Privacy Policy

Let's Talk GMO ("we", "us", "our") is an independent initiative dedicated to evidence-based agricultural biotechnology communication across Sub-Saharan Africa. We operate the website letstalkgmo.org.

Data Controller contact: privacy@letstalkgmo.org

• Account management: authenticating users and managing access roles
• Research publishing: processing and publishing submitted documents
• Newsletter: sending policy and research updates you subscribed to
• Platform security: detecting abuse, fraud, and unauthorised access
• Analytics: understanding how the platform is used to improve it
• Legal compliance: meeting obligations under applicable law

We do not use your data for advertising, profiling, or sale to third parties.

We do not sell or rent your personal data. We may share data with:

• Service providers: hosting (server infrastructure), email delivery (transactional only) — bound by data processing agreements
• Law enforcement: only when legally required by a valid court order or regulatory authority

All third-party processors are contractually bound to handle data in accordance with this policy.

Under Kenya's Data Protection Act 2019 and GDPR, you have the right to:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your personal data ("right to be forgotten")
• Restriction — request we limit processing of your data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — at any time, without affecting prior processing

To exercise any right, email privacy@letstalkgmo.org. We respond within 30 days.

We use only essential cookies:

• PHPSESSID — session management and secure login (expires on browser close)
• csrf_token — cross-site request forgery protection (session-scoped)

We do not use tracking cookies, advertising cookies, or third-party analytics cookies. No cookie consent banner is required for essential cookies only.

We implement appropriate technical and organisational measures including:

• TLS 1.2+ encryption for all data in transit
• Bcrypt password hashing
• CSRF token validation on all forms
• Role-based access control
• File upload malware scanning
• Daily encrypted backups with 30-day retention

No system is 100% secure. In the event of a data breach affecting your rights, we will notify you within 72 hours as required by law.

Our servers are located within the East Africa region. If data is transferred outside Kenya, we ensure adequate protection through standard contractual clauses or equivalent safeguards in accordance with the Data Protection Act 2019.

This platform is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted data, please contact us at privacy@letstalkgmo.org for immediate removal.

We may update this policy periodically. Material changes will be notified via a site notice and, where appropriate, by email. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the platform constitutes acceptance of the updated policy.

For privacy questions or to exercise your rights:

Email: privacy@letstalkgmo.org
Response time: Within 30 days

If you are unsatisfied with our response, you have the right to lodge a complaint with Kenya's Office of the Data Protection Commissioner (ODPC).