1. About this policy
MERL Kenya (Monitoring, Evaluation, Reporting and Learning) is the platform used by the Ministry of Environment, Climate Change and Forestry, its State Departments and agencies, and participating county governments to record and publish climate projects, results and finance. This policy explains what personal information the platform handles when you visit the public website, use the staff portal or contact us, and how it is protected.
We handle personal data in line with the Data Protection Act, 2019 of Kenya and its regulations. We collect only what the platform needs to work, keep it secure, and do not sell it or use it for advertising.
2. Information we collect
Visitors to the public website
- Visit records: the page you opened, the time, the type of device (desktop, tablet or phone), the website that referred you, and your IP address.
- Approximate location: the city, region and country derived from your IP address. We do not use GPS or ask for your precise location.
Staff and partner accounts
- Account details: name, work email, phone number, workspace (county, ministry unit or partner organisation), role and designation.
- Sign-in information: password (stored only as a one-way hash, never in readable form), sign-in and sign-out times, IP address and approximate location, and failed or blocked sign-in attempts.
- Activity records: pages used and the changes you make, for example creating or editing a project or submitting a report, so the platform keeps an accurate audit trail.
- Work you submit: project details, reports, indicator results, beneficiary figures and evidence files such as photos and documents.
People who contact us
- Your name, email address, phone number (optional), organisation or institution, the message and any files you attach.
- The page you were on when you wrote, your browser and device type, and your IP address, so we can understand and fix the issue you report.
3. How we use information
- To run the platform, sign staff in and show each person the workspace their role allows.
- To publish approved project and results information on the public dashboards.
- To keep the platform secure: detecting unusual sign-in activity, investigating misuse and keeping an audit trail of changes.
- To answer messages sent through the Contact Us form and fix reported problems.
- To understand how the platform is used (for example, the most visited pages) so we can improve it.
We rely on the performance of a public function and our legitimate interest in running an accountable national monitoring system. Where we need your consent, for example when you send us a message, we ask for it.
4. Who can see your information
- The public sees only approved project and results information. Staff names, contact details and account records are never published.
- Staff see the records their role allows: a county sees its county, a ministry unit sees its portfolio, and reviewers see the reports they are responsible for.
- The MERL Super Administrator can see account, security and visit records, and Contact Us messages, to run and protect the platform.
- Partner organisations may receive read-only access, through access keys issued and revocable by the administrator, to the projects and reports they are assigned to. They do not receive staff account data.
- We may disclose information where the law requires it, for example to comply with a court order.
5. Services we rely on
| Service | Why | What it receives |
|---|---|---|
| Google Maps | Project maps and the location picker | Your IP address and the map area being viewed, when a page with a map loads |
| Google Fonts | Typography on the public website | Your IP address when the fonts load |
| OpenAI | The optional "Ask MERL" assistant | The question you type and the public project information needed to answer it. Do not enter personal information in the assistant. |
| Email delivery (Gmail SMTP) | Delivering Contact Us messages to the MERL team | The contents of the message you send |
| MaxMind GeoLite2 | Approximate location of visits and sign-ins | Nothing; the lookup runs on our own server |
6. Cookies and browser storage
MERL does not use advertising or third-party tracking cookies. It uses a small number of cookies and browser storage that the platform needs to work:
| Name | Purpose | Lasts |
|---|---|---|
| Session cookie | Keeps you signed in to the staff portal | Until you sign out, or after a period of inactivity |
| XSRF-TOKEN | Protects forms against cross-site request forgery | The session |
| merl_last_staff_path, merl_idle_return | Return you to the page you were on after an automatic sign-out | Up to 2 hours |
| Trusted browser (Super Administrator only) | Remembers a browser that has passed two-step verification | Up to 30 days, or until revoked |
| Theme preference (browser storage) | Remembers light or dark mode | Until you clear it |
| Form drafts and offline fieldwork (browser storage) | Keeps unsent forms and reports captured offline on your device until they are submitted | Until submitted or cleared |
You can clear cookies and storage in your browser settings. If you block the session cookie you will not be able to sign in.
7. How long we keep information
- Visit records are kept for analysis and security, and older records are deleted periodically.
- Security and audit records are kept for as long as they are needed for accountability and to investigate incidents.
- Accounts are kept while you work on the platform. Deactivated accounts are kept so the history of the records you created stays accurate.
- Contact messages are kept until the issue is resolved and for a reasonable period afterwards for follow-up and service improvement.
- Project and report records are part of the national monitoring record and are kept in line with government records management requirements.
8. How we protect information
- All traffic is encrypted with HTTPS, and session cookies are sent over secure connections only.
- Access is based on roles, so each person sees only the workspace they are responsible for.
- The Super Administrator account requires two-step verification.
- Staff are signed out automatically after a period of inactivity, and the administrator can end any session.
- Sign-ins, failed attempts and changes to records are logged, and unusual activity is flagged.
9. Your data rights
Under the Data Protection Act, 2019 you have the right to:
- be informed of how your personal data is used;
- access the personal data we hold about you;
- ask us to correct data that is wrong or incomplete;
- ask us to delete data that is false, misleading or no longer needed, where the law allows;
- object to the processing of all or part of your data.
To exercise any of these rights, send a request through the Contact Us form and choose Account or access help. We may need to confirm your identity before acting on the request.
10. Contact and complaints
Questions about this policy or how your information is handled can be sent through the Contact Us form. Every message is logged with a reference number and reviewed by the MERL team.
If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.
We may update this policy when the platform changes. The date at the top of the page shows when it was last revised.