choose to watch a video.

How long we keep it

• Article view records: deleted automatically after 180 days. The total view count shown on an article is a running tally, kept indefinitely, but it is only a number and is not linked to anyone.
• Newsletter subscriptions: until you unsubscribe.
• Contact messages and ticket requests: kept while they are operationally useful, then deleted.
• Registration records: kept for as long as you are registered, and afterwards where competition or safeguarding records require it.

Who we share it with

We do not sell your personal data, and we do not share it with third parties for their own marketing. We share it only with:

• Mailchimp, which delivers our newsletter on our behalf;
• our hosting and email providers, which process data as part of running the site;
• competition partners or authorities, where we are required to for eligibility, safeguarding or by law.

Some of these providers are based outside Kenya, which means your data may be stored or processed abroad.

Children and young people

We run youth programmes and tryouts. Where we collect data about anyone under 18, we do so through their club with the consent of a parent or guardian, and we apply our safeguarding policy to it. This website is not designed to collect data directly from children.

Your rights

Under Kenya's Data Protection Act 2019 you have the right to be told how your data is used, to get a copy of the data we hold about you, to have inaccurate data corrected, to have your data deleted, to object to how we use it, and to withdraw consent at any time. To exercise any of these, email info@kenyanfl.com.

One honest limitation: because article view records are stored as irreversible hashes, we genuinely cannot identify which of them relate to you, so we cannot retrieve or delete them individually. They delete themselves after 180 days.

If you are not satisfied with how we have handled your data, you can complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

Changes to this policy

If we change how we handle your data we will update this page and the date at the top. Significant changes will be announced through our newsletter.