Privacy Policy

Last updated: 14 September 2026

1. Introduction

galck+ respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how galck+ (“galck+”, “we”, “us”, or “our”) collects, uses, stores, protects, shares, and otherwise processes personal data when you:

• visit galck.org or other websites operated by galck+;
• contact us;
• subscribe to our communications;
• make a donation;
• apply for membership, partnership, employment, volunteering, or other opportunities;
• participate in galck+ programmes, activities, surveys, research, events, advocacy initiatives, or community programmes;
• access counselling, therapy, mental-health or wellbeing services facilitated by galck+;
• use an online portal, appointment booking platform or other digital service provided by galck+; or
• otherwise interact with us.

galck+ is committed to handling personal information lawfully, fairly and transparently, and with particular care for information that could expose LGBTQ+ individuals or other members of our communities to discrimination, stigma, harassment or harm.

This Privacy Policy should be read together with our Terms of Service and any additional privacy notice or consent form provided for a particular programme, research activity, service or event.

2. Who We Are

galck+ is an LGBTQ+ rights organisation and coalition operating in Kenya.

Our mission includes advancing and defending the human rights, safety and wellbeing of LGBTQ+ people through advocacy, community support, policy engagement, movement building and coordinated action.

For purposes of applicable data protection laws, galck+ may act as a data controller when we determine why and how personal data is processed.

Our contact details are:

galck+

P.O. Box 13005 – 00100

Nairobi, Kenya

Email: info@galck.org

Telephone: +254 20 242 6060

Website: galck.org

3. Applicable Data Protection Law

We process personal information in accordance with applicable Kenyan laws, including the Data Protection Act, 2019, the Data Protection (General) Regulations, and other applicable regulations, rules and legal requirements.

Where another country’s data protection law applies to a particular activity, we will take reasonable steps to comply with the applicable requirements.

4. Personal Information We May Collect

The information we collect depends on how you interact with galck+.

4.1 Identification and Contact Information

We may collect information such as:

• first and last name;
• email address;
• telephone number;
• postal address;
• organisation;
• job title;
• preferred method of communication; and
• other contact information you voluntarily provide.

4.2 Membership and Organisational Information

Where you or your organisation applies for or participates in galck+ membership, networks, programmes or partnerships, we may collect:

• organisation name;
• registration information;
• geographic area of operation;
• representatives and contact persons;
• programme information;
• membership records;
• organisational profiles;
• application information; and
• communications relating to membership or partnership.

4.3 Therapy, Counselling and Wellbeing Information

If you access therapy, counselling, wellbeing or mental-health services facilitated through galck+, we may collect information necessary to provide or administer those services.

This may include:

• your name and contact information;
• appointment dates and times;
• therapist or counsellor assignment;
• attendance information;
• service-use information;
• information you voluntarily provide when requesting support;
• information necessary for safeguarding;
• relevant health or wellbeing information; and
• other information necessary for the provision or administration of the service.

Information disclosed during a therapy or counselling session may be subject to separate professional confidentiality requirements and professional obligations applicable to the therapist or counsellor providing the service.

We seek to limit galck+’s administrative access to therapy information to what is reasonably necessary to operate, protect, evaluate and improve the service.

4.4 Sensitive Personal Information

Because of the communities and programmes we serve, information provided to galck+ may sometimes reveal sensitive characteristics or circumstances, including information relating to:

• sexual orientation;
• gender identity or expression;
• sex characteristics;
• health or mental health;
• HIV or other health status;
• experiences of discrimination or violence;
• disability;
• family or relationship circumstances;
• ethnicity or other protected characteristics; or
• other information considered sensitive under applicable law.

We recognise that disclosure of this information may expose individuals to heightened risks.

We therefore seek to collect sensitive information only when necessary and to apply appropriate safeguards.

Where consent is required for processing sensitive information, we will seek appropriate consent.

4.5 Donations and Payment Information

When you make a donation, we may collect:

• donor name;
• email address;
• telephone number;
• donation amount;
• transaction reference;
• payment method;
• date and time of payment;
• payment status; and
• information necessary to issue receipts or meet accounting and reporting obligations.

Online card, PayPal and mobile-money transactions may be processed by third-party payment providers.

galck+ generally does not need to receive or store complete payment-card details when payments are processed directly through an authorised payment provider.

For offline donations, we may use your contact information to provide our bank payment details and to confirm or reconcile your donation.

4.6 Communications

If you contact us, we may maintain records of:

• emails;
• contact-form submissions;
• correspondence;
• enquiries;
• complaints;
• requests for support; and
• other communications with galck+.

4.7 Newsletter and Marketing Information

If you subscribe to our newsletter or other communications, we may collect:

• your email address;
• subscription preferences;
• communication history; and
• engagement information where provided by our email platform.

You may unsubscribe from non-essential promotional communications at any time.

4.8 Applications and Opportunities

If you apply for a job, consultancy, internship, volunteer position or other opportunity, we may collect:

• name and contact information;
• curriculum vitae;
• education and professional information;
• employment history;
• references;
• portfolio information;
• interview records; and
• other information you provide during an application process.

4.9 Research, Surveys and Advocacy

Where you participate in research, surveys, consultations, interviews, focus groups or advocacy initiatives, we may collect information relevant to that activity.

Where appropriate, we will provide additional information explaining:

• what information is being collected;
• why it is being collected;
• how it will be used;
• whether participation is voluntary;
• whether the information will be anonymised;
• who may receive the information; and
• how you may withdraw where withdrawal is possible.

Research information may be anonymised or aggregated before publication wherever reasonably appropriate.

4.10 Technical and Website Information

When you use our website, our systems or service providers may automatically collect information such as:

• IP address;
• browser type;
• device type;
• operating system;
• pages visited;
• referring website;
• approximate location derived from an IP address;
• date and time of access;
• cookies or similar identifiers;
• website interactions; and
• security and diagnostic information.

We use this information primarily for website operation, security, analytics and improvement.

5. Information We Ask You Not to Submit Unnecessarily

Because of the sensitivity of the communities we serve, please avoid submitting highly sensitive information through general contact forms, newsletter forms or other public-facing website forms unless the information is necessary for your request.

Where galck+ provides a dedicated secure service or portal, please use that channel for sensitive information whenever possible.

6. How We Collect Information

We may collect information:

• directly from you;
• through galck+ websites and forms;
• through therapy or appointment platforms;
• through payment processors;
• during programmes, events and meetings;
• through surveys or research activities;
• through member organisations or partners where lawful;
• through publicly available sources;
• through referrals;
• from service providers acting on our behalf; or
• automatically through website technologies such as cookies.

7. How We Use Personal Information

We may process your information to:

7.1 Provide Services

We may use information to:

• respond to enquiries;
• provide community services;
• facilitate counselling and therapy appointments;
• administer programmes;
• communicate with service users;
• manage memberships;
• coordinate activities with member organisations;
• manage events;
• provide resources; and
• deliver other services requested from galck+.

7.2 Protect Community Members

Where appropriate and lawful, information may be processed for:

• safeguarding;
• responding to security concerns;
• preventing abuse;
• responding to emergencies;
• protecting individuals from serious harm; and
• maintaining safe galck+ programmes and platforms.

7.3 Process Donations

We may process donor information to:

• process or verify donations;
• reconcile payments;
• issue confirmations or receipts;
• maintain financial records;
• meet audit requirements;
• comply with donor reporting obligations where applicable; and
• prevent fraudulent transactions.

7.4 Communicate With You

We may use your information to:

• respond to messages;
• provide requested information;
• send administrative messages;
• provide programme updates;
• communicate regarding appointments;
• send newsletters where you have subscribed; and
• provide other communications you have requested.

7.5 Improve Our Work

We may analyse information to:

• understand programme use;
• measure impact;
• improve accessibility;
• improve our website and services;
• identify community needs;
• perform statistical analysis; and
• plan future programmes.

Where reasonably possible, aggregated or anonymised information will be used for these purposes.

7.6 Advocacy and Research

Where lawful and appropriate, information may be used for:

• research;
• policy development;
• human-rights advocacy;
• publications;
• reports;
• programme evaluations; and
• community needs assessments.

We will take particular care before publishing information capable of identifying individuals.

7.7 Security and Legal Compliance

We may process information to:

• protect our website and information systems;
• detect fraud or misuse;
• investigate security incidents;
• establish, exercise or defend legal claims;
• comply with lawful orders;
• comply with regulatory obligations; and
• meet legal, accounting, governance and audit requirements.

8. Legal Grounds for Processing

Depending on the activity, galck+ may process personal information because:

• you have given consent;
• processing is necessary to provide a service you requested;
• processing is necessary to fulfil an agreement with you;
• processing is required by law;
• processing is necessary to protect vital interests;
• processing is necessary for legitimate activities undertaken by galck+ with appropriate safeguards;
• processing is necessary for legitimate organisational interests that do not override your rights and freedoms; or
• another lawful ground under applicable law applies.

Where sensitive personal data is involved, we apply additional legal requirements and safeguards.

Health-related information will be handled in accordance with applicable data protection law and relevant professional confidentiality obligations.

9. Consent

Where we rely on consent, your consent should be freely given, specific and informed.

You may withdraw consent at any time.

Withdrawal of consent does not make processing that occurred before withdrawal unlawful.

There may also be circumstances where galck+ may continue processing certain information after consent is withdrawn because another legal obligation or lawful ground requires or permits us to retain it.

10. Children’s Information

galck+ services are primarily intended for adults unless a particular programme expressly includes children or persons under 18.

Where we process information concerning a child, we will seek to apply appropriate safeguards and comply with applicable requirements regarding parental or guardian authority, consent, safeguarding and the child’s best interests.

We do not knowingly seek to collect children’s personal information through general website functions where it is not necessary.

11. Cookies and Similar Technologies

Our website may use cookies or similar technologies.

Cookies may be used to:

• enable essential website functions;
• maintain security;
• remember preferences;
• understand website performance;
• identify technical problems;
• measure website traffic; and
• improve user experience.

Some cookies may be provided by third-party services incorporated into our website.

Where required, non-essential cookies will be used based on appropriate consent.

You can also manage cookies using your browser settings, although disabling certain cookies may affect website functionality.

12. Third-Party Payment Services

Donations may be processed through external providers such as Paystack, mobile-money providers, PayPal, banks or other financial-service providers.

When you use a third-party payment service, that provider may independently collect and process your payment information according to its own privacy policy and legal obligations.

galck+ is not responsible for the independent privacy practices of a third-party payment provider, although we seek to work with reputable service providers.

13. Google Calendar and Google Workspace Integration

Therapists may voluntarily connect their Google account to galck+ to manage therapy availability, appointments and related calendar functions.

The connection uses Google OAuth 2.0 and can be disconnected by the therapist at any time.

Connecting a Google account is optional. Therapists who do not connect Google Calendar may have access to alternative scheduling features where such alternatives are provided by galck+.

13.1 Google User Data We Access

When a therapist connects their Google account, galck+ may access or process limited Google account and Google Calendar information necessary to provide the requested integration, including:

• the email address and basic account identity associated with the connected Google account;
• names and identifiers of calendars available to the therapist;
• calendar access or permission information;
• free and busy time information used to identify scheduling conflicts;
• calendar event information required to synchronise galck+ availability and appointments;
• identifiers for events created or managed through galck+;
• Google Meet conferencing information associated with therapy appointments;
• OAuth permissions granted by the therapist;
• access and refresh tokens required to maintain the authorised connection;
• connection and verification information;
• synchronisation timestamps;
• synchronisation status; and
• error or diagnostic information relating to the Google integration.

The permissions granted to galck+ may technically allow the application to view, create, update or delete calendar events on calendars available to the therapist, depending on the permissions granted.

galck+ uses this access only as necessary to provide the Google Calendar integration described in this Privacy Policy.

galck+ does not intentionally access unrelated Google services or data that are not required to provide the requested integration.

13.2 How We Use Google Calendar Information

galck+ uses information received from Google Calendar and Google Workspace APIs only to provide or support functionality requested by the connected therapist.

This may include:

• confirming which Google account has been connected;
• authenticating the therapist’s Google account;
• allowing a therapist to select an appointment calendar;
• creating or identifying a dedicated galck+ appointments calendar where applicable;
• checking free and busy periods;
• comparing proposed availability with existing calendar commitments;
• reducing the risk of double booking;
• reserving appointment times;
• creating calendar events when therapy appointments are confirmed;
• updating calendar events when appointments are rescheduled;
• removing or cancelling calendar events when appointments are cancelled;
• synchronising upcoming appointments;
• generating or retrieving Google Meet conferencing information where this functionality is enabled;
• maintaining calendar-event references associated with galck+ appointments;
• maintaining the connection between galck+ and the therapist’s authorised Google Calendar; and
• diagnosing and resolving authorised connection or synchronisation failures.

When checking scheduling conflicts, galck+ uses free and busy information where reasonably possible instead of exposing unrelated calendar event titles, descriptions or participant information to other galck+ users.

galck+ does not make unrelated Google Calendar event information visible to therapy participants merely because a therapist has connected their Google Calendar.

13.3 Information Included in Calendar Events

galck+ is designed to minimise the amount of sensitive information placed in Google Calendar.

galck+ does not intentionally place confidential therapy notes, clinical records, detailed security-case information, sexual orientation information, gender identity information or other unnecessary sensitive personal information in Google Calendar event titles or descriptions.

Calendar events created through the integration may contain information necessary to manage the appointment, including:

• appointment date and time;
• a galck+ appointment or booking reference;
• a neutral appointment description;
• appointment status;
• information necessary to synchronise the appointment; and
• a Google Meet link or conferencing information where enabled.

The exact information included may depend on the configuration and functionality of the galck+ appointment platform.

13.4 Storage of Google User Data

To maintain the Google Calendar integration, galck+ may securely store information including:

• the connected Google account email address;
• a protected lookup or internal account identifier;
• selected calendar name and identifier;
• OAuth access tokens;
• OAuth refresh tokens;
• permissions or scopes granted by the therapist;
• Google Calendar event identifiers;
• synchronisation timestamps;
• connection status;
• synchronisation status; and
• limited technical or audit information required to maintain, secure or troubleshoot the integration.

galck+ does not intentionally retain complete copies of a therapist’s Google Calendar for unrelated or independent purposes.

Calendar information is accessed and processed only to the extent reasonably necessary to provide the requested integration.

13.5 Protection of Google Credentials and Data

OAuth tokens, Google account information, calendar identifiers, calendar names and other sensitive connection information are encrypted or otherwise protected where appropriate.

Access to Google user data is restricted to authorised systems, processes and personnel with a legitimate operational need.

Google OAuth client credentials and secrets are maintained as protected system credentials and are not disclosed to therapists, participants or other unauthorised users.

galck+ applies reasonable technical and organisational safeguards designed to protect Google user data from:

• unauthorised access;
• unauthorised disclosure;
• alteration;
• loss;
• misuse;
• destruction; and
• unlawful processing.

No internet-connected service can be guaranteed to be completely secure.

13.6 Human Access to Google User Data

galck+ personnel do not routinely access Google Calendar user data.

Human access to Google user data may occur only where:

• the connected therapist has provided explicit consent for access to specific information for support or troubleshooting purposes;
• access is reasonably necessary to investigate a security incident, suspected abuse or technical problem affecting the security or integrity of the integration;
• information has been aggregated and anonymised and is used for permitted internal operations that do not identify the user; or
• access is required to comply with applicable law, regulation or a valid legal process.

Where human access is necessary, galck+ seeks to limit access to the minimum information required for the relevant purpose.

13.7 Sharing and Transfer of Google User Data

galck+ does not sell Google user data.

galck+ does not use Google Calendar or Google Workspace API data for:

• targeted advertising;
• personalised advertising;
• advertising measurement unrelated to the service;
• unrelated marketing;
• commercial profiling unrelated to the galck+ service; or
• purposes materially unrelated to the functionality requested by the therapist.

Information may be transmitted to Google where necessary to:

• authenticate the therapist;
• maintain OAuth authorisation;
• access authorised Google Calendar functionality;
• check availability;
• create, update or remove calendar events;
• synchronise appointments; and
• create or retrieve Google Meet conferencing information.

Google user data may also be processed by service providers supporting galck+ hosting, security, infrastructure or system operation where such processing is necessary to provide or protect the service.

Where third-party service providers process Google user data on behalf of galck+, they are expected to process the information only for authorised purposes and subject to appropriate confidentiality, security and data-processing obligations.

Google user data may also be disclosed where required by applicable law, regulation or valid legal process.

13.8 Google API Services User Data Policy and Limited Use

galck+’s use of raw or derived user data received from Google Workspace APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

This applies to the access, use, storage and transfer of information received through Google APIs.

galck+ uses Google user data only to provide or improve user-facing functionality that is prominent and relevant to the requesting user’s interaction with galck+.

13.9 Artificial Intelligence and Machine Learning

galck+ does not use Google Workspace API data to develop, improve or train generalised or non-personalised artificial intelligence or machine-learning models.

Google Calendar information obtained through the integration is not used to build advertising profiles, behavioural profiles or unrelated automated decision-making systems.

Where galck+ introduces new artificial intelligence or machine-learning functionality in the future that materially changes how Google user data is processed, this Privacy Policy will be updated and any additional permissions or consent required by applicable law or Google’s policies will be obtained before such processing begins.

13.10 Retention of Google User Data

Google Calendar access is retained only while reasonably required to provide the integration, until the therapist disconnects the account, revokes access, or the authorisation expires.

galck+ seeks not to retain Google user data longer than reasonably necessary for the purposes described in this Privacy Policy.

Retention periods may differ depending on:

• the type of information;
• whether the Google connection remains active;
• security and audit requirements;
• legal obligations;
• safeguarding requirements;
• appointment administration requirements; and
• whether information is required to establish, exercise or defend legal claims.

13.11 Disconnecting Google Calendar

A therapist may disconnect Google Calendar through the Calendar Integration or equivalent settings page within galck+, where that functionality is available.

A therapist may also revoke galck+’s Google access directly through their Google Account permissions.

When Google access is revoked, galck+ will no longer be authorised to access Google Calendar through the revoked authorisation.

Where technically possible and appropriate, galck+ attempts to revoke the Google authorisation when a therapist disconnects their account through the galck+ platform.

13.12 Deletion Following Disconnection

When a therapist disconnects Google Calendar, galck+ removes active access tokens, refresh tokens and selected calendar connection details from the active integration where those details are no longer required.

Limited information may continue to be retained where necessary for:

• security;
• fraud prevention;
• accountability;
• audit records;
• service administration;
• appointment administration;
• safeguarding;
• legal obligations; or
• the establishment, exercise or defence of legal claims.

This may include limited connection history, internal account identifiers, audit information, appointment records and Google Calendar event identifiers where retention is reasonably necessary.

Calendar events already created in the therapist’s Google Calendar may remain after disconnection.

The therapist can review, edit or delete those calendar events directly through Google Calendar.

13.13 Requests to Delete Google Connection Information

A therapist may request deletion of eligible Google connection information by contacting:

Email: info@galck.org

Deletion requests will be handled in accordance with applicable data protection law and may be subject to lawful security, safeguarding, accountability and record-retention requirements.

galck+ may need to verify the identity of the person making the request before acting on it.

14. When We May Share Personal Information

We do not sell personal information.

We may disclose personal information where reasonably necessary to:

• service providers working on our behalf;
• website and hosting providers;
• payment processors;
• email and communications providers;
• IT and cybersecurity providers;
• professional advisers;
• auditors;
• therapists, counsellors or healthcare professionals involved in providing a requested service;
• research partners where appropriate safeguards exist;
• member organisations or programme partners where disclosure is necessary and lawful;
• authorities where legally required; or
• other parties where you have authorised the disclosure.

Third parties processing personal information on our behalf are expected to process it only for authorised purposes and apply appropriate privacy and security protections.

We seek to limit disclosure of sensitive information to what is reasonably necessary for the relevant purpose.

15. Confidentiality and LGBTQ+ Community Safety

galck+ recognises that information revealing or suggesting a person’s sexual orientation, gender identity, gender expression, sex characteristics, health condition or association with LGBTQ+ organisations may carry significant personal and security risks.

We therefore aim to apply heightened confidentiality protections to such information.

We will not intentionally disclose an individual’s LGBTQ+ identity, health information or similar sensitive information to family members, employers, organisations, authorities, media organisations or other third parties simply because they request it.

Any disclosure must have an appropriate lawful basis and must comply with applicable legal obligations.

Where legally permissible, galck+ will consider the safety and privacy implications of a disclosure request before releasing sensitive information.

16. International Transfers

Some technology providers used by galck+ may store or process information outside Kenya.

This may include cloud hosting, communications, payment, security and technology providers.

Where personal information is transferred outside Kenya, galck+ will seek to ensure that the transfer complies with applicable data protection requirements.

Depending on the circumstances, safeguards may include:

• contractual protections;
• appropriate technical safeguards;
• transfers to jurisdictions with adequate protections;
• consent where legally appropriate; or
• another lawful transfer mechanism.

We take additional care when transferring sensitive personal information.

17. Information Security

galck+ takes reasonable administrative, organisational and technical measures to protect personal information against:

• unauthorised access;
• accidental loss;
• unlawful disclosure;
• alteration;
• destruction;
• misuse; and
• cyber threats.

Measures may include:

• access controls;
• password protections;
• multi-factor authentication where appropriate;
• restricted administrative privileges;
• encryption where appropriate;
• backups;
• secure hosting;
• confidentiality obligations;
• staff awareness;
• monitoring;
• software updates; and
• security incident procedures.

Access to particularly sensitive information is intended to be limited to individuals and systems with a legitimate need for access.

No internet-based service or information system can be guaranteed to be completely secure.

18. Personal Data Breaches

Where galck+ becomes aware of a personal-data breach, we will assess the incident and take appropriate steps to contain, investigate and mitigate the breach.

Where notification to Kenya’s Office of the Data Protection Commissioner or affected individuals is required by law, galck+ will seek to make the required notification within the applicable legal period.

Particular attention will be paid to incidents that could expose LGBTQ+ community members, therapy users or other vulnerable persons to discrimination, violence, harassment or other harm.

19. Data Retention

We do not intend to keep identifiable personal information indefinitely.

Retention periods depend on:

• why the information was collected;
• the sensitivity of the information;
• programme requirements;
• professional requirements;
• financial and auditing obligations;
• donor requirements;
• legal obligations;
• safeguarding requirements; and
• whether information is needed to establish, exercise or defend legal claims.

When identifiable information is no longer reasonably required, we may securely delete, destroy, anonymise or aggregate it.

Therapy and health-related records may be retained in accordance with applicable professional, clinical, contractual and legal requirements.

Donation and financial records may be retained for periods required by applicable accounting, tax, audit, donor or legal obligations.

Google user data is additionally subject to the retention, disconnection and deletion provisions described in Section 13.

20. Anonymised and Aggregated Information

galck+ may create statistical, anonymised or aggregated information from information collected through our programmes and services.

Where information has been genuinely anonymised so that individuals can no longer reasonably be identified, it may be used for research, reporting, planning, advocacy, funding applications and programme evaluation.

We seek to ensure that small datasets or combinations of information do not inadvertently reveal the identity of vulnerable individuals.

Anonymised information will not intentionally be combined with other information for the purpose of re-identifying an individual.

21. Your Data Protection Rights

Subject to applicable law and any lawful limitations, you may have the right to:

• be informed about how your personal information is used;
• request access to personal information held about you;
• request correction of inaccurate or misleading information;
• object to certain processing;
• request restriction of processing where applicable;
• request deletion of information in appropriate circumstances;
• withdraw consent where processing is based on consent; and
• exercise other rights provided under applicable data protection law.

Requests can be submitted to:

**info@galck.org**

We may need to verify your identity before acting on a request.

We may also need to retain certain information despite a request for deletion where retention is required or permitted by law.

For Google Calendar integration data, users may also disconnect the integration or revoke access through their Google Account as described in Section 13.

22. Complaints

If you have concerns about how galck+ handles your personal information, please contact us first so that we can investigate the issue.

You may contact:

galck+

P.O. Box 13005 – 00100

Nairobi, Kenya

Email: info@galck.org

Telephone: +254 20 242 6060

You may also have the right to lodge a complaint with Kenya’s Office of the Data Protection Commissioner (ODPC).

23. Third-Party Websites and Services

Our website and platforms may contain links to websites or services operated by partner organisations, social-media services, payment providers, publications or other third parties.

galck+ does not control the privacy practices of independent third-party websites or services.

You should review the privacy policies of those services before providing them with personal information.

Where galck+ integrates with a third-party service such as Google Calendar, the processing performed directly by that third party may also be governed by that provider’s terms and privacy policy.

24. Social Media

If you interact with galck+ through social-media platforms, both galck+ and the relevant platform may receive information relating to that interaction.

Your use of a social-media platform is also governed by that platform’s privacy practices and terms.

Please avoid sharing confidential or highly sensitive personal information publicly through comments, posts or public social-media messages.

25. Photography, Video and Stories

galck+ may photograph, film or document events, activities, programmes and community stories.

Where a person’s identity or story could create privacy or safety risks, galck+ will seek to apply appropriate consent and safeguarding procedures.

Consent to participate in a galck+ programme does not automatically constitute consent for galck+ to publicly disclose sensitive personal information.

Where specific consent is required for photography, video, testimonials or personal stories, that consent should be obtained separately.

We will seek to take particular care where visual or written content could disclose a person’s LGBTQ+ identity, health information or participation in a sensitive programme without their informed consent.

26. Changes to this Privacy Policy

We may update this Privacy Policy when our services, technology, legal obligations or data practices change.

The date at the top of this policy indicates when it was last updated.

Where changes materially affect how we handle sensitive information or Google user data, we may take additional reasonable steps to inform affected users.

Where required, we may request renewed consent or authorisation before materially different processing begins.

27. Contact Us

Questions, complaints and requests relating to this Privacy Policy, Google Calendar integration, personal-data rights, or galck+’s handling of personal information may be sent to:

galck+

P.O. Box 13005 – 00100

Nairobi, Kenya

Email: info@galck.org

Telephone: +254 20 242 6060

Website: galck.org