Privacy Policy

1. Introduction

World Samma Federation ("WSF," "we," "our," "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Services.

We comply with:

• Kenya's Data Protection Act, 2019
• European Union's General Data Protection Regulation (GDPR)
• California Consumer Privacy Act (CCPA) where applicable

2. Information We Collect

2.1 Personal Information

• Account Information: Name, email, admission number, belt level
• Payment Information: Payment method, transaction history (processed by PayPal/M-Pesa)
• Training Data: Progress, certifications, belt advancements
• Family Package Data: Family relationships, member information

2.2 Technical Information

• IP addresses, browser type, device information
• Usage data and platform interaction metrics
• Cookies and similar tracking technologies

3. Legal Basis for Processing (GDPR)

• Contract: Processing necessary for service delivery
• Consent: For marketing communications and optional data
• Legal Obligation: Compliance with Kenyan sports regulations
• Legitimate Interests: Platform improvement and security

4. How We Use Your Information

• Provide and maintain our Services
• Process payments and manage course access
• Issue certifications and track belt progression
• Communicate important updates and security notices
• Improve platform functionality and user experience
• Comply with legal obligations under Kenyan law

5. Data Sharing and Disclosure

5.1 Service Providers

• Payment processors (PayPal, M-Pesa Safaricom)
• Cloud hosting services with adequate security measures
• Email service providers for communications

5.2 Legal Requirements

We may disclose your information if required by:

• Kenyan courts or regulatory authorities
• Ministry of Sports requirements
• International sports bodies for competition eligibility

5.3 International Transfers

Data may be transferred outside Kenya only to countries with adequate data protection laws or under appropriate safeguards.

6. Data Retention

• Account Data: Retained while account is active + 5 years
• Payment Records: 7 years for tax and audit purposes
• Certification Records: Indefinitely for historical and verification purposes
• Inactive Accounts: Deleted after 3 years of inactivity

7. Your Data Protection Rights

7.1 Rights Under Kenyan Data Protection Act

• Right to access your personal data
• Right to correction of inaccurate data
• Right to deletion of unnecessary data
• Right to object to processing

7.2 Rights Under GDPR

• Right to access, rectify, or erase your data
• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent

To exercise these rights, contact us at privacy@worldsamma.org

8. Data Security

We implement appropriate technical and organizational measures including:

• Encryption of sensitive data in transit and at rest
• Regular security assessments and penetration testing
• Access controls and authentication mechanisms
• Secure payment processing through certified providers

9. Children's Privacy

Our Services are not directed to children under 13. We collect information from children under 18 only with verifiable parental consent in accordance with:

• Kenyan Children Act
• GDPR requirements for children's data
• COPPA compliance for US users

10. Data Protection Officer

As required by Kenyan Data Protection Act, we have appointed a Data Protection Officer:

Email: dpo@worldsamma.org

Phone: +254 789 273 384

11. Changes to This Policy

We may update this Privacy Policy. We will notify you of significant changes and obtain consent where required by law.