Last updated: Septemba 23, 2026
Blooming World International ("BWI", "we", "us", "our") is the data controller for personal information processed through blwi.org. This Privacy Policy explains what we collect, why, how long we keep it, who we share it with, and the rights available to you under Kenya's Data Protection Act, 2019, the EU/UK GDPR, and other applicable data protection laws.
We never sell data
Your data is never sold or rented to third parties.
Reports are protected
Whistleblower reports are restricted to authorized personnel only.
You have rights
Access, correct, or delete your data at any time.
This Policy applies to personal information collected through blwi.org, our user accounts, our job application portal, our contact and whistleblowing forms, and any related interactions with BWI in connection with our mission of community empowerment through research, science and innovation.
It does not cover third-party websites we link to (such as BWI Academy) or third-party identity providers (Google, LinkedIn) you may use to sign in — those services have their own privacy policies.
We rely on the following legal bases, consistent with Kenya's Data Protection Act, 2019 and (for visitors in the EU/UK) the GDPR:
To operate your account, process applications, respond to inquiries, and investigate reports
To detect abuse, enforce rate limits, and prevent fraudulent or malicious submissions
To reply to your messages and, where you consent, send updates about our work
To meet legal, regulatory, and accountability obligations, including to our funders
We recognize that reports of misconduct involve sensitive information and that confidentiality is essential to protect reporters. We apply the following safeguards:
BWI prohibits retaliation against any individual who submits a report in good faith, regardless of the investigation's outcome.
CVs, cover letters, and other application documents are stored securely with our file-storage provider and are only accessible to the hiring team for the relevant role.
If you are not selected, we retain your application data for a limited period (generally up to 12 months) in case a similar role becomes available, unless you ask us to delete it sooner or applicable law requires a different period. You may withdraw your application at any time from your account.
We do not sell, rent, or trade your personal data. We only share it in the following circumstances:
We keep personal data only as long as necessary for the purpose it was collected: account data for as long as your account is active, job applications as described in Section 6, and whistleblowing reports for as long as needed to investigate and close the matter and to meet any legal or audit obligation, after which data is deleted or anonymized.
We use industry-standard measures to protect personal data, including encryption in transit (HTTPS/TLS), hashed passwords, rate-limiting and bot protection on public forms, and role-based access controls that restrict who can view sensitive data such as whistleblowing reports and CVs.
No system is 100% secure. If a breach occurs that affects your personal data, we will notify affected individuals and, where required, the Office of the Data Protection Commissioner (Kenya) or other relevant authority, without undue delay.
BWI is based in Kenya and works across multiple countries. Some of our service providers (such as our hosting and file-storage providers) may process data outside your country of residence, including in the EU/EEA or the United States. Where we transfer personal data internationally, we use appropriate safeguards, such as contractual data protection commitments with our processors, consistent with the Kenya Data Protection Act, 2019 and, for EU/UK data subjects, the GDPR's transfer rules.
Subject to applicable law, you may have the right to:
To exercise any of these rights, contact us at privacy@blwi.org. We will respond within 30 days and may need to verify your identity first. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (Kenya) or your local data protection authority.
Our website and accounts are not directed at children under 13, and we do not knowingly collect personal data from them through the site or job application portal.
Where our educational or community programs involve minors (for example, early childhood education initiatives), we collect any related data only with explicit parental or guardian consent and apply additional safeguards, handled outside this website.
We may update this Privacy Policy from time to time. We will post the revised policy here and update the "Last updated" date; significant changes will be communicated more prominently where appropriate.
For any question or request relating to this Privacy Policy, please contact our Data Protection Officer:
Blooming World International — Data Protection Officer
Barua pepe: privacy@blwi.org
Headquarters: Nairobi, Kenya
Website: https://blwi.org
Protecting your privacy is fundamental to how we build trust with the communities, partners, and applicants we work with.