Last Updated: 2 September 2026
1. Introduction
galck+ respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains how galck+ (“galck+”, “we”, “us”, or “our”) collects, uses, stores, protects, shares, and otherwise processes personal data when you:
visit galck.org or other websites operated by galck+;
contact us;
subscribe to our communications;
make a donation;
apply for membership, partnership, employment, volunteering, or other opportunities;
participate in galck+ programmes, activities, surveys, research, events, advocacy initiatives, or community programmes;
access counselling, therapy, mental-health or wellbeing services facilitated by galck+;
use an online portal, appointment booking platform or other digital service provided by galck+; or
otherwise interact with us.
galck+ is committed to handling personal information lawfully, fairly, transparently and with particular care for information that could expose LGBTQ+ individuals or other members of our communities to discrimination, stigma, harassment or harm.
This Privacy Policy should be read together with our Terms of Service and any additional privacy notice or consent form provided for a particular programme, research activity, service or event.
2. Who We Are
galck+ is an LGBTQ+ rights organisation and coalition operating in Kenya.
Our mission includes advancing and defending the human rights, safety and wellbeing of LGBTQ+ people through advocacy, community support, policy engagement, movement building and coordinated action.
For purposes of applicable data protection laws, galck+ may act as a data controller when we determine why and how personal data is processed.
Our contact details are:
galck+
P.O. Box 13005 – 00100
Nairobi, Kenya
Email: info@galck.org
Telephone: +254 20 242 6060
Website: galck.org
3. Applicable Data Protection Law
We process personal information in accordance with applicable Kenyan laws, including the Data Protection Act, 2019, the Data Protection (General) Regulations, and other applicable regulations, rules and legal requirements.
Where another country’s data protection law applies to a particular activity, we will take reasonable steps to comply with the applicable requirements.
4. Personal Information We May Collect
The information we collect depends on how you interact with galck+.
4.1 Identification and Contact Information
We may collect information such as:
first and last name;
email address;
telephone number;
postal address;
organisation;
job title;
preferred method of communication; and
other contact information you voluntarily provide.
4.2 Membership and Organisational Information
Where you or your organisation applies for or participates in galck+ membership, networks, programmes or partnerships, we may collect:
organisation name;
registration information;
geographic area of operation;
representatives and contact persons;
programme information;
membership records;
organisational profiles;
application information; and
communications relating to membership or partnership.
4.3 Therapy, Counselling and Wellbeing Information
If you access therapy, counselling, wellbeing or mental-health services facilitated through galck+, we may collect information necessary to provide or administer those services.
This may include:
your name and contact information;
appointment dates and times;
therapist or counsellor assignment;
attendance information;
service-use information;
information you voluntarily provide when requesting support;
information necessary for safeguarding;
relevant health or wellbeing information; and
other information necessary for the provision or administration of the service.
Information disclosed during a therapy or counselling session may be subject to separate professional confidentiality requirements and professional obligations applicable to the therapist or counsellor providing the service.
We seek to limit galck+’s administrative access to therapy information to what is reasonably necessary to operate, protect, evaluate and improve the service.
4.4 Sensitive Personal Information
Because of the communities and programmes we serve, information provided to galck+ may sometimes reveal sensitive characteristics or circumstances, including information relating to:
sexual orientation;
gender identity or expression;
sex characteristics;
health or mental health;
HIV or other health status;
experiences of discrimination or violence;
disability;
family or relationship circumstances;
ethnicity or other protected characteristics; or
other information considered sensitive under applicable law.
We recognise that disclosure of this information may expose individuals to heightened risks.
We therefore seek to collect sensitive information only when necessary and to apply appropriate safeguards.
Where consent is required for processing sensitive information, we will seek appropriate consent.
4.5 Donations and Payment Information
When you make a donation, we may collect:
donor name;
email address;
telephone number;
donation amount;
transaction reference;
payment method;
date and time of payment;
payment status; and
information necessary to issue receipts or meet accounting and reporting obligations.
Online card, PayPal and mobile-money transactions may be processed by third-party payment providers.
galck+ generally does not need to receive or store complete payment-card details when payments are processed directly through an authorised payment provider.
For offline donations, we may use your contact information to provide our bank payment details and to confirm or reconcile your donation.
4.6 Communications
If you contact us, we may maintain records of:
emails;
contact-form submissions;
correspondence;
enquiries;
complaints;
requests for support; and
other communications with galck+.
4.7 Newsletter and Marketing Information
If you subscribe to our newsletter or other communications, we may collect:
your email address;
subscription preferences;
communication history; and
engagement information where provided by our email platform.
You may unsubscribe from non-essential promotional communications at any time.
4.8 Applications and Opportunities
If you apply for a job, consultancy, internship, volunteer position or other opportunity, we may collect:
name and contact information;
curriculum vitae;
education and professional information;
employment history;
references;
portfolio information;
interview records; and
other information you provide during an application process.
4.9 Research, Surveys and Advocacy
Where you participate in research, surveys, consultations, interviews, focus groups or advocacy initiatives, we may collect information relevant to that activity.
Where appropriate, we will provide additional information explaining:
what information is being collected;
why it is being collected;
how it will be used;
whether participation is voluntary;
whether the information will be anonymised;
who may receive the information; and
how you may withdraw where withdrawal is possible.
Research information may be anonymised or aggregated before publication wherever reasonably appropriate.
4.10 Technical and Website Information
When you use our website, our systems or service providers may automatically collect information such as:
IP address;
browser type;
device type;
operating system;
pages visited;
referring website;
approximate location derived from an IP address;
date and time of access;
cookies or similar identifiers;
website interactions; and
security and diagnostic information.
We use this information primarily for website operation, security, analytics and improvement.
5. Information We Ask You Not to Submit Unnecessarily
Because of the sensitivity of the communities we serve, please avoid submitting highly sensitive information through general contact forms, newsletter forms or other public-facing website forms unless the information is necessary for your request.
Where galck+ provides a dedicated secure service or portal, please use that channel for sensitive information whenever possible.
6. How We Collect Information
We may collect information:
directly from you;
through galck+ websites and forms;
through therapy or appointment platforms;
through payment processors;
during programmes, events and meetings;
through surveys or research activities;
through member organisations or partners where lawful;
through publicly available sources;
through referrals;
from service providers acting on our behalf; or
automatically through website technologies such as cookies.
7. How We Use Personal Information
We may process your information to:
7.1 Provide Services
We may use information to:
respond to enquiries;
provide community services;
facilitate counselling and therapy appointments;
administer programmes;
communicate with service users;
manage memberships;
coordinate activities with member organisations;
manage events;
provide resources; and
deliver other services requested from galck+.
7.2 Protect Community Members
Where appropriate and lawful, information may be processed for:
safeguarding;
responding to security concerns;
preventing abuse;
responding to emergencies;
protecting individuals from serious harm; and
maintaining safe galck+ programmes and platforms.
7.3 Process Donations
We may process donor information to:
process or verify donations;
reconcile payments;
issue confirmations or receipts;
maintain financial records;
meet audit requirements;
comply with donor reporting obligations where applicable; and
prevent fraudulent transactions.
7.4 Communicate With You
We may use your information to:
respond to messages;
provide requested information;
send administrative messages;
provide programme updates;
communicate regarding appointments;
send newsletters where you have subscribed; and
provide other communications you have requested.
7.5 Improve Our Work
We may analyse information to:
understand programme use;
measure impact;
improve accessibility;
improve our website and services;
identify community needs;
perform statistical analysis; and
plan future programmes.
Where reasonably possible, aggregated or anonymised information will be used for these purposes.
7.6 Advocacy and Research
Where lawful and appropriate, information may be used for:
research;
policy development;
human-rights advocacy;
publications;
reports;
programme evaluations; and
community needs assessments.
We will take particular care before publishing information capable of identifying individuals.
7.7 Security and Legal Compliance
We may process information to:
protect our website and information systems;
detect fraud or misuse;
investigate security incidents;
establish, exercise or defend legal claims;
comply with lawful orders;
comply with regulatory obligations; and
meet legal, accounting, governance and audit requirements.
8. Legal Grounds for Processing
Depending on the activity, galck+ may process personal information because:
you have given consent;
processing is necessary to provide a service you requested;
processing is necessary to fulfil an agreement with you;
processing is required by law;
processing is necessary to protect vital interests;
processing is necessary for legitimate activities undertaken by galck+ with appropriate safeguards;
processing is necessary for legitimate organisational interests that do not override your rights and freedoms; or
another lawful ground under applicable law applies.
Where sensitive personal data is involved, we apply additional legal requirements and safeguards.
Health-related information will be handled in accordance with applicable data protection law and relevant professional confidentiality obligations.
9. Consent
Where we rely on consent, your consent should be freely given, specific and informed.
You may withdraw consent at any time.
Withdrawal of consent does not make processing that occurred before withdrawal unlawful.
There may also be circumstances where galck+ may continue processing certain information after consent is withdrawn because another legal obligation or lawful ground requires or permits us to retain it.
10. Children’s Information
galck+ services are primarily intended for adults unless a particular programme expressly includes children or persons under 18.
Where we process information concerning a child, we will seek to apply appropriate safeguards and comply with applicable requirements regarding parental or guardian authority, consent, safeguarding and the child’s best interests.
We do not knowingly seek to collect children’s personal information through general website functions where it is not necessary.
11. Cookies and Similar Technologies
Our website may use cookies or similar technologies.
Cookies may be used to:
enable essential website functions;
maintain security;
remember preferences;
understand website performance;
identify technical problems;
measure website traffic; and
improve user experience.
Some cookies may be provided by third-party services incorporated into our website.
Where required, non-essential cookies will be used based on appropriate consent.
You can also manage cookies using your browser settings, although disabling certain cookies may affect website functionality.
12. Third-Party Payment Services
Donations may be processed through external providers such as Paystack, mobile-money providers, PayPal, banks or other financial-service providers.
When you use a third-party payment service, that provider may independently collect and process your payment information according to its own privacy policy and legal obligations.
galck+ is not responsible for the independent privacy practices of a third-party payment provider, although we seek to work with reputable service providers.
13. Google Calendar Integration
Therapists may voluntarily connect their Google Calendar account to galck+ to manage therapy availability and appointments. The connection uses Google OAuth 2.0 and can be disconnected by the therapist at any time.
13.1 Google Information We Access
When a therapist connects Google Calendar, galck+ accesses or processes:
the email address and basic account identity associated with the connected Google account;
the names, identifiers and access permissions of calendars available to the therapist;
free and busy time information used to identify scheduling conflicts;
information about calendar events required to synchronise galck+ availability and appointments;
identifiers for events created or managed through galck+;
Google Meet conferencing information generated for therapy appointments;
the OAuth permissions granted by the therapist; and
connection, verification, synchronisation and error information.
The Calendar permissions granted to galck+ may technically allow the application to view and edit events on calendars available to the therapist. galck+ uses this access only to provide the Calendar integration described in this section.
13.2 How We Use Google Calendar Information
galck+ uses Google Calendar information to:
confirm which Google account has been connected;
allow a therapist to select an appointment calendar;
create or identify a dedicated galck+ appointments calendar;
compare proposed availability with existing free and busy periods;
reduce the risk of double booking;
place availability reservations on the therapist’s calendar;
create, update or remove calendar events when appointments are booked, rescheduled, completed or cancelled;
generate and provide Google Meet links for confirmed therapy appointments;
synchronise upcoming appointments; and
diagnose connection or synchronisation failures.
When checking scheduling conflicts, galck+ uses free and busy information rather than displaying unrelated event titles or descriptions to other galck+ users.
galck+ is designed not to place participant names, security-case details, clinical notes or confidential therapy-session records in Google Calendar event titles or descriptions. Calendar events may include the appointment date and time, a galck+ appointment reference, a neutral event description and a Google Meet link.
13.3 Storage and Protection
galck+ stores the connected Google account email address, a protected lookup value for the account, the selected calendar name and identifier, OAuth access and refresh tokens, granted permissions, event identifiers, connection timestamps and synchronisation status where required to operate the integration.
OAuth tokens, Google account information, calendar identifiers, calendar names and other sensitive connection information are encrypted or otherwise protected where appropriate. Access is restricted to authorised system processes and personnel with a legitimate operational need.
Google OAuth client secrets are maintained as protected system credentials and are not disclosed to therapists, participants or other users.
13.4 Sharing and Transfer
galck+ does not sell Google user data or use it for advertising, profiling or unrelated marketing.
Information is transmitted to Google where necessary to authenticate the therapist, access Google Calendar services, create Google Meet links and synchronise calendar events.
Google information may also be processed by service providers supporting galck+ hosting, security and system operation, but only where necessary to provide the service and subject to appropriate confidentiality, security and data-processing obligations. Information may also be disclosed where required by applicable law.
galck+’s use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
galck+ personnel do not access Google Calendar content except where access is necessary to provide or secure the integration, investigate a technical or security issue, comply with applicable law, or provide support requested by the connected therapist.
13.5 Retention, Disconnection and Deletion
Google Calendar access is retained only while required to provide the integration or until the therapist disconnects the account, revokes access or the connection expires.
A therapist may disconnect Google Calendar through the Calendar Integration page in galck+ or revoke access through their Google Account permissions.
When a therapist disconnects Google Calendar, galck+ attempts to revoke the Google authorisation and removes the active access token, refresh token and selected calendar details from the active connection. Limited connection history, account identifiers, audit information, event identifiers and appointment records may be retained where necessary for security, accountability, service administration or legal obligations.
Calendar events already created in the therapist’s Google Calendar may remain after disconnection and can be reviewed or deleted by the therapist directly in Google Calendar.
A therapist may request deletion of eligible retained Google connection information by contacting info@galck.org. Requests will be handled subject to applicable legal, safeguarding, security and record-retention requirements.
14. When We May Share Personal Information
We do not sell personal information.
We may disclose information where reasonably necessary to:
service providers working on our behalf;
website and hosting providers;
payment processors;
email and communications providers;
IT and cybersecurity providers;
professional advisers;
auditors;
therapists, counsellors or healthcare professionals involved in providing a requested service;
research partners where appropriate safeguards exist;
member organisations or programme partners where disclosure is necessary and lawful;
authorities where legally required; or
other parties where you have authorised the disclosure.
Third parties processing personal information on our behalf are expected to process it only for authorised purposes and apply appropriate privacy and security protections.
15. Confidentiality and LGBTQ+ Community Safety
galck+ recognises that information revealing or suggesting a person’s sexual orientation, gender identity, gender expression, sex characteristics, health condition or association with LGBTQ+ organisations may carry significant personal and security risks.
We therefore aim to apply heightened confidentiality protections to such information.
We will not intentionally disclose an individual’s LGBTQ+ identity, health information or similar sensitive information to family members, employers, organisations, authorities, media organisations or other third parties simply because they request it.
Any disclosure must have an appropriate lawful basis and must comply with applicable legal obligations.
Where legally permissible, galck+ will consider the safety and privacy implications of a disclosure request before releasing sensitive information.
16. International Transfers
Some technology providers used by galck+ may store or process information outside Kenya.
Where personal information is transferred outside Kenya, galck+ will seek to ensure that the transfer complies with applicable data protection requirements.
Depending on the circumstances, safeguards may include:
contractual protections;
appropriate technical safeguards;
transfers to jurisdictions with adequate protections;
consent where legally appropriate; or
another lawful transfer mechanism.
We take additional care when transferring sensitive personal information.
17. Information Security
galck+ takes reasonable administrative, organisational and technical measures to protect personal information against:
unauthorised access;
accidental loss;
unlawful disclosure;
alteration;
destruction;
misuse; and
cyber threats.
Measures may include:
access controls;
password protections;
restricted administrative privileges;
encryption where appropriate;
backups;
secure hosting;
confidentiality obligations;
staff awareness;
monitoring;
software updates; and
security incident procedures.
No internet-based service or information system can be guaranteed to be completely secure.
18. Personal Data Breaches
Where galck+ becomes aware of a personal-data breach, we will assess the incident and take appropriate steps to contain, investigate and mitigate the breach.
Where notification to the Office of the Data Protection Commissioner or affected individuals is required by law, galck+ will seek to make the required notification within the applicable legal period.
Particular attention will be paid to incidents that could expose LGBTQ+ community members, therapy users or other vulnerable persons to discrimination, violence, harassment or other harm.
19. Data Retention
We do not intend to keep identifiable personal information indefinitely.
Retention periods depend on:
why the information was collected;
the sensitivity of the information;
programme requirements;
professional requirements;
financial and auditing obligations;
donor requirements;
legal obligations;
safeguarding requirements; and
whether information is needed to establish, exercise or defend legal claims.
When identifiable information is no longer reasonably required, we may securely delete, destroy, anonymise or aggregate it.
Therapy and health-related records may be retained in accordance with applicable professional, clinical, contractual and legal requirements.
Donation and financial records may be retained for periods required by applicable accounting, tax, audit, donor or legal obligations.
20. Anonymised and Aggregated Information
galck+ may create statistical, anonymised or aggregated information from information collected through our programmes and services.
Where information has been genuinely anonymised so that individuals can no longer reasonably be identified, it may be used for research, reporting, planning, advocacy, funding applications and programme evaluation.
We seek to ensure that small datasets or combinations of information do not inadvertently reveal the identity of vulnerable individuals.
21. Your Data Protection Rights
Subject to applicable law and any lawful limitations, you may have the right to:
be informed about how your personal information is used;
request access to personal information held about you;
request correction of inaccurate or misleading information;
object to certain processing;
request deletion of information in appropriate circumstances;
withdraw consent where processing is based on consent; and
exercise other rights provided under applicable data protection law.
Requests can be submitted to:
We may need to verify your identity before acting on a request.
We may also need to retain certain information despite a request for deletion where retention is required or permitted by law.
22. Complaints
If you have concerns about how galck+ handles your personal information, please contact us first so that we can investigate the issue.
You may contact:
galck+
P.O. Box 13005 – 00100
Nairobi, Kenya
Email: info@galck.org
Telephone: +254 20 242 6060
You may also have the right to lodge a complaint with Kenya’s Office of the Data Protection Commissioner (ODPC).
23. Third-Party Websites
Our website may contain links to websites operated by partner organisations, social-media services, payment providers, publications or other third parties.
galck+ does not control the privacy practices of independent third-party websites.
You should review the privacy policies of those services before providing them with personal information.
24. Social Media
If you interact with galck+ through social-media platforms, both galck+ and the relevant platform may receive information relating to that interaction.
Your use of a social-media platform is also governed by that platform’s privacy practices and terms.
Please avoid sharing confidential or highly sensitive personal information publicly through comments, posts or public social-media messages.
25. Photography, Video and Stories
galck+ may photograph, film or document events, activities, programmes and community stories.
Where a person’s identity or story could create privacy or safety risks, galck+ will seek to apply appropriate consent and safeguarding procedures.
Consent to participate in a galck+ programme does not automatically constitute consent for galck+ to publicly disclose sensitive personal information.
Where specific consent is required for photography, video, testimonials or personal stories, that consent should be obtained separately.
26. Changes to this Privacy Policy
We may update this Privacy Policy when our services, technology, legal obligations or data practices change.
The date at the top of this policy indicates when it was last updated.
Where changes materially affect how we handle sensitive information, we may take additional reasonable steps to inform affected users.
27. Contact Us
Questions, complaints and requests relating to this Privacy Policy or galck+’s handling of personal information may be sent to:
galck+
P.O. Box 13005 – 00100
Nairobi, Kenya
Email: info@galck.org
Telephone: +254 20 242 6060
Website: galck.org