African Academy of Engineering (AAE) Version v3.0 ｜ Effective: September 2025
Governing law: Kenya Data Protection Act No. 24 of 2019; where the data subject is in the European Economic Area, this Policy also applies under the EU General Data Protection Regulation (GDPR).
1. Data Controller
The controller of personal data processed through this website and related services is:
African Academy of Engineering P.O. Box 52428-00200, Nairobi, Kenya Email: info@aae-africa.org / info@au-aae.org Website: www.aae-africa.org / au-aae.org
Data Protection Officer (DPO)
- Email: info@aae-africa.org / info@au-aae.org
- Address: as above
- The DPO handles all requests concerning your personal data and will respond within 30 working days.
2. Categories of Personal Data We Collect
We collect only the minimum data necessary to operate the website and conduct the Academy’s business.
| Category | Content | Source |
|---|---|---|
| Identity data | Name, title, country | Provided by you in forms |
| Contact data | Email, phone, postal address, employer, job title | Provided by you in forms |
| Academic and professional data | Qualifications, discipline, appointments, representative work, references | Submitted with fellowship or membership applications |
| Event participation | Conference, training and award records | Submitted through online registration |
| Correspondence | Emails, enquiries and messages between you and the Academy | Initiated by you |
| Technical data | IP address, browser type, device type, access time, pages visited, referring site | Collected automatically via cookies and server logs |
| Uploaded content | CVs, reference letters, images and attachments you upload | Provided by you on request |
We do not collect special categories of personal data (such as race, religion, health or biometric data) unless you voluntarily provide it in a nomination or application and it is directly relevant to review.
3. Purposes of Processing and Legal Basis
| Purpose | Legal basis (Kenya DPA / GDPR) |
|---|---|
| Respond to enquiries and submitted forms | Your consent; performance of communication with you |
| Review and elect Fellows, Industry Researchers and Technical Engineers | Performance of the Academy’s charter; your consent; our legitimate interests |
| Register and organise conferences, training and awards | Performance of contract (event participation) |
| Send the newsletter and event notices you subscribe to | Your consent (withdrawable at any time) |
| Website security, anti-spam and fault diagnosis | Our legitimate interests; legal obligation |
| Finance, audit and legal compliance | Legal obligation |
| Anonymous website traffic statistics | Our legitimate interests (only after cookie consent) |
We do not use your personal data for automated decision-making or profiling beyond the purposes above, and we do not sell your personal data to third parties.
4. Cookies and Similar Technologies
This website uses cookies and similar technologies. On your first visit, a cookie banner appears allowing you to choose “Accept all”, “Necessary only” or “Reject analytics cookies”. Your choice is recorded and can be changed at any time via the “Cookie Settings” link in the page footer.
| Type | Purpose | Retention |
|---|---|---|
| Necessary cookies | Maintain login, security, form tokens | Deleted within 24 hours of session end; login persists 2 days, “Remember me” 14 days |
| Functional cookies | Remember language and form preferences | 13 months |
| Analytics cookies | Anonymous traffic statistics | 13 months |
| Marketing cookies | Newsletter subscription status | While subscribed; 12 months after unsubscription |
You may block or delete cookies through your browser settings, but disabling necessary cookies may prevent login and form submission.
5. Recipients and Sharing
We share your personal data only in the following circumstances:
- Partner institutions: When you register for a programme jointly organised with WIDCO, WIIT, Quanzhou Ocean College or other partners, we provide the partner with the name, affiliation and contact details needed to run the programme. Partners process your data under their own privacy policies.
- Service providers: Hosting, email delivery, payment and security vendors process data only on our behalf and under our written instructions.
- Legal requirement: We may disclose necessary data in response to a legal obligation, judicial process or lawful request from a competent authority.
- Organisational change: In the event of a merger, reorganisation or asset transfer, your data may be transferred as part of the transaction, subject to this Policy.
Content you publish on the site (such as comments or forum posts) may be visible to other visitors.
6. Data Retention
We retain your personal data only as long as necessary for the purposes for which it was collected, after which it is deleted or anonymised.
| Data type | Retention |
|---|---|
| Enquiries and correspondence | 3 years from last contact |
| Fellow and member account data | During membership; 7 years after resignation or removal |
| Nomination and application materials (including unsuccessful) | 6 years from the year of nomination |
| Event and conference registration records | 5 years from the event |
| Mailing list | While subscribed; 12 months after unsubscription |
| Technical logs (IP, access records) | 12 months |
| Financial and audit records | 7–10 years, per Kenyan tax and audit requirements |
| Uploaded attachments (CVs, references) | Same period as the corresponding business record |
Where law requires a longer retention period, the legal requirement applies.
7. International Data Transfers
The Academy is based in Kenya, and our partners and service providers are located across Africa, Asia, Europe and North America. Your personal data may be transferred between and processed in these countries and regions.
Where data is transferred from Kenya to a country not recognised by the Kenyan Office of the Data Protection Commissioner (ODPC) as providing adequate protection, we apply one of the following safeguards:
- Standard Contractual Clauses (SCCs) compliant with the Kenyan DPA and GDPR;
- Your explicit consent; or
- Transfer necessary for the performance of a contract with you.
Where the data subject is in the European Economic Area, transfers are also carried out in accordance with Chapter V of the GDPR.
8. Your Data Rights
Under the Kenyan DPA and the GDPR, you have the following rights:
- Right to be informed: to know how we process your personal data (this Policy).
- Right of access: to obtain a copy of the personal data we hold about you.
- Right to rectification: to request correction of inaccurate or incomplete data.
- Right to erasure: to request deletion of your personal data in defined circumstances.
- Right to restriction: to request restriction of processing in defined circumstances.
- Right to object: to object to processing based on our legitimate interests, including marketing.
- Right to data portability: to receive the data you provided to us in a structured, commonly used format.
- Right to withdraw consent: where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of prior processing.
To exercise these rights, contact the DPO at info@aae-africa.org / info@au-aae.org. We respond within 30 working days; complex requests may be extended to 60 working days, with notice.
9. Right to Lodge a Complaint
If you consider that our processing of your personal data violates your rights, you may:
- First contact our DPO; we will use best efforts to resolve the matter;
- If you are not satisfied, you may lodge a complaint with:
- The Office of the Data Protection Commissioner (ODPC), Kenya: https://www.odpc.go.ke, competent for complaints arising in Kenya.
- Your EU data protection authority: if you are in the European Economic Area, you have the right to complain to the data protection authority of your member state.
10. Data Breach
In the event of a personal data breach likely to affect your rights and freedoms, the Academy will:
- Notify the Kenyan ODPC within 72 hours of becoming aware (where applicable);
- Notify affected data subjects without undue delay;
- Take remedial measures to mitigate the impact and prevent recurrence.
11. Minors
This website is intended for engineering professionals, scholars and institutions, and is not designed for users under 18. We do not knowingly collect personal data from anyone under 18. If you are a minor and have submitted information to us, please ask your guardian to email info@aae-africa.org / info@au-aae.org and we will delete it promptly.
12. Embedded Content and Third-Party Sites
This website may contain links or embedded content from third-party websites, videos, social media and online services. The privacy practices of those third parties are not covered by this Policy, and we are not responsible for their content or practices. We encourage you to review their privacy policies.
13. Updates to this Policy
We may update this Policy as our business, applicable law or technology evolves. Material changes will be notified through website notices, email (where applicable) or the cookie banner. The updated Policy takes effect on the date of publication. We encourage you to review this page periodically.
14. Contact
For any questions, comments or requests regarding this Policy, contact:
African Academy of Engineering
Data Protection Officer
P.O. Box 52428-00200, Nairobi, Kenya
Email: info@aae-africa.org / info@au-aae.org
Phone: +254 700 843 643