Privacy Policy
Last updated September 2026
This policy explains how the Institute of Design & Innovation (IDI) collects and uses personal data through idi.africa. It is written to meet Kenya's Data Protection Act, 2019.
Who we are
IDI is a research, strategy and implementation institute based at Dennis Pritt Road, Kilimani, Nairobi, Kenya. For any question about this policy or your data, contact collectives@idi.africa.
What we collect, and why
When you contact us
Our contact form collects your name, organisation, email address, enquiry type and message. We use these solely to respond to you and to keep a record of the conversation. The lawful basis is your consent, given when you submit the form.
When you subscribe to updates
We store your email address and which page you subscribed from. You can ask us to remove it at any time and we will do so without asking why.
When a certificate is verified
Certificates issued by the Decision Intelligence Design Academy carry a QR code linking to a verification page. When that page is opened we record the time, the outcome, a coarse device category, and a one-way hash of the visitor's IP address. We do not store the IP address itself. The hash is salted and changes daily, so it cannot be used to follow anyone over time or be reversed back to an address. We keep these records to detect abuse and to understand how often certificates are checked. The lawful basis is our legitimate interest in the integrity of the credentials we issue.
Analytics
Where Google Analytics is enabled, it collects usage data subject to Google's own privacy terms. We do not combine it with the data above.
What certificate verification shows publicly
A verification page displays the recipient's name, the programme completed, the relevant dates and the issuing body, to anyone holding the certificate's verification code. It never shows an email address or any internal notes. Recipients are told this at enrolment. If you hold a certificate and want it withdrawn from public verification, contact us.
How long we keep things
- Enquiries and subscriptions — until you ask us to delete them.
- Failed verification lookups — 30 days.
- Successful verification lookups — 180 days.
- Certificate records — retained as a record of the award.
Who we share data with
We do not sell personal data and we do not share it for advertising. Data is processed by the hosting and email providers that operate this site on our behalf.
Your rights
Under the Data Protection Act, 2019 you may ask us for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Write to collectives@idi.africa and we will respond within 30 days. You may also complain to the Office of the Data Protection Commissioner.
Changes
If we change this policy we will update the date at the top of this page.