1. Who we are
ElimuDesk Technologies Limited (“ElimuDesk”, “we”) provides a school operating system. For learner, parent and staff data that a school puts into ElimuDesk, the school is the data controller and ElimuDesk acts as a data processor. For visitors to our website, prospective customers and account administrators, ElimuDesk is the data controller. We register with the Office of the Data Protection Commissioner (ODPC) where the Data Protection Act, 2019 of Kenya requires it.
Contact for privacy matters: [email protected] or +254719611966. Address: Nairobi, Kenya.
2. Information we collect
- Learner data (added by schools): names, admission numbers, class, date of birth, guardian contacts, attendance, fees, marks and report comments, and any other fields the school chooses. Some data may be sensitive (for example health or special-needs notes).
- Parent and guardian data: names, phone numbers, email addresses, payment references.
- Staff data: names, roles, TSC numbers, contact details, attendance.
- Website and account data: name, email, phone, school, messages you send us, device and usage data, and cookie identifiers.
- Payment data: M-Pesa transaction references, amounts and timestamps (we do not store M-Pesa PINs or card numbers).
3. How we use information
We use personal data to provide and secure the Service, reconcile fees, send messages the school requests, provide support, improve the product, comply with law and, where you agree, send product updates. We do not sell personal data and do not use learner data for advertising.
4. Lawful bases
Under the Data Protection Act, 2019 we rely on: performance of a contract; compliance with a legal obligation; legitimate interests (such as security and service improvement) balanced against your rights; and consent, where required, for example for marketing messages and for processing children’s data where the school relies on parental consent. Schools determine their own lawful bases for the data they control.
5. Children’s data
Most learners are children. We process their data only on the school’s instructions, apply role-based access and encourage schools to collect only what is necessary. Schools must obtain any parental or guardian consent required and inform families how data is used. We do not market to children.
7. International transfers
Some providers may store or process data outside Kenya. Where that happens we use the safeguards required by the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021, including written contracts with those providers and, where the law requires it, consent.
8. Retention
We keep School Data while the school’s subscription is active and for 30 days afterwards so the school can export it. We then delete or anonymise it unless a longer period is required by law. Website enquiries are kept for as long as needed to respond, and then for up to 24 months as a business record.
9. Your rights
Under the Data Protection Act, 2019 you have the right to be informed; to access your data; to object to processing; to correct inaccurate data; to request deletion of data that is no longer needed; and to data portability, among others. Parents and guardians can exercise these rights for their children. For School Data, please contact the school first; we will help the school respond. You can also contact us at the address above and may complain to the ODPC (www.odpc.go.ke).
10. Security
We use encryption in transit and at rest, role-based access, audit logs and backups. If a breach is likely to put individuals at risk we will notify the school and, where required, the ODPC within 72 hours. See our Security page.
12. Marketing messages
We will only send marketing messages if you have opted in or are an existing customer, and every message includes an easy way to opt out.
13. Changes to this policy
We will post updates here and notify account administrators of material changes.
14. Contact and complaints
Email [email protected] or write to Nairobi, Kenya. You may also contact the Office of the Data Protection Commissioner, Kenya.