Privacy and terms

What FIRMS collects, who can see it, and the rules for using the system — in plain language.

What we collect and why

FIRMS collects only the personal details needed for festival registration, participation, adjudication administration, reporting and certification, under the Kenya Data Protection Act, 2019. Children's data is visible only to authorised festival officials through their institution.

Specifically, the system stores what festival administration needs:

  • Institution details, official contacts and authorised officials.
  • Participant and instructor details, their institution, roles and items.
  • Item registrations, results, progression decisions and certificates.
  • A record of who did what in the system, for accountability.

Nothing else is collected. There is no advertising, no tracking for marketing, and no selling of data.

Who can see records

Access is role-based and scoped. An institution contact sees their own institution; a Sub-County coordinator sees their Sub-County; national roles see the whole festival. Data entry and final approval are separate permissions — the same person cannot do both on a result. Technical administrators cannot change approved results at all.

Children's data

Many participants are children, so their data gets stricter handling: limited fields, access restricted to authorised festival officials, consent captured through the institution, and no public display anywhere on this site — including the certificate verification page.

Your rights under the Data Protection Act, 2019

You can ask to see or correct personal data held about you. Requests go to the data protection focal person through your institution or coordinator, and are logged and answered within a set period. To reach the focal person, use the help and contact page.

Keeping records safe

  • Connections are encrypted (HTTPS only) and passwords are stored hashed.
  • Sessions sign out automatically after a period of inactivity.
  • Exports of participant lists are watermarked and logged.
  • The audit trail is append-only: records cannot be silently changed or deleted.
  • Retention, archive and disposal follow the government's records-management requirements.

Terms of use

  • Use your own account only; shared logins are not allowed.
  • Enter only true records. Every significant change needs a reason and is audited.
  • Do not share participant lists outside the system.
  • FIRMS is an information layer only — it does not replace festival rules, adjudication procedures or authorised decisions.
  • Misuse, including attempts to guess certificate codes, is logged and can lead to access being removed.

Data location

Festival records are hosted in line with the Ministry's requirements for government data, including any requirement that the data stay in Kenya.