1. INTRODUCTION AND SCOPE

1.1 Introduction

[Company Name] (the “Company”, “we”, “us” or “our”) operates an online tutoring and learning platform (the “Platform”) that connects Students, Parents or Guardians, Tutors and other Users with tutoring, educational and related services.

This Privacy Policy explains how we collect, use, store, disclose and otherwise process personal information in connection with the Platform and its Services, in accordance with applicable data-protection laws, including Kenya’s Data Protection Act, 2019, and applicable regulations.

1.2 Scope

This Privacy Policy applies to personal information processed in connection with the Platform relating to:

• (a) Students and prospective Students;
• (b) Parents or Guardians;
• (c) Tutors and prospective Tutors;
• (d) other persons who register for, access or use the Platform;
• (e) persons who contact us, submit enquiries or complaints, or otherwise communicate with us;
• (f) persons participating in referrals, promotions or other Platform-related activities; and
• (g) other individuals whose personal information we lawfully process in connection with the Platform.

It covers personal information collected directly from individuals, generated through their use of the Platform or received from authorised third parties, subject to applicable law.

1.3 Relationship with Terms and Conditions

This Privacy Policy should be read together with the Platform General Terms and Conditions, Tutor Terms and Conditions and any other applicable policies or privacy notices.

The Terms and Conditions govern contractual rights, obligations and the use of the Platform, while this Privacy Policy explains how personal information is processed. Additional privacy notices may apply to particular features or Services.

Nothing in this Privacy Policy authorises processing that is prohibited by law. Where mandatory legal requirements apply, those requirements prevail.

1.4 Definitions

For purposes of this Privacy Policy, unless the context requires otherwise:

• (a) Personal Information or Personal Data means information relating to an identified or identifiable natural person, as defined under applicable data-protection law.
• (b) User means any person who registers for, accesses or uses the Platform or its Services.
• (c) Student means a person who accesses or receives tutoring or educational services through the Platform.
• (d) Parent or Guardian means a parent, legal guardian or other person legally authorised to act on behalf of a Student where applicable.
• (e) Tutor means a person registered or seeking registration to provide tutoring services through the Platform.
• (f) Processing means any operation performed on personal information, including collection, recording, organisation, storage, use, disclosure, transfer, restriction or deletion.
• (g) Services means the tutoring, educational and related services made available through the Platform.

These definitions are intended to assist interpretation and do not restrict any broader or different definition required by applicable law.

2. PERSONAL INFORMATION WE COLLECT

2.1 Information Provided Directly by Users

Depending on the User's relationship with the Platform and the Services involved, we may collect personal information provided directly by the User or by an authorised representative, including:

2.1.1 Account and Identity Information

Names, identification details, usernames, account identifiers, login and authentication information, email addresses, telephone numbers, dates of birth or age information where necessary, profile details, preferences and documents required for identity verification or account administration.

2.1.2 Student and Educational Information

Class or grade, curriculum, subjects, learning goals, learning needs and preferences, assignments, questions, submitted work, attendance, participation, lesson history, progress reports, feedback, assessments and other educational information reasonably necessary to provide or administer the Services.

2.1.3 Parent or Guardian Information

Names, contact details, relationship to the Student, information required to verify parental or guardian authority, permissions, consents and authorisations, and communications concerning bookings, learning progress, safeguarding or support.

2.1.4 Tutor Information

Identity and contact details, academic and professional qualifications, teaching experience, subjects and relevant training, Teachers Service Commission (TSC) details where applicable, verification documents, approved profile information, preferences, availability, performance records, lesson-delivery information, compliance records and relevant complaints.

2.1.5 Communications and User-Submitted Content

Messages, enquiries, complaints, support requests, reviews, ratings, feedback, uploaded documents, images, audio or video, lesson notes, assignment records, educational materials and communications submitted through authorised Platform features.

2.1.6 Payment and Transaction Information

Subscription and booking details, transaction references, payment status and amounts, refunds, cancellations, payment disputes and other transaction-related information. Depending on the payment method, payment card details, mobile-money credentials or other sensitive payment information may be handled directly by the relevant payment provider.

2.2 Information Collected Through Platform Use

We may collect technical, usage and activity information generated when Users access or use the Platform, including:

• (a) Internet Protocol (IP) addresses and device or browser information;
• (b) login, access and session records;
• (c) Platform features accessed and actions performed;
• (d) booking, attendance and lesson-activity information;
• (e) error reports, diagnostic information and security logs;
• (f) cookie identifiers and similar technologies where used; and
• (g) other technical information reasonably necessary to operate, secure, maintain or troubleshoot the Platform.

The information collected will depend on the features used, the device and the relevant settings.

2.3 Information Received from Other Sources

Where lawful and necessary, we may receive personal information from:

• (a) Parents, Guardians or other authorised representatives;
• (b) Tutors and other Users;
• (c) identity, qualification and verification providers;
• (d) payment providers and financial institutions;
• (e) hosting, security, communication and other technical service providers;
• (f) persons submitting complaints or safeguarding reports; and
• (g) public authorities, regulators or other lawful sources.

Personal information received from these sources will be handled in accordance with this Privacy Policy and applicable law.

2.4 Information We Do Not Intentionally Require

Users should not submit personal, confidential or sensitive information that is unnecessary for the relevant Platform purpose.

We seek to limit collection to information reasonably necessary for specified purposes. Where sensitive personal information is required, its processing must satisfy the additional legal requirements and safeguards described in Clause 4.9.

2.5 Accuracy of Information

Users must provide accurate information and update it as reasonably necessary. A person providing information about another individual must have the authority required by law.

We may request clarification, correction or additional verification where reasonably necessary to maintain accurate records, protect Users or comply with applicable law.

2.6 Mandatory and Optional Information

Certain personal information may be required by law or may be necessary to register or administer an account, verify identity or eligibility, provide the Services, process transactions, protect Users or meet applicable Platform requirements. Other information may be optional.

Where practicable, we will identify information that is mandatory or optional at the point of collection and explain the consequences of not providing the requested information. Where information is required by law, we will indicate this where practicable.

Failure to provide information that is necessary for a particular purpose may prevent us from creating or activating an account, completing verification, providing a relevant Service or feature, processing a transaction or taking another action for which the information is required. Where information is optional, declining to provide it will not prevent access to unrelated Services, although certain preferences or features may be unavailable.

3. HOW WE USE PERSONAL INFORMATION

We process personal information for the purposes set out below, subject to the lawful bases and additional conditions described in Section 4.

3.1 Account Registration, Verification and Administration

We process personal information to register, verify, activate, maintain, manage, restrict, suspend or close accounts and to determine eligibility to access or use the Platform.

The registration, parental or guardian authorisation, verification and activation requirements for minor Students are governed by Clause 2.2 of the Platform General Terms and Conditions and applicable law.

3.2 Providing Tutoring and Educational Services

We process personal information as reasonably necessary to:

• (a) match Students with Tutors and facilitate authorised access to tutoring services;
• (b) manage bookings, schedules, attendance, cancellations and rescheduling;
• (c) facilitate online lessons, assignments, assessments, feedback and other learning activities;
• (d) maintain educational records, review learning progress and provide relevant information to authorised Users;
• (e) enable authorised communications through approved Platform channels; and
• (f) administer subscriptions, referrals, promotions and other Services or Platform features.

3.3 Access to Lesson Recordings

Access to lesson recordings is restricted to the participants of the relevant class and the Tutor who conducted the lesson. A Student may access the recording through their Platform profile, subject to the Platform’s access controls and applicable retention period.

A Parent or Guardian who is authorised to act on behalf of a minor Student may access that Student’s lesson recordings through the Student’s Platform profile or an authorised parent or guardian account linked to that profile. Such access is limited to recordings associated with the relevant Student and does not permit access to recordings of other classes in which the Student did not participate.

Platform staff and administrators will not have routine access to lesson recordings merely by virtue of their role. Authorised personnel may access a recording where reasonably necessary for safeguarding, investigating a complaint or incident, resolving a dispute, providing technical support, maintaining platform security or complying with a legal obligation. Such access must be limited to what is necessary for the relevant purpose.

All access to lesson recordings is subject to the Platform’s access controls, applicable retention periods, safeguarding requirements and data-protection obligations.

3.4 Communications and Customer Support

We process personal information to respond to enquiries and support requests, communicate about accounts, bookings, lessons, payments, Platform changes and Services, investigate complaints and disputes, address suspected misconduct or breaches of Platform rules, and maintain relevant records.

Any review or monitoring of communications must be consistent with applicable Platform rules, privacy requirements and law.

3.5 Payments and Transactions

We process personal information and transaction records to administer subscriptions, payments, refunds, cancellations, referral transactions and payment disputes, verify transaction status, maintain accounting records, prevent fraud and meet applicable financial or legal obligations.

Where third-party payment providers are involved, their processing is subject to the relevant service arrangements and applicable law, including their applicable terms and privacy notices.

3.6 Safety, Security and Enforcement

We may process personal information where reasonably necessary to:

• (a) protect Students, children, Tutors, other Users and the Platform;
• (b) enforce the Terms and Conditions and applicable Platform policies;
• (c) detect, prevent or investigate fraud, abuse, unauthorised access, impersonation, safeguarding concerns or prohibited conduct; and
• (d) take appropriate protective or enforcement action.

We may review relevant information and records for these purposes where lawful and reasonably necessary.

3.7 Platform Operation, Maintenance and Improvement

We process personal information to operate, maintain, troubleshoot, secure and test the Platform, resolve technical errors, understand the use of Services and develop or evaluate Platform features.

Where practicable, we use aggregated, anonymised or minimised information for analytics and service evaluation. The use of artificial intelligence tools or other third-party technical services must remain subject to applicable contractual terms, this Privacy Policy and applicable law.

3.8 Legal and Regulatory Obligations

We may process or disclose personal information where reasonably necessary to comply with legal or regulatory obligations, respond to lawful requests from authorities, establish or defend legal claims, protect legal rights or cooperate with lawful investigations.

Any disclosure must be lawful and limited to information relevant to the applicable purpose.

3.9 Other Authorised Purposes

We may process personal information for an additional purpose where that purpose is compatible with the original purpose or is otherwise lawful.

Where a new purpose requires consent or another legal condition, we will satisfy that requirement before proceeding, unless applicable law permits otherwise.

4. LEGAL BASES FOR PROCESSING PERSONAL INFORMATION

4.1 General Principle

We process personal information only where an appropriate lawful basis exists under Kenya's Data Protection Act, 2019, applicable regulations or other applicable law.

The lawful basis depends on the particular processing activity and the circumstances in which the information is processed.

4.2 Performance of a Contract and Pre-Contractual Steps

We may process personal information where necessary to enter into or perform a contract with a User, or to take steps requested by the User before entering into a contract.

This may include account administration, arranging tutoring services, managing bookings, maintaining lesson records, administering payments and handling contractual disputes.

4.3 Compliance with Legal Obligations

We may process personal information where necessary to comply with applicable legal or regulatory obligations, including those relating to data protection, child safeguarding, recordkeeping, financial transactions and lawful requests from authorities.

4.4 Consent

We may rely on consent where it is an appropriate lawful basis. Where consent is legally required, it must be freely given, specific, informed and unambiguous, and must be obtained and recorded in accordance with applicable law.

Where an individual withdraws consent, the withdrawal will not affect the lawfulness of processing carried out before withdrawal. We will assess whether continued processing is permitted under another lawful basis, rather than assuming that the prior provision of information automatically authorises further processing.

4.5 Legitimate Interests

We may process personal information where necessary for our legitimate interests or those of a third party, provided those interests are not overridden by the individual's rights and freedoms.

Relevant interests may include Platform security, fraud prevention, enforcement of Platform requirements, complaint handling, protection of Users, service quality and the establishment or defence of legal claims.

We will consider the purpose of the processing, the individual's reasonable expectations and the potential impact on their rights and freedoms.

4.6 Protection of Vital Interests

Where the legal requirements are met, we may process personal information where necessary to protect the vital interests of an individual, particularly where there is a threat to life or a serious threat to health or safety.

4.7 Public Interest and Official Authority

Where applicable, we may process personal information for a task carried out in the public interest, under official authority or under another legally permitted public-interest basis, provided the relevant legal conditions are satisfied.

4.8 Research, Statistics and Related Purposes

Where permitted by law, we may process personal information for qualifying historical, statistical, journalistic, literary, artistic or scientific research purposes, subject to applicable legal requirements and safeguards.

Where practicable, we will use aggregated or anonymised information for statistical purposes and service evaluation. Where information is treated as anonymised, it must no longer identify an individual in accordance with applicable law.

4.9 Sensitive Personal Information and Children's Information

The processing of sensitive personal information and children's personal information must satisfy any additional requirements and safeguards imposed by applicable law. Establishing a general lawful basis does not, by itself, satisfy every additional condition that may apply.

Parental or guardian authorisation will be obtained where required by law. The registration, verification, authorisation and activation requirements for minor Students are governed by Clause 2.2 of the Platform General Terms and Conditions.

4.10 Determination of the Applicable Lawful Basis

We determine the appropriate lawful basis before carrying out the relevant processing and do not assume that one basis necessarily applies to every activity involving the same personal information.

Where a particular activity requires specific consent, authorisation or another legal condition, that requirement must be satisfied before processing begins, except where applicable law permits otherwise.

Further processing must remain compatible with the original purpose or otherwise be permitted by law.

5. DISCLOSURE AND SHARING OF PERSONAL INFORMATION

5.1 General Conditions for Disclosure

We may disclose personal information to the recipients and in the circumstances described in this Section, subject to the purposes and lawful bases set out in Sections 3 and 4, the applicable provisions of the General Terms and Conditions, and applicable data-protection law.

5.2 Sharing with Other Platform Users

We may make relevant personal information available to Students, Parents or Guardians, and Tutors where reasonably necessary for the provision or administration of the relevant Services and where the disclosure is lawful.

Such information may include student or tutor profile information, booking and scheduling details, attendance information, and relevant educational or lesson-related records.

Access is limited to information appropriate to the recipient’s authorised role. Use of the Platform or participation in a class does not, by itself, authorise access to another person’s personal information.

5.3 Sharing with Parents or Guardians

We may disclose a Student’s personal information to a Parent or Guardian where the disclosure is lawful and that person is authorised to receive the information. Applicable authorisation and access requirements, including those concerning minors, shall be governed by the relevant provisions of the General Terms and Conditions and applicable law.

5.4 Third-Party Service Providers

We may disclose personal information to third-party service providers engaged to support or operate the Platform, including providers of:

• (a) hosting, cloud storage and technical infrastructure;
• (b) payment processing and financial services;
• (c) communications and notification services;
• (d) identity, qualification and other verification services;
• (e) cybersecurity, fraud prevention and technical support;
• (f) analytics and Platform performance services; and
• (g) artificial intelligence and other technical services used for authorised Platform features.

Where a provider processes personal information on our behalf, we will apply appropriate contractual, technical and organisational safeguards as required by applicable law. Providers may process information only within the scope of their authorised role and applicable arrangements.

5.5 Payment and Financial Transactions

We may disclose relevant transaction information to payment service providers, financial institutions and other parties involved in processing payments, verifying transactions, administering refunds or resolving payment disputes.

Where a recipient processes personal information independently under its own legal obligations or privacy arrangements, that processing will be subject to applicable law.

5.6 Verification, Safeguarding and Compliance

Where lawful and reasonably necessary, we may disclose relevant personal information to verification providers, professional or regulatory bodies, safeguarding service providers or other appropriate recipients for verification, investigation, compliance or protective purposes.

5.7 Professional Advisers

We may disclose relevant personal information to our lawyers, auditors, accountants, insurers and other professional advisers where necessary for the services they provide, subject to applicable confidentiality obligations and data-protection requirements.

5.8 Public Authorities and Legal Proceedings

We may disclose personal information to courts, regulators, law-enforcement agencies, government authorities or other relevant recipients where required or permitted by applicable law, in response to a lawful request or order, or where lawfully necessary for legal proceedings or the protection of legal rights.

Where appropriate and lawful, we will limit the disclosure to the information required or reasonably necessary for the relevant matter.

5.9 Corporate Transactions

In connection with a proposed or completed merger, acquisition, restructuring, financing or sale of all or part of the Company’s business or assets, we may disclose relevant personal information to prospective or actual transaction participants and their professional advisers where necessary and permitted by law.

Any subsequent processing or transfer must comply with applicable data-protection requirements.

5.10 User-Authorised Disclosure

We may disclose personal information to a recipient at a User’s valid request or with appropriate authorisation, provided the disclosure is lawful. Where the information concerns another person, including a child, any required authority or consent must be established in accordance with applicable law.

5.11 Limits on Disclosure

Nothing in this Section grants unrestricted permission to disclose personal information or overrides applicable legal requirements, authorised access restrictions or relevant provisions of the General Terms and Conditions.

6. DATA RETENTION AND DELETION OF PERSONAL INFORMATION

6.1 Retention of Personal Information

We will retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected or is otherwise lawfully processed, taking into account the nature and sensitivity of the information, the purposes of processing, whether the information remains necessary for the provision or administration of the Services, and applicable legal requirements.

6.2 Deletion or Anonymisation

When personal information is no longer reasonably necessary for a lawful purpose and no legal obligation or other lawful basis requires its continued retention, we will take reasonable steps to delete, destroy or anonymise it in accordance with applicable law and our data-retention procedures.

Where personal information is anonymised so that an individual can no longer reasonably be identified from it, the anonymised information may be retained and used for lawful statistical, analytical, research or other permitted purposes.

6.3 Exceptions to Deletion

Personal information may be retained for longer where reasonably necessary to comply with legal or regulatory obligations, maintain required accounting or other records, address complaints or disputes, investigate suspected fraud or misconduct, protect the rights or security of Users or the Platform, or establish, exercise or defend legal claims.

6.4 Account Closure and Continued Retention

Closing, deactivating or ceasing to use an account does not necessarily result in the immediate deletion of all personal information associated with that account. Any continued retention and subsequent deletion or anonymisation will be governed by this Section, applicable law and our data-retention procedures.

6.5 Backups and Archived Records

Personal information contained in backups or archived records may remain stored for a limited period after deletion from active systems where reasonably necessary for system recovery, security, operational continuity or legal compliance. Such information will remain subject to appropriate safeguards and will be deleted or overwritten in accordance with our data-retention procedures, unless its continued retention is lawfully required.

6.6 Retention of Lesson Recordings

6.6.1 Routine Retention Period

Lesson recordings will ordinarily be retained for ninety (90) days from the date of the relevant lesson. This period supports legitimate educational, administrative, safeguarding, security and ordinary complaint-resolution purposes. Recordings will not be retained for longer than necessary for the purposes for which they are maintained, subject to applicable law and the provisions of this Clause 6.6.

6.6.2 Safeguarding, Complaints and Investigations

A lesson recording may be retained beyond the routine retention period where reasonably necessary for a safeguarding concern, complaint, investigation, incident review or related appeal. Such retention must be limited to the recording or portion of the recording reasonably relevant to the matter and must continue only for as long as necessary for the relevant purpose, subject to applicable law.

6.6.3 Legal Claims and Legal Obligations

A lesson recording may be retained beyond the routine retention period where required by law, necessary to establish, exercise or defend a legal claim, or subject to a valid legal hold or other lawful retention requirement. Access to any such recording will remain restricted to authorised persons with a legitimate need to access it.

6.6.4 Review of Extended Retention

An authorised Platform administrator will periodically review lesson recordings retained beyond the routine retention period. The review will consider the reason for continued retention, whether that purpose remains valid, whether continued retention is necessary and proportionate, and whether the recording can be deleted or anonymised. Where the relevant purpose has been fulfilled and no lawful basis or legal obligation requires further retention, the recording will be deleted or anonymised without undue delay.

6.6.5 Deletion and Anonymisation

At the end of the applicable retention period, or when a recording is no longer reasonably necessary for its intended purpose, the Platform will delete or anonymise the recording, unless continued retention is permitted or required under this Clause 6.6 or applicable law. Where recordings are held in backup systems, they will be removed in accordance with the applicable backup-deletion cycle. Until removed from backups, they will not be accessed, restored or otherwise used except where reasonably necessary for system security, disaster recovery or a lawful purpose.

6.6.6 Access and Protection During Retention

The retention of a recording does not give every Student, Parent or Guardian, Tutor or other User an automatic right to access it. Access remains subject to Clause 3.3 and the Platform’s applicable access controls, permissions, safeguarding requirements, privacy obligations and legal requirements. Recordings retained beyond the routine retention period will remain subject to appropriate access restrictions and protection against unauthorised access, use or disclosure.

7. DATA SECURITY AND PROTECTION

7.1 Security Measures

We will implement and maintain appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration, disclosure, destruction or other unlawful processing, taking into account the nature of the information, the purposes of processing, the risks involved and applicable legal requirements.

As appropriate to the nature and risks of the processing, such measures may include access controls and authentication, safeguards for the storage and transmission of information, backup and recovery arrangements, confidentiality requirements, security monitoring and procedures for responding to security incidents.

7.2 Access Controls and Confidentiality

Access to personal information will be restricted to persons and service providers who are authorised to access it for legitimate and permitted purposes. We will apply appropriate access controls, confidentiality obligations and other safeguards to help prevent unauthorised access, disclosure or use, in accordance with applicable law.

Users must comply with the account-security, confidentiality and information-handling obligations applicable to them under the General Terms and Conditions and other relevant Platform policies.

7.3 Security Monitoring and Incident Response

We may monitor and review relevant systems, access activities and security events to help detect, prevent and respond to suspected security incidents, unauthorised access, fraud or other threats to personal information.

Where a personal data breach occurs, we will take appropriate steps to assess, contain, investigate and address the incident. We will notify the Data Commissioner, affected data subjects or other relevant persons within the applicable periods and in the circumstances required by Kenyan data-protection law.

7.4 Limitations of Security

Although we take measures designed to protect personal information, no electronic system, internet transmission or storage method can be guaranteed to be completely secure. Accordingly, we cannot guarantee absolute security against every possible threat, unauthorised access or security incident.

7.5 Reporting Security Concerns

Users should promptly report any suspected unauthorised access to, loss of, disclosure of or other security incident affecting personal information processed through the Platform using the Platform's designated reporting channels or official contact details. Where the concern relates to a User's account, the applicable account-security requirements in the General Terms and Conditions also apply.

8. YOUR DATA PROTECTION RIGHTS AND HOW TO EXERCISE THEM

8.1 Your Data Protection Rights

Subject to applicable law and the circumstances of the relevant processing, you may exercise rights concerning your personal information, including the right to:

1. be informed about how your personal information is collected, used and otherwise processed;
2. request access to your personal information held by or on behalf of the Platform and obtain a copy where applicable;
3. request correction or rectification of personal information that is inaccurate, incomplete, outdated, false or misleading;
4. request deletion or erasure of personal information where the applicable legal requirements for deletion or erasure are satisfied;
5. object to the processing of all or part of your personal information, subject to any lawful grounds that permit the processing to continue;
6. request restriction of processing where permitted by applicable law;
7. request the portability of your personal information where the applicable legal requirements are satisfied;
8. withdraw consent where your consent is the lawful basis for the relevant processing, subject to Clause 8.5; and
9. exercise applicable rights relating to decisions based solely on automated processing, including profiling, where such decisions produce legal effects concerning you or significantly affect you.

The availability and scope of these rights depend on applicable law and the circumstances of the relevant processing. Nothing in this Section is intended to exclude or restrict a right that cannot lawfully be excluded or restricted.

8.2 How to Exercise Your Rights

You may submit a request to exercise your data protection rights using the contact details provided in this Privacy Policy or any designated channel made available by the Platform for privacy-related requests.

Your request should identify the right you wish to exercise and provide sufficient information for us to understand and assess it. We may request additional information where reasonably necessary to clarify the request, verify your identity or establish your authority to act on behalf of another person.

We will handle requests in accordance with applicable law, including the applicable requirements concerning response periods, verification, applicable fees and the information to be provided to the person making the request.

8.3 Identity, Authority and Requests Concerning Children

We may take reasonable and proportionate steps to verify the identity of a person making a request and, where applicable, that person's authority to act on behalf of another individual.

A request concerning a child may be made by a parent or guardian with the necessary parental authority, or another person duly authorised to act on the child's behalf, in accordance with applicable law. We may request evidence of the relevant relationship or authority where reasonably necessary.

Requests concerning a child's personal information will be handled in accordance with applicable law, the child's rights and best interests, and the relevant parent or guardian authorisation provisions of the General Terms and Conditions.

8.4 Assessment and Handling of Requests

We will assess each request in light of applicable law and the circumstances of the relevant processing.

We may decline, limit or defer a request only where permitted or required by applicable law, including where necessary to protect the rights and freedoms of others, preserve legally required records, maintain appropriate security, comply with legal obligations or establish, exercise or defend legal claims.

Where we decline, limit or defer a request, we will provide the explanation or other information required by applicable law. Any refusal or limitation will not affect rights or remedies available to the individual under applicable law.

8.5 Withdrawal of Consent

Where personal information is processed on the basis of your consent, you may withdraw that consent through an appropriate mechanism made available by the Platform or by contacting us through the designated privacy-related channels.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Where another lawful basis permits or requires continued processing, we may continue to process the relevant information to the extent permitted by applicable law.

Withdrawal of consent does not automatically require the deletion of all personal information associated with your account. Any deletion or continued retention will be assessed in accordance with Section 6 of this Privacy Policy and applicable law.

8.6 Decisions Based on Automated Processing

Where the Platform makes a decision based solely on automated processing, including profiling, and that decision produces legal effects concerning you or significantly affects you, applicable legal protections may entitle you to request reconsideration or a decision that is not based solely on automated processing, subject to the conditions and exceptions provided by law.

Where required by applicable law, we will provide relevant information about the automated decision and respond to a request for reconsideration in accordance with the applicable legal requirements.

8.7 Privacy-Related Complaints

If you believe that your personal information has been processed in violation of your rights or applicable data-protection law, you may raise the matter with us through the contact details provided in this Privacy Policy.

We will handle privacy-related complaints in accordance with applicable legal requirements and our relevant procedures.

9. INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION

9.1 Transfers Outside Kenya

Personal information may be transferred to, stored in, accessed from or otherwise processed in a country outside Kenya where necessary for the operation, provision, maintenance or support of the Platform and its Services, subject to applicable data-protection law.

9.2 Conditions for International Transfers

We will ensure that any transfer of personal information outside Kenya complies with applicable legal requirements. Depending on the circumstances, this may require appropriate data-protection safeguards, an applicable adequacy determination, a transfer necessary for a legally recognised purpose, consent or another lawful transfer mechanism permitted by applicable law.

9.3 Transfers of Sensitive Personal Data

Where sensitive personal data is transferred outside Kenya, we will comply with the additional requirements applicable to such transfers, including obtaining the required consent and confirmation of appropriate safeguards where required by law.

9.4 Safeguards for Transferred Information

Where personal information is transferred outside Kenya, we will take appropriate measures required by applicable law to protect the information and safeguard the rights of the individuals concerned. Such measures may include appropriate contractual arrangements, restrictions on the recipient's use or disclosure of the information, and other safeguards required by the circumstances and applicable law.

10. COOKIES AND SIMILAR TECHNOLOGIES

10.1 Use of Cookies and Similar Technologies

The Platform may use cookies and similar technologies, including local storage and other technologies that store or access information on a User's device, where necessary or appropriate for the operation, security, maintenance or improvement of the Platform and its features.

These technologies may recognise a browser or device, maintain a session, remember preferences or support other authorised Platform functions.

10.2 Purposes of Use

Where used, cookies and similar technologies may support purposes including:

1. enabling account login, session management and essential Platform functionality;
2. maintaining Platform security, detecting unauthorised activity and preventing misuse;
3. remembering User preferences and settings;
4. understanding Platform performance and usage, diagnosing technical problems and improving functionality; and
5. supporting other lawful purposes described in this Privacy Policy, subject to applicable data-protection requirements.

10.3 Third-Party Technologies

The Platform may use technologies provided by third parties to support authorised Platform functions, including analytics, security, communications or other technical services.

Where such technologies involve the processing or disclosure of personal information by third parties, that processing will be subject to the applicable provisions of this Privacy Policy, including Section 5 on disclosure and sharing and Section 9 on international transfers, where relevant.

10.4 User Choices and Controls

Where appropriate, Users may manage cookie preferences through settings or controls made available by the Platform or through their browser or device settings.

Where applicable law requires consent or another form of user choice for particular cookies or similar technologies, the Platform will apply the relevant requirements before using those technologies.

Disabling or restricting certain cookies or similar technologies may affect account access, security, preferences or the availability or proper functioning of some Platform features.

10.5 Personal Information and Retention

Information collected through cookies or similar technologies that constitutes personal information will be processed in accordance with this Privacy Policy and applicable law.

The retention, deletion or anonymisation of such information will be governed by Section 6 of this Privacy Policy and any applicable legal requirements.

11. PERSONAL INFORMATION RELATING TO CHILDREN

11.1 Protection of Children's Personal Information

Where we process personal information relating to a child, we will do so in accordance with applicable Kenyan data-protection and child-protection laws. Such processing will be carried out lawfully, fairly and transparently, with due regard to the child's rights, privacy, safety and best interests.

11.2 Parental or Guardian Authorisation

Where required by applicable law, we will obtain the necessary consent or authorisation from a parent or guardian and undertake appropriate verification measures before processing a child's personal information for the relevant purpose.

The procedures governing age verification, parental or guardian authorisation, verification of authority and activation of a child's account are set out in the General Terms and Conditions and applicable Platform procedures. This Section should be read together with those provisions.

11.3 Additional Safeguards for Children

We will apply appropriate safeguards when processing children's personal information, taking into account the nature and sensitivity of the information, the purpose of processing, the child's age and the risks involved.

Where appropriate or required by law, we may apply additional access restrictions, verification requirements or other protective measures to features and Services involving children. Access to, disclosure of and requests concerning a child's personal information will also be governed by Sections 5, 7 and 8 of this Privacy Policy, as applicable.

12. AI-ASSISTED FEATURES AND PERSONAL INFORMATION

12.1 Processing Through AI-Assisted Features

The Platform may provide AI-assisted learning tools and other AI-powered features to support educational activities and Platform functionality. When a Student interacts with an AI-assisted feature, the Student’s text prompts and messages may be processed by the Platform and authorised third-party AI service providers to generate responses and provide the relevant functionality, subject to this Privacy Policy and applicable law.

12.2 Third-Party AI Service Providers

The Platform may use third-party AI service providers to support AI-assisted learning features. Where a provider processes personal information in connection with these features, the processing may also be subject to the provider’s applicable terms, privacy notices and data-handling practices, as well as applicable data-protection requirements.

Information submitted through an AI-assisted feature may be processed by the relevant provider as necessary for the functionality being used. Relevant disclosures and international transfers of personal information remain subject to Sections 5 and 9 of this Privacy Policy and applicable law.

12.3 Data Minimisation and User Precautions

Users should avoid submitting personal, confidential or sensitive information through AI-assisted features where that information is not reasonably necessary for the intended activity. Users should also avoid submitting another person's personal information unless they are authorised to do so and the submission is lawful.

The Platform may implement reasonable measures designed to limit the collection, use or transmission of unnecessary personal information through AI-assisted features, taking into account the nature of the feature, the risks involved and applicable law.

12.4 Third-Party AI Services and Responsibility

12.4.1

Where a User voluntarily submits Personal Information or User Content directly to a third-party artificial intelligence service, or where such information is processed within a third-party service outside the Platform’s custody or control, the handling of that information by the third-party provider shall be subject to the provider’s applicable terms, privacy policy, and data-handling practices.

12.4.2

To the extent permitted by applicable law, the Platform shall not be responsible for the independent acts or omissions of a third-party AI provider in relation to information that is outside the Platform’s custody or control, including the provider’s independent storage, retention, use, disclosure, or deletion of that information.

12.4.3

Lesson recordings are not sent to third-party AI service providers for AI processing. They are not used to train or develop AI models except where the Platform separately obtains any consent or authorisation required by applicable law, as provided in Clause 11.2.9 of the General Terms and Conditions.

The processing of lesson recordings for educational, administrative, safeguarding, security or dispute-resolution purposes remains subject to the relevant provisions of this Privacy Policy and the General Terms and Conditions.

12.4.4

The Platform does not warrant or guarantee the privacy, security, accuracy, availability, or continued confidentiality of information processed independently by a third-party AI provider. Users are encouraged to review the provider’s applicable terms and privacy policy before submitting Personal Information or User Content directly to that provider.

12.4.5

Nothing in this Clause excludes or limits the Platform’s responsibility for its own acts or omissions, its own disclosures or integrations involving third-party AI services, or any obligation imposed on the Platform under applicable data-protection law. Where the Platform itself determines the purposes or means of processing, or otherwise has legal responsibilities in relation to the relevant processing, those responsibilities shall remain subject to applicable law.

12.5 Children's Personal Information and AI Features

The processing of a child's personal information through AI-assisted features will remain subject to Section 11 of this Privacy Policy, the relevant parent or guardian authorisation requirements in the General Terms and Conditions, and applicable law. The Platform may apply additional restrictions, verification or safeguards where reasonably necessary or legally required.

13. CHANGES TO THIS PRIVACY POLICY

13.1 Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our processing of personal information, Platform features, technology, operational practices, applicable legal requirements or other relevant circumstances, subject to applicable law.

13.2 Publication and Notification of Changes

Where this Privacy Policy is updated, we will publish the revised version through the Platform and update the effective or last-updated date, as appropriate.

Where applicable, we may use the communication channels and notification procedures described in Section 23 (Changes to These Terms) of the General Terms and Conditions to notify Users of changes to this Privacy Policy, subject to any additional requirements imposed by applicable law.

13.3 Changes Requiring Further Notice or Consent

Where a change introduces a new purpose for processing personal information, materially alters the relevant processing, or otherwise triggers a notice, consent or other legal requirement, we will comply with the applicable requirements before undertaking the affected processing, where required by law.

14. CONTACT US

14.1 Privacy-Related Enquiries and Requests

If you have questions about this Privacy Policy or wish to make an enquiry, request or complaint concerning the processing of your personal information, you may contact us using the details below:

Email: support@vazaki.com

Address: Nairobi

Telephone: 0797606888/ 0797606912

14.2 Handling of Privacy-Related Requests

Requests to exercise data protection rights and privacy-related complaints will be handled in accordance with Sections 8.2, 8.4 and 8.7 of this Privacy Policy, as applicable, and the requirements of Kenyan data-protection law.

14.3 Updates to Contact Details

We may update our contact details from time to time. Updated contact details will become effective when published through the Platform or otherwise communicated to Users, subject to applicable law.