Skip to content

Legal

Privacy Policy

How Kulea Hive collects, uses, shares and protects personal data through this website, and the rights you have under UK and EU data protection law.

Last updated: July 2026

Legal review required

This is a production-quality template that has not yet been reviewed by a qualified data protection lawyer. Every item marked [PLACEHOLDER — …] must be confirmed and completed, and the whole document verified against the applicable law, before this policy is published as final.

This policy explains how Kulea Hive handles personal data collected through this website. It covers the information you give us through our forms, the aggregate analytics we gather with your consent, the cookies and similar technologies we use, and the rights you have over your personal data.

We have written this policy in plain language so that it is easy to understand. It reflects the principles of the EU General Data Protection Regulation (EU GDPR), the UK General Data Protection Regulation (UK GDPR) and the EU ePrivacy rules on cookies and consent. Some details that require legal confirmation are marked as outstanding items for review.

Who we are

Kulea Hive is the controller responsible for the personal data described in this policy. This means we decide why and how your personal data is processed.

Kulea Hive is a nonprofit organisation, registered as a company limited by guarantee with the National Investment Board of Sierra Leone under company registration number SL060326KULEA29231. Our registered office is at 6 Sanders Street, Freetown, Sierra Leone.

You can reach us for general enquiries through the Contact page on this website. For questions specifically about this policy or about your personal data, please see the section "How to contact us about privacy" below. Our data protection contact is [PLACEHOLDER — confirm the data protection contact email].

Scope of this policy

This policy applies to personal data we collect through this website: the enquiry and subscription forms, the aggregate analytics we gather with your consent, and the cookies and local storage the site uses.

It does not cover the practices of any external websites we may link to, which have their own privacy policies. It also does not cover personal data we may collect through other channels, such as direct email correspondence, events or partnership agreements, except where that data originates from a form on this website.

Our work is in the field of education. Enquiries made through this website are expected to come from adults, such as prospective partners, organisations and interested professionals. The website is not directed at children and does not knowingly collect personal data about children. Please see the section "Children and safeguarding" below.

What personal data we collect and how

We collect personal data in three ways: when you complete one of our forms, when the site records aggregate analytics after you consent, and through a small number of cookies and local storage entries.

Forms. This website offers three forms, each collecting only what is needed for its purpose:

  • Stay Updated (newsletter): your name, email address, optional organisation, optional country, your areas of interest, and your consent to receive updates.
  • Contact Us: your reason for contact, name, email address, optional organisation, optional country, your message, and your consent.
  • Partner With Us: your organisation, name, role, country, partnership interest, and message, together with your consent. This form does not collect an email address.

Analytics we collect

We use privacy-conscious, aggregate analytics to understand how the website is used and to improve it. These analytics are gated behind your consent: nothing is collected unless you grant Analytics consent through our cookie banner or preferences dialog.

Our analytics are designed not to identify you. We do not store your IP address, we do not track you across other websites, and we do not use the data for advertising or to build a profile of you as an individual.

We use two forms of measurement, and the same Analytics consent controls both. The first is our own, described in the list below. The second is provided by Vercel, the company that hosts this website: Vercel Web Analytics counts page views and visitors, and Vercel Speed Insights measures page performance, such as how quickly a page loads. Both set no cookies, store nothing on your device, and are switched off entirely on our internal admin pages.

When Analytics consent is granted, our own analytics may record the following, stored separately from any form submissions in our database:

  • A random per-browser-session identifier that is not linked to your identity.
  • The page or route visited and the referring page.
  • Device type, browser, and operating system.
  • A coarse country code derived on our servers from an edge network header.
  • Your preferred language and your screen size.
  • Any UTM campaign parameters present in the link you followed.
  • An event type, such as a page view, a form being started or submitted, a newsletter signup, a partner enquiry, or a contact enquiry.

Cookies and similar technologies

We use a small number of first-party cookies and browser storage entries. We do not set any third-party advertising or marketing cookies today.

You can manage your choices at any time through the cookie banner or the Privacy Preferences dialog, which is reachable from the footer on every page. Analytics do not run until you grant consent, and you can withdraw consent at any time.

The technologies we use fall into these categories:

  • Essential: a first-party entry (the localStorage key "kh-consent") that remembers your cookie choices so we do not have to ask you again. This is always on because the site cannot function properly without it.
  • Analytics: a per-session identifier (the sessionStorage key "kh-session") that is set only after you grant Analytics consent, used for the aggregate analytics described above.
  • Functional: optional cookies that would remember preferences to enhance your experience. None are active today.
  • Marketing: reserved for possible future use. No marketing or advertising cookies are set today.

Purposes and legal bases

Under the UK and EU GDPR we must have a lawful basis for each use of your personal data. Our purposes and bases are as follows:

  • To respond to your enquiry (Contact Us and Partner With Us forms): our legitimate interests in answering the people who contact us, and, where you provide it, your consent. Responding to a partnership enquiry may also form part of steps taken at your request before entering into any agreement.
  • To send you the updates you asked for (Stay Updated newsletter): your consent, which you can withdraw at any time.
  • To gather aggregate analytics and improve the website: your consent, given through the cookie banner or preferences dialog.
  • To keep an essential record of your cookie choices: our legitimate interests in respecting your preferences and complying with data protection and ePrivacy rules.
  • To keep secure records and protect the website and our organisation: our legitimate interests in the security and integrity of our systems.

Email notifications

When you submit the Contact Us or Partner With Us form, we send a notification email to a Kulea Hive staff inbox so that we can act on your message — a general inbox for contact enquiries and a partnerships inbox for partnership enquiries [PLACEHOLDER — confirm the canonical Kulea Hive email domain; the site currently uses kuleahive.africa for public contact and kuleahive.org for form notifications]. These notifications are delivered using Google Workspace.

Newsletter signups through the Stay Updated form do not trigger a notification email.

In all cases, your form submission is also stored in our database, regardless of whether a notification email is sent.

Who we share your data with

We do not sell your personal data, and we do not share it for advertising. We share it only with service providers (processors) who help us run this website and who act on our instructions under appropriate contracts. These are:

  • Supabase — provides the database that stores form submissions and the analytics events we generate ourselves. The database is hosted in the United Kingdom (London region, eu-west-2).
  • Google (Google Workspace) — delivers the notification emails for Contact and Partnership enquiries.
  • Vercel — hosts and serves the website. Where you have granted Analytics consent, Vercel also provides the page-view and performance measurement described above; this is processed on Vercel's platform rather than stored in our database.

International transfers

The primary data collected through this website — form submissions and the analytics events we generate ourselves — is stored in the United Kingdom (London region). If you are in the European Economic Area, this is a transfer outside the EEA; the safeguard we rely on is set out below. The page-view and performance measurement provided by Vercel is processed separately, on Vercel's own platform.

Some of our service providers are global companies and may process limited data outside the country where you are located. Where personal data is transferred outside the UK or the European Economic Area, we will rely on an appropriate safeguard recognised under the UK and EU GDPR, such as an adequacy decision or Standard Contractual Clauses.

The specific transfer mechanisms that apply to our providers are still to be confirmed: [PLACEHOLDER — confirm transfer safeguards / SCCs].

How long we keep your data

We keep personal data only for as long as we need it for the purposes described in this policy, after which we delete it or make it anonymous.

Our specific retention periods are still to be confirmed: [PLACEHOLDER — define retention periods for enquiries, subscriptions and analytics]. Until those periods are finalised, we retain enquiry and subscription data for no longer than is necessary to respond to and manage your request, and we retain aggregate analytics in a form that does not identify you.

Your rights

Under the UK and EU GDPR you have a number of rights over your personal data. Subject to the conditions and exemptions in the law, these are:

  • The right of access — to be told whether we hold personal data about you and to receive a copy of it.
  • The right to rectification — to have inaccurate or incomplete personal data corrected.
  • The right to erasure — to ask us to delete your personal data in certain circumstances.
  • The right to restriction — to ask us to limit how we use your personal data in certain circumstances.
  • The right to object — to object to our processing where we rely on our legitimate interests.
  • The right to data portability — to receive certain personal data in a structured, commonly used, machine-readable format, and to have it transferred to another controller where technically feasible.
  • The right to withdraw consent — where we rely on your consent, you can withdraw it at any time, without affecting processing carried out before you withdrew it.
  • The right to complain to a supervisory authority — if you are concerned about how we handle your personal data. The relevant authority is [PLACEHOLDER — name the relevant supervisory authority/authorities].

How to exercise your rights

To exercise any of these rights, please contact us using the details in the section "How to contact us about privacy" below. We may need to verify your identity before we act on a request, so that we do not disclose personal data to the wrong person.

You can withdraw your consent to analytics at any time through the Privacy Preferences dialog in the footer, and you can unsubscribe from our newsletter at any time. We aim to respond to rights requests within the timeframe required by law, and we will not charge a fee except where the law allows.

Exercising your right to complain to a supervisory authority does not require you to contact us first, although we would welcome the chance to address your concerns directly.

How we keep your data secure

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration. Form submissions and analytics events are stored in a managed database, kept separate from one another, and access is limited to those who need it.

No method of transmission or storage is completely secure, so while we work to protect your personal data we cannot guarantee absolute security.

Children and safeguarding

Kulea Hive works in the field of education, and safeguarding matters to us. This website, however, is intended for adults — for example prospective partners, organisations and interested professionals — and its forms are designed to be completed by adults about their own enquiries.

We do not ask for, and we do not knowingly collect, personal data about children through this website. Please do not use these forms to send us personal data about a child. If you believe a child has provided us with personal data through this website, please contact us and we will take appropriate steps to delete it.

Accessibility

We want everyone to be able to read this policy and manage their privacy choices. This website targets WCAG 2.1 Level AA, using semantic HTML, keyboard operability, visible focus indicators, support for reduced motion, ARIA where needed, accessible forms, and accessible cookie and preferences dialogs.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices, our service providers, or the law. When we make changes, we will update the "Last updated" date shown with this policy.

Where changes are significant, we will take reasonable steps to bring them to your attention. We encourage you to review this policy periodically.

How to contact us about privacy

If you have any questions about this policy, about how we handle your personal data, or if you wish to exercise your rights, please get in touch.

You can reach us through the Contact page on this website, or write to us at our registered office: Kulea Hive, 6 Sanders Street, Freetown, Sierra Leone. Our dedicated data protection contact is [PLACEHOLDER — confirm the data protection contact email].