Privacy Policy

Last updated: 2026-10-16

This is a starting draft covering ElimuNexus's actual data flows as implemented in the platform. It has not been reviewed by a lawyer and should be reviewed against Kenya's Data Protection Act, 2019 (and any other applicable law) — and against your Data Protection Officer registration with the ODPC — before being relied on as your final published policy.

1. Who this policy covers

This policy applies to students, parents/guardians, teachers, school administrators, and finance/transport staff who use ElimuNexus, a school management and digital learning platform used by schools in Kenya.

2. What we collect

Account information: name, username, role, and school affiliation.
Academic records: exam results, attendance, assignments, and timetable data entered by teachers and administrators.
Financial records: fee statements and payment history, for schools using the finance module.
Transport records: routes, vehicle assignments, and related logistics, for schools using the transport module.
Communication data: SMS messages sent to parents/guardians regarding results, fees, or announcements.
Uploaded files: curriculum documents and other files uploaded by teachers/administrators.
Technical data: IP address and basic request logs, collected automatically for security (e.g. login rate-limiting) and reliability purposes.

3. How we use it

To operate the platform's core functions: results, attendance, fees, transport, and communication between school, parents, and students.
To send SMS notifications to parents/guardians (e.g. exam results, fee reminders) via our SMS provider.
To secure accounts and prevent abuse (e.g. detecting repeated failed login attempts).
To generate PDF reports, statements, and receipts requested by school staff.

4. Who we share it with

We do not sell personal data. Data is shared only as needed to operate the platform:

Your school's own staff, according to their role (e.g. a teacher sees only their assigned students/subjects).
Our SMS delivery provider, to send the messages a school's staff request.
Our cloud infrastructure providers (database hosting and file storage), who process data on our behalf under their own security safeguards.

5. Data retention

[PLACEHOLDER — state your actual retention period per data type, e.g. "academic records are retained for the duration of enrollment plus N years" — this must reflect a real policy decision, not a default we can infer from the code.]

6. Your rights

Under Kenya's Data Protection Act, 2019, you may have the right to access, correct, or request deletion of your personal data, and to object to certain processing. To exercise these rights, contact us at [PLACEHOLDER — support/contact email].

7. Security

We use industry-standard measures including encrypted connections (HTTPS), secure session cookies, password hashing, and role-based access control to protect your data. No system is perfectly secure, and we encourage users to use strong, unique passwords.

8. Children's data

ElimuNexus necessarily processes data about students who are minors, on behalf of and at the direction of their school. Parents/guardians and schools should ensure they have the appropriate basis (e.g. school enrollment agreements) for this processing under applicable law.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

10. Contact us

Questions about this policy can be sent to [PLACEHOLDER — contact email / address].