Privacy Policy

Last updated: November 06, 2026

This Privacy Policy explains how Nairobi Lighthouse Church (“the organization”, “We”, “Us”) collects, uses and shares personal data when You browse events, register for an event, pay for tickets or attend an event through this website (the “Service”). It also explains Your rights under Kenya’s Data Protection Act, 2019.

Definitions

  • Attendee means a person named on a ticket or registration, including a person registered by someone else.
  • Payer means the person who completes a registration or makes a payment.
  • Personal Data means any information that relates to an identified or identifiable person.
  • Service Provider means a third party that processes Personal Data on behalf of the organization.
  • You means anyone using the Service, including Payers and Attendees.

Personal Data We Collect

Information You give Us

  • Payer details: first and last name, phone number and, where requested, email address.
  • Attendee details: names and, where requested, email addresses and phone numbers.
  • Registration choices: the event, sessions, ticket types, seats and add-ons You select.
  • Event-specific answers: some events ask extra questions, which are shown on the registration form.

If You register other people, please make sure they know You are sharing their details with Us and that they have seen this policy.

Information created when You register or pay

  • Registration records: registration codes, ticket numbers, ticket status and a unique QR code for each ticket.
  • Payment records: M-Pesa receipt number, phone number, payer name, amount, payment status and time of payment.
  • Attendance records: when a ticket is checked in at an event, and which staff member checked it in.

We do not receive or store Your M-Pesa PIN.

Information collected automatically

Our servers record technical information such as IP addresses, browser details, pages requested and times of access.

This website does not set its own cookies and does not use advertising or analytics trackers. Event pages may include videos from YouTube or Vimeo, and those services may collect information or set cookies under their own policies.

Photos and videos at events

We capture photos and videos at events for ministry, promotional and community-sharing purposes. If You have a concern about being photographed or filmed, please speak to an event team member or contact Us.

How We Use Personal Data

We use Personal Data to:

  • register You for events and issue Your tickets
  • process payments, confirm them and resolve payment problems
  • send confirmations, tickets and important event updates by email or SMS, including notice of postponements, changes or cancellations
  • check tickets at the event and manage capacity and seating
  • answer Your questions and requests
  • keep the Service secure and fix errors
  • meet the organization’s legal and financial record-keeping duties

We do not sell Personal Data. We do not use Your registration details to send promotional messages unless You have agreed to receive them.

We process Personal Data where it is needed to complete the registration You have asked for, to meet legal obligations, for the organization’s legitimate interests in running safe and well-organized events, or with Your consent. Where We rely on consent, You may withdraw it at any time. This does not affect anything done before You withdrew it.

Who We Share Personal Data With

We share only what each party needs:

  • Safaricom (M-Pesa), to process payments.
  • Resend, to send confirmation emails and tickets.
  • Advanta Africa, to send SMS messages.
  • Supabase, which hosts our database.
  • DigitalOcean, which hosts this website.
  • Sentry, which helps Us find and fix errors. Error reports may include registration codes and payment details such as a phone number.
  • Cloudinary, which serves images on the website. It receives technical details when Your browser loads an image.
  • Authorized organization staff and volunteers, who use these records to run events.
  • Other people on Your booking. A Payer can see the details of the Attendees on their registration, and Attendees may receive messages that mention the registration.

We may also disclose Personal Data where the law requires it, for example in response to a valid request from a court or public authority, or where needed to protect people’s safety or to establish or defend a legal claim.

Transfers Outside Kenya

This website is hosted in Frankfurt, Germany. Some Service Providers also process data outside Kenya, including in the United States.

We take reasonable steps to make sure Personal Data remains protected when it is transferred, as Kenyan law requires.

How Long We Keep Personal Data

We keep Personal Data only for as long as We reasonably need it for the purposes in this policy:

  • Registration and ticket records: for as long as We reasonably need them after the event.
  • Payment records: for as long as tax and financial record-keeping laws require.
  • Server logs and error reports: for a limited period, to keep the Service secure and fix errors.

When data is no longer needed, We delete or anonymize it. We may keep it longer where the law requires or where it is needed for a legal claim.

Security

We protect Personal Data with measures including encrypted HTTPS connections, access limited to authorized staff, unpredictable codes on ticket QR codes, and server-side checks on registrations and payments. No method of transmission or storage is completely secure, so We cannot guarantee absolute security.

Children

Some events and tickets are for children. Children should be registered by a parent or guardian, who provides their details and agrees to their use for the event. A parent or guardian may contact Us about a child’s data at any time. If We learn that a child’s data was provided without that agreement, We will take steps to remove it.

Your Rights

Under the Data Protection Act, 2019, You have the right to:

  • be informed of how Your Personal Data is used
  • access Your Personal Data
  • object to all or part of its processing
  • have false or misleading data corrected or deleted
  • withdraw consent where We rely on it

To use these rights, contact Us using the details below. We may need to confirm Your identity first, and We may need to keep some records where the law requires it.

If You are unhappy with how We have handled Your Personal Data, You may complain to the Office of the Data Protection Commissioner: www.odpc.go.ke.

If You Do Not Provide Your Data

Providing Personal Data is voluntary, and You can browse events without giving Us any. We do need the details marked as required on a registration form to register You and issue tickets, so without them We cannot complete Your registration.

The Service links to other websites, including church pages, maps and social media. We are not responsible for their content or privacy practices.

Changes to This Policy

We may update this policy from time to time. We will post the new version on this page and change the “Last updated” date. If a change significantly affects how We use Your Personal Data, We will let You know by a notice on the Service or by email.

Contact Us

Nairobi Lighthouse Church, Garden Estate Road, Off Thika Rd, Exit 7, Nairobi