1. Our commitment
ElimuDesk Technologies Limited designs ElimuDesk to help schools meet their obligations under the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021. Schools remain responsible for their own compliance as data controllers; we provide the tools and a processor’s commitments.
2. Controller and processor roles
The school decides why and how learner, parent and staff data is processed and is the data controller. ElimuDesk processes that data on the school’s documented instructions as a data processor under a written agreement. ElimuDesk is a controller for its own website, sales and account data.
3. Data protection principles we follow
- Lawfulness, fairness and transparency
- Purpose limitation: data is used only for school operations
- Data minimisation: schools choose what to collect
- Accuracy: users can correct records
- Storage limitation: retention and deletion controls
- Integrity and confidentiality: encryption, access control, audit logs
4. Registration with the ODPC
Data controllers and processors that meet the criteria in the Act must register with the Office of the Data Protection Commissioner. Schools should check whether they must register and keep that registration current. ElimuDesk registers where the Act requires a processor or controller to register, and keeps that registration current.
5. Children’s data
Schools should obtain parental or guardian consent or rely on another lawful basis before processing learners’ data, minimise sensitive fields and restrict access by role. ElimuDesk supports consent records, role-based access and field-level privacy controls.
6. Supporting data-subject requests
We provide export, correction and deletion tools so schools can respond to requests for access, rectification, erasure and portability. Send privacy requests relating to ElimuDesk’s own data to [email protected].
7. Breach response
We maintain an incident response process. We will notify the school without undue delay after becoming aware of a personal data breach so the school can notify the ODPC within 72 hours and affected individuals where required.
8. Cross-border processing
Where data is processed outside Kenya we use the safeguards required by the Act and the Regulations, including contracts with those providers. A current list of sub-processors is available from the contact below.
9. Data processing agreement
Schools can request our data processing agreement from the contact below. It sets out processing instructions, sub-processor controls, security measures, breach notification and return or deletion of data.
10. Data protection contact
Data Protection Officer: [email protected]. Address: Nairobi, Kenya.