Privacy Policy

This Privacy Policy explains how EdTrust Kenya Ltd (“EdTrust”, “we”, “us”) collects, uses, stores and protects your personal data when you visit edtrust.co.ke or use our applications (EdManager, EdParent, EdTeacher, EdStudent and EdScan).

We take privacy seriously because our platform is used by schools, teachers, learners and their families. This Policy is governed by the Data Protection Act, 2019 of Kenya, the Data Protection (General) Regulations, 2021, and any guidance issued by the Office of the Data Protection Commissioner (ODPC).

1. Data Controller

For the purposes of the Data Protection Act, the data controller is EdTrust Kenya Ltd, a private limited company incorporated in Kenya, with offices at Konza Technopolis, Nairobi, Kenya. We are registered with the Office of the Data Protection Commissioner where required.

Our Data Protection Officer can be contacted at contact@edtrust.co.ke or by phone at +254 745 534 885.

2. Information we collect

2.1 Information you provide

• Identification data: name, surname, email, phone number, role, and the school or organization you represent.
• Account data: username, hashed password, role (administrator, teacher, parent, learner).
• Communications content: demo requests, contact forms, support conversations.
• School data: grades, attendance, timetables, assignments, fees and payments, when entrusted to us by the school.
• Payment data: M-Pesa or card transaction references when you pay school fees through our platform. Card details are handled by PCI-compliant payment service providers; we do not store card numbers ourselves.

2.2 Information collected automatically

• Device information: device type, operating system, browser, IP address, mobile network operator.
• Usage data: pages visited, session duration, features used, sign-in logs.
• Approximate location derived from IP address, used for security and fraud prevention.

3. Purposes and lawful bases of processing

Under section 30 of the Data Protection Act, we process your data when:

• Performance of a contract: to deliver our services to subscribing schools and their authorised users.
• Legitimate interests: commercial relationship management, demo requests, customer support, product analytics, and fraud prevention.
• Consent: marketing emails, non-essential cookies, and optional features such as push notifications. Consent can be withdrawn at any time.
• Legal obligation: tax records, accounting, requests from competent authorities, response to ODPC enquiries.
• Vital interests / public interest: in rare safety situations affecting a learner, where applicable.

4. Learner data and the role of the school

Where you are a learner or parent and your data reaches us through your school, the school is the data controller and EdTrust Kenya Ltd acts as a data processor under sections 39–41 of the Data Protection Act, 2019. We process learner data only on the school’s documented instructions and under our subscription contract.

For requests about a specific learner’s school records (access, rectification, deletion), please contact the school administration first.

In line with section 33 of the Data Protection Act, processing of children’s data requires the consent of a parent or guardian and is only carried out where it is in the child’s best interests.

5. Recipients of data

Your data is accessible only to authorised EdTrust personnel, your school (where relevant) and our trusted processors:

• Hosting: Amazon Web Services (AWS), Frankfurt region, Germany; with the option of in-region hosting on request.
• Email and CRM: HubSpot, transactional email providers.
• Payments: Safaricom (M-Pesa), licensed payment service providers regulated by the Central Bank of Kenya.
• SMS notifications: licensed mobile network operators and SMS aggregators.
• Analytics: HubSpot Analytics, loaded only with your consent.

6. International transfers

Some processors are located outside Kenya. Such transfers are carried out in accordance with sections 48 to 50 of the Data Protection Act, through one or more of the following safeguards: data-processing agreements with appropriate technical and organisational measures, Standard Contractual Clauses, and assessment that the destination country provides an adequate level of protection. A copy of these safeguards can be requested at contact@edtrust.co.ke.

7. Data retention

• Marketing prospects (forms, demo requests): up to 3 years from the last contact.
• Active accounts: for the duration of the school’s subscription.
• After account deletion request: we will delete all copies from our servers within 90 days to 12 months. After 90 days we no longer guarantee being able to restore a copy.
• Accounting records: 7 years, in line with the Income Tax Act.
• Sign-in / audit logs: 12 months.

8. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be informed of the use to which your personal data is put;
• access your personal data;
• request rectification of inaccurate or out-of-date data;
• request erasure of false or misleading data;
• object to the processing of your personal data and to withdraw consent at any time;
• data portability where technically feasible.

To exercise any of these rights, please email us at contact@edtrust.co.ke. We will respond within 7 days. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Britam Tower, Hospital Road, Nairobi.

9. Security

We apply technical and organisational measures appropriate to the risk: encryption in transit (TLS) and at rest, role-based access control, multi-factor authentication for staff, audit logs, regular backups, security reviews and continuous staff training.

10. Cookies

Our website uses essential cookies and, with your consent, analytics and marketing cookies. See our Cookie Policy for details.

11. Changes to this Policy

We may update this Policy from time to time. The date of the latest update is shown at the top of this page. Material changes will be notified by email or through an in-app notification.

12. Contact

• Email: contact@edtrust.co.ke
• Phone: +254 745 534 885
• Address: Konza Technopolis, Nairobi, Kenya