Who this policy covers

This policy applies to visitors and users of CRESA’s website and its online features, including membership registration, enquiries, resource submissions, reviews, event-related forms and merchandise enquiries where these are provided.

In this policy, “CRESA”, “we” and “us” refer to the Construction and Real Estate Students Association. This policy does not automatically cover the separate websites, systems or data practices of the University of Nairobi or other organisations.

What information we may collect

We may collect information that you provide directly when you interact with us, depending on the feature you use. This may include:

• Contact details such as your name, email address and phone number.
• Student or membership details such as registration number, course, faculty, study level, year of study and membership type.
• Information in messages, enquiries, feedback, reviews or applications you send to CRESA.
• Content you submit, such as articles, photographs, learning resources, links or event-related information.
• Limited technical information that a website or service may record, such as browser/device details, access logs and basic usage data.

Please provide only information that is relevant to the form or service. Avoid submitting passwords, financial account credentials, identification documents or other sensitive information unless a specific official process clearly requires it.

How we use information

Depending on the interaction, CRESA may use information to:

• process membership registrations and communicate about membership-related matters;
• respond to questions, feedback, complaints and requests for assistance;
• administer events, site visits, activities, orders or collection arrangements;
• review, organise and publish approved student resources or editorial submissions;
• moderate reviews and submissions, prevent misuse and maintain the integrity of website features;
• maintain, troubleshoot and improve the website and its services; and
• meet applicable legal, institutional or record-keeping obligations.

We do not describe these purposes as a promise to use every category of information for every activity. Use should be limited to what is relevant to the particular interaction.

Why we may process information

Where applicable, personal information should be processed on an appropriate legal basis, such as your consent, steps you request us to take, a legitimate and proportionate association-related purpose, or compliance with a legal obligation. The relevant basis depends on the information and activity involved.

If we rely on consent, you may withdraw it where applicable. Withdrawal does not necessarily affect processing that took place before withdrawal or processing supported by another lawful basis.

When information may be shared

CRESA does not intend to sell personal information. Information may be shared only where reasonably necessary for the stated purpose, where you have been informed or have agreed where required, or where disclosure is otherwise permitted or required by law.

Depending on the activity, this may involve authorised CRESA office holders or chapter representatives who need the information to carry out their responsibilities, service providers supporting a form or website feature, or an appropriate institution or authority where a valid requirement applies.

We should not publish private contact details or individual registration information in public-facing content unless there is a proper basis and the necessary permissions have been obtained.

Third-party services and links

CRESA may use or link to external services for forms, file storage, video tutorials, email, analytics or other functions. When you interact with a third-party service, information may be processed under that provider’s own privacy terms and settings.

For example, if a form or resource is hosted by another provider, information you enter may be handled by that provider as well as by CRESA. Please review the provider’s privacy notice before submitting information. CRESA cannot guarantee the privacy practices, security or availability of services it does not operate.

How long information is kept

We should retain personal information only for as long as it is reasonably needed for the purpose for which it was collected, to manage association activities, resolve issues, maintain appropriate records or meet applicable obligations.

Retention periods may differ by record type. When information is no longer needed, it should be securely deleted, anonymised or otherwise handled appropriately, subject to any applicable record-keeping requirements and technical limitations of the services used.

Keeping information safe

CRESA aims to use reasonable organisational and technical measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. Access should be limited to people who need the information for an authorised purpose.

No website, email system or online transmission can be guaranteed completely secure. Please contact us promptly if you believe information submitted to CRESA has been exposed or used improperly.

Your privacy rights

Subject to applicable law and any relevant exceptions, you may have rights to request access to personal information about you, ask for correction of inaccurate information, request deletion, object to or restrict certain processing, or withdraw consent where processing is based on consent.

To make a request, email [email protected] and describe the information and action you are requesting. We may need to verify your identity and clarify the request before acting. We will respond in accordance with applicable requirements.

If you believe your information has been handled unlawfully, you may also have the right to raise a concern with the relevant data-protection authority in Kenya.

Cookies and analytics

The website or its underlying platform may use essential technologies, such as cookies or similar storage, to support core functionality, security, preferences or session management. Third-party embedded content may also set its own technologies.

This page does not confirm that CRESA uses advertising cookies or a particular analytics tool. If optional analytics or tracking tools are enabled, this policy and any relevant consent controls should be updated to explain what is used, why it is used and how you can manage your choices. You can also manage cookies through your browser settings, although disabling some cookies may affect website functionality.

Children and young people

CRESA’s website is intended primarily for the student community and people interested in the built environment. If a website feature collects information from a child or a person who requires additional safeguards under applicable law, the collection and use of that information should be handled with the necessary protections and permissions.

Please do not submit another person’s information without an appropriate basis or permission.

Changes to this policy

We may update this Privacy Policy when our website features, information practices or legal obligations change. The latest version will be published on this page with a revised “Last updated” date. Please review it periodically.

For privacy questions, access or correction requests, or concerns about information submitted through a CRESA website feature, contact:

Construction and Real Estate Students Association (CRESA)
[email protected]

This policy is intended to be read consistently with applicable data-protection laws in Kenya, including the Data Protection Act, 2019, and any relevant rules or guidance.