Privacy Policy

1. Scope, and who this policy is written for

SmartSkuli is a school-management product used by Kenyan schools (also referred to in the product as SmartSkuli, and in some documents by the working name "SmartSkuli"). Schools are our customers. This policy covers the data we process for a school, and it is written for three audiences at once: the school itself, the guardians and learners whose records the school keeps in SmartSkuli, and SmartSkuli's own staff.

This policy does not cover data an app store, a payment network or a telecom carrier collects independently of SmartSkuli under their own terms.

2. Controller and processor — the split the law requires

Under the DPA, a learner's school record has two parties responsible for it, and they carry different duties. The school is the data controller. It decides to enrol a learner, what to record about them, and who their guardians are. SmartSkuli is the data processor. We hold and process that data only on the school's instructions and only to run the service the school has asked us to run. We do not decide, on our own, to use a school's learner data for anything else.

The full contract terms for that processor relationship — what we may do with school data, our security obligations, our sub-processors, and what happens to the data if a school leaves — are set out in the Data Processing Agreement inside our Terms of Service. For a school's own account details, billing contact and staff logins, and for anyone who contacts us directly (a director filling in the contact form on this site, for example), SmartSkuli is itself the controller.

3. What we process

On a school's instructions, SmartSkuli processes:

• Learner records — name, admission number, KNEC assessment number, the learning areas a learner is enrolled in, CBC assessment records (performance levels against strands and sub-strands, and school-based assessment rubric records), and daily attendance.
• Guardian contact details — phone number, email address and WhatsApp number, and which learner(s) each guardian is linked to.
• Staff accounts — name, role and login details for teachers and office staff using SmartSkuli.
• Timetable data — for schools on a plan that includes the timetable module.
• Payment references — M-Pesa payment references matched to a learner by admission number. In the product, the payer's phone number is masked; SmartSkuli's systems retain what is needed to reconcile a payment against an invoice.
• Message records — a log of absence, fee and assessment messages sent to guardians and the channel each went out on (in-app, email, WhatsApp or SMS), so a school can show what was sent and when.

We do not process anything beyond what a school's own use of the product creates.

4. Why we process it

Only to run the service a school has signed up for, specifically to:

• keep the daily register and notify guardians of absence;
• record CBC assessment and produce the CBE Learner Progress Report;
• raise invoices, match M-Pesa payments to learners, and send statements and payment reminders;
• send guardians the messages a school configures, on the channel they have consented to;
• run the timetable, bus and staff-register modules where a school has bought them; and
• let a school export its own data on request.

5. Our legal basis under the Data Protection Act

As a processor, SmartSkuli relies on the school's own legal basis for processing — typically the school's contract with a guardian (enrolment) and its legitimate interest and legal obligations as an education provider. Where SmartSkuli is itself the controller (a school's billing account, or a director who contacts us directly), we rely on: performance of our contract with the school; our legitimate interest in operating and improving the product without overriding a person's rights; and consent, specifically for guardian messaging (see below).

6. Consent for messages to guardians

Messages to a guardian over WhatsApp, SMS and email are consent-gated. A school records a guardian's consent (and its date) before those channels are used, and a guardian can withdraw it. In-app messages inside the SmartSkuli app do not require this separate consent, since they are part of using the app itself. A fee message is never sent in a way that could reach more than one family.

7. What we do not do: the KNEC portal

SmartSkuli has no integration with the KNEC portal of any kind — no API connection, no upload, and no KNEC login held on a school's or a teacher's behalf. Teachers type assessment scores into the KNEC portal themselves. What SmartSkuli does is prepare those figures and lay them out in the order the portal asks for them, so that no KNEC credential, of any teacher or school, is ever in our possession.

8. Who else sees data, and where it is hosted

We use a small number of processors of our own to run the service — a category list, since the exact named providers are confirmed separately with each school's contract:

• an SMS gateway, to deliver absence, fee and result messages by SMS;
• WhatsApp / Meta Business Platform, for guardians who have consented to WhatsApp messages;
• M-Pesa / Safaricom, to receive and match payment references;
• our cloud hosting provider, to store and run the product.

Our sub-processors are Supabase (database hosting, Ireland), Fly.io (application hosting), Amazon Web Services (document storage, Ireland), Resend (email delivery), Africa's Talking (SMS delivery) and Paystack (payment processing). We do not sell data, and we do not share a school's data with another school.

SmartSkuli encrypts data in transit and at rest. This is a transfer of personal data outside Kenya, and under the DPA it is made subject to appropriate safeguards (for example, standard contractual clauses with the hosting provider). Learner records are held in Ireland with Supabase and Amazon Web Services. Transfers outside Kenya rely on the standard contractual clauses in each provider's data processing agreement .

9. How long we keep it

We keep a school's data for as long as the school's account is active, and for a period after it ends so the school can complete an export. Exact retention periods, by data category, are: learner and assessment records, seven years after a learner leaves, which is the period a school may be asked to produce them; guardian contact details and message logs, two years; payment references, seven years, to match the records a school keeps for audit. Where a school cancels, our Terms commit to giving the school 30 days' notice and the ability to export all of its data before any deletion.

10. Data subject rights

Under the DPA, a data subject (a guardian, a staff member, or a learner acting through their guardian or school) has the right to: be informed that their data is processed; access it; ask for correction of inaccurate data; object to processing; ask for deletion or restriction, subject to a school's own record-keeping duties; and data portability. Because the school is the controller of learner and guardian records, the first place to raise any of these is the school itself; SmartSkuli will assist a school in fulfilling a request, and will act directly on a request about a person's own SmartSkuli account (a staff login, or a director's contact details).

11. Learners are children

Learner records in SmartSkuli belong to children. The school, as controller, is responsible for the lawful basis for holding a learner's record and for obtaining any guardian consent the DPA requires for a child's data — including consent for guardian messaging above. SmartSkuli does not independently collect data directly from a learner; every learner record in the product is entered by the school.

12. Security

We apply administrative, technical and physical safeguards appropriate to the sensitivity of school and learner data — access limited to staff who need it, encrypted connections, and separation between schools' data.

13. If something goes wrong

If we become aware of a breach affecting a school's data, we will notify the affected school without undue delay so it can meet its own duty to notify the ODPC and affected data subjects where the DPA requires it. The exact notification timeline is set out in the Data Processing Agreement in our Terms of Service.

14. Changes to this policy

We will post any change to this policy on this page and update the date at the top. Material changes affecting how a school's data is used will be notified to the school directly.

15. Contact and complaints

Questions about this policy, or a request concerning your own data, can be sent to [email protected]. Our registered address is Kilimani, Nairobi, Kenya (our office is at Greenhouse Towers, Ngong Road, Nairobi). Our Data Protection Officer / privacy contact is Iain Mosima, reachable at the address above.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya's data-protection regulator, at odpc.go.ke.