1. Introduction
The Institute for Social Policy (“the Institute”, “we”, “us” or “our”) is the learning arm of CHASP Advisory, based in Nairobi, Kenya. We deliver courses, training and applied learning for people working in social policy and social protection.
This policy explains what personal data we collect through this website, why we collect it, how we protect it and the rights you have over it. It is written to meet our obligations under the Kenya Data Protection Act, 2019 and, where our processing falls within its scope, the EU General Data Protection Regulation (GDPR).
Last updated: 28 September 2026
2. Who is responsible for your data
The Institute for Social Policy is the data controller for the personal data described in this policy. We are part of CHASP Advisory.
3. Information we collect
We collect only what you give us, and the limited technical information the website needs in order to work. Specifically:
- Course account details — your name, email address, password and any profile information you add.
- Learning records — the courses you enrol in, your progress and any work you submit.
- Newsletter subscriptions — your email address and your consent record.
- Enquiries — the name, email address and message you send us through a form or by email.
- Technical data — your IP address and browser information, recorded in standard server logs.
We do not buy personal data, and we do not collect sensitive personal data through this website.
4. Course accounts and learning records
If you register for a course, we create an account for you. We use it to give you access to your course materials, record your progress, issue any certificate you earn, and contact you about the course you are taking.
Your learning records are visible to you and to the Institute staff and instructors who administer your course. They are not shared with other learners or with third parties except as described in section 9.
You can view and update your account details at any time when signed in, or ask us to correct or delete them.
5. Newsletter and email updates
If you subscribe to our updates, we record your email address and your consent. Subscriptions are managed through Mailchimp (Intuit Inc.), which stores subscriber data on servers in the United States — see section 9 on international transfers.
Every email we send includes an unsubscribe link, and you can withdraw your consent at any time. We do not use newsletter data for any other purpose, and we do not sell or rent our mailing list.
6. Enquiries and forms
When you send us a message through a form on this website, the content of that message and the contact details you provide are delivered to an Institute email address so that we can reply.
We keep enquiries only for as long as we need them to answer you and to keep a record of our correspondence. They are not added to our mailing list unless you separately ask to subscribe.
7. Cookies
This website uses very few cookies. We do not run advertising trackers or analytics profiling on this site.
- Session and preference cookies — needed for the site to function and to keep you signed in while you are taking a course.
- WordPress settings cookies — set only for signed-in users, to remember interface preferences.
You can control or delete cookies through your browser settings. Blocking them may stop parts of the site, including course access, from working.
8. Why we use your data, and our lawful basis
- Delivering courses and managing your account — performance of a contract with you.
- Replying to your enquiries — our legitimate interest in responding to people who contact us.
- Sending newsletters and updates — your consent, which you may withdraw at any time.
- Keeping the site secure and working — our legitimate interest in running a safe service.
- Meeting tax, audit and legal obligations — compliance with a legal obligation.
9. Sharing and international transfers
We do not sell your personal data and we do not share it for advertising. We share it only with:
- service providers who host this website and deliver our email, acting under contract and on our instructions;
- instructors and Institute staff who administer the course you are enrolled in;
- professional advisers, regulators, courts or law enforcement where we are required by law.
Some of these providers — including Mailchimp — are based outside Kenya, mainly in the United States and the European Union. Where we transfer personal data out of Kenya we do so in line with sections 48 and 49 of the Data Protection Act, 2019, relying on appropriate safeguards, your consent, or the necessity of the transfer to perform a contract. Where the GDPR applies, transfers outside the European Economic Area are made under an adequacy decision or standard contractual clauses.
10. How long we keep it, and how we protect it
- Course accounts and learning records — for as long as your account is active, and for up to 3 years afterwards so we can verify completion and reissue certificates.
- Newsletter subscriptions — until you unsubscribe.
- Enquiries — up to 24 months after our last contact with you.
- Financial records — for the period required by Kenyan tax law.
We protect your data with encrypted connections to this website, access limited to the staff whose role requires it, and confidentiality obligations in our staff and instructor contracts. No system can be guaranteed completely secure; if a breach occurs that is likely to put your rights at risk, we will notify the Office of the Data Protection Commissioner and affected individuals as the law requires.
11. Your rights, complaints and changes
Under the Data Protection Act, 2019 and, where it applies, the GDPR, you have the right to be informed about how your data is used; to access the data we hold about you; to have inaccurate data corrected; to ask us to delete data we no longer have a reason to keep; to object to processing based on our legitimate interests; to ask us to restrict processing; to receive your data in a portable format; and to withdraw consent at any time.
To exercise any of these rights, email theinstitute@chasp.ke. We may need to verify your identity first, and we will respond within the timeframes set by law.
If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (Kenya) at www.odpc.go.ke. If you are in the European Economic Area or the United Kingdom, you may complain to your national supervisory authority.
We may update this policy from time to time. The date at the top of this page shows when it was last revised.