Privacy Policy
This policy explains how School A collects, uses, and protects personal data through its school portal, and the rights you have under the Kenya Data Protection Act, 2019 (Act No. 24 of 2019).
Last updated: 11 November 2026
1. Who is responsible for your data
School A is the data controller for personal data processed through this portal, as defined in section 2 of the Act. The school decides why data is collected and how it is used, and processes it in line with the data protection principles set out in section 25 of the Act.
Where a third-party provider processes data on the school's behalf — for example hosting, messaging, or payments — that provider acts as a data processor and is engaged only to carry out the school's instructions.
2. Information we collect
Depending on your role and use of the portal, we may collect information such as account details (name, email, phone, login identifiers), student and parent/guardian records, admissions information, attendance, academic records, fee and payment-related records, messages, and uploaded documents. We may also collect technical information needed to operate and secure the portal (such as session and device/browser data).
Some of this data may be sensitive personal data as defined in section 2 of the Act — for example information relating to a learner's health, special educational needs, or religious affiliation where relevant to school administration. Such data is handled with additional care and only where the Act permits.
3. Why we process your data (lawful basis)
Under section 30 of the Act we process personal data only where we have a lawful basis. The bases we rely on for this portal are:
- Consent — where you or your guardian have given clear consent, for example for optional communications.
- Performance of a contract — to provide the school services you or your child are enrolled for.
- Compliance with a legal obligation — for example statutory education records, financial record-keeping, and safeguarding duties.
- Legitimate interests — operating and securing the portal, preventing misuse, and keeping audit records, where these do not override your rights.
4. How we use information
Information is used to operate the school and the portal, including: managing accounts and access, admissions and enrollment, teaching and learning, communication with parents/guardians and staff, fee administration, reporting, safeguarding, and maintaining security and audit records. We do not sell personal data.
5. Sharing and access
Access to information is limited to authorized users based on their role (for example, administrators, teachers, and parents/guardians). Information may be shared where necessary for school operations, with service providers that support the portal, or where required by applicable law or school policy.
Where personal data is transferred outside Kenya, we do so only as permitted by section 48 of the Act — that is, where there is an adequate level of protection, appropriate safeguards, or your consent.
6. Storage and security
School A takes reasonable steps to protect portal information through access controls and other safeguards, consistent with the duty in section 41 of the Act to secure personal data against loss, unauthorised access, and misuse. No system can be guaranteed completely secure; users should protect their credentials and report suspected misuse to the school.
If a breach of personal data occurs, the school will notify the Office of the Data Protection Commissioner and affected data subjects as required by section 43 of the Act.
7. Retention
Records are kept only for as long as needed for school administration, legal, and operational purposes, in line with the retention limitation principle in section 25 of the Act and applicable school record-keeping requirements. When data is no longer needed, it is securely deleted or anonymised.
8. Your rights
As a data subject, section 26 of the Act gives you the right to:
- be informed of the use of your personal data;
- access your personal data held by the school;
- object to the processing of all or part of your personal data;
- correct false or misleading personal data;
- request deletion of your personal data where there is no lawful reason to keep it;
- receive your data in a structured, commonly used format (data portability);
- request not to be subject to a decision based solely on automated processing, where it has legal consequences for you.
To exercise any of these rights, contact School A. We will respond within a reasonable time and, where the Act prescribes a period, within that period.
9. Children's data
Much of the data in this portal belongs to learners. Under section 33 of the Act, personal data relating to a child may only be processed in a manner that protects and advances the child's rights and best interests. Where consent is the basis for processing a child's data, it is given by a parent or legal guardian.
10. Cookies
The portal uses cookies and similar technologies as described in our Cookies Policy.
11. Complaints and the regulator
If you believe your data has been handled unlawfully, please contact School A first so we can address it. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), the regulator established under the Act.
12. Contact
For privacy questions or to exercise your rights, contact School A.