Loading SasaSchool...
Privacy Policy
School Management Information System (MIS)
Last updated: May 21, 2026
1. Introduction
SasaTech (“we,” “us,” or “our”) is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our School Management Information System (MIS).
We are registered with the Office of the Data Protection Commissioner (ODPC) in Kenya and comply with the Kenya Data Protection Act, 2019. This policy applies to all users of our system, including schools, administrators, teachers, students, and parents.
2. Data Controller Information
SasaTech
Address: Nairobi, Kenya
Email: privacy@sasatech.com
Phone: +254 XXX XXX XXX
ODPC Registration: [Registration Number]
Data Protection Officer: dpo@sasatech.com
3. Information We Collect
3.1 Personal Information
- • Names and contact details (email, phone numbers)
- • Date of birth and gender
- • National ID numbers and student admission numbers
- • NEMIS/KEMIS unique identifiers
- • Address and location information
- • Emergency contact information
3.2 Academic Information
- • Academic records and performance data
- • Assessment scores and competency tracking
- • Attendance records
- • Behavioral and disciplinary records
- • Special educational needs information
- • Extracurricular activities and achievements
3.3 Financial Information
- • Fee payment records and balances
- • Payment method information
- • Transaction history
- • Scholarship and financial aid information
- • Bank account details (for refunds)
3.4 Health and Medical Information
- • Medical conditions and allergies
- • Immunization records
- • Emergency medical information
- • Disability accommodations
- • Health insurance information
3.5 Technical Information
- • IP addresses and device information
- • Browser type and version
- • Operating system information
- • Usage patterns and analytics data
- • Log files and system events
- • Cookie and tracking information
4. How We Collect Information
4.1 Direct Collection
- • Information provided during registration and account creation
- • Data entered by school administrators and teachers
- • Information submitted through forms and surveys
- • Communication with our support team
- • Feedback and reviews provided by users
4.2 Automated Collection
- • Cookies and similar tracking technologies
- • Server logs and analytics tools
- • Mobile app usage data
- • System performance monitoring
- • Security monitoring and threat detection
4.3 Third-Party Sources
- • Government databases (NEMIS/KEMIS)
- • Payment processors (Paystack, banks)
- • SMS and email service providers
- • Educational content providers
- • Integration partners and APIs
5. How We Use Information
5.1 Educational Purposes
- • Student enrollment and registration management
- • Academic record keeping and progress tracking
- • Assessment and grading administration
- • Attendance monitoring and reporting
- • Curriculum management and lesson planning
- • Parent-teacher communication
5.2 Administrative Purposes
- • Fee collection and financial management
- • Staff and teacher management
- • Inventory and resource management
- • Event planning and scheduling
- • Regulatory compliance and reporting
- • Quality assurance and improvement
5.3 System Operations
- • System maintenance and optimization
- • Security monitoring and threat prevention
- • Performance analysis and improvement
- • Bug fixes and feature development
- • User support and troubleshooting
- • Backup and disaster recovery
5.4 Communication
- • Important announcements and notifications
- • Academic updates and progress reports
- • Fee reminders and payment confirmations
- • Event invitations and scheduling
- • Emergency communications
- • Marketing and promotional materials (with consent)
6. Legal Basis for Processing
6.1 Consent
- • Explicit consent for marketing communications
- • Parental consent for students under 18
- • Consent for third-party integrations
- • Consent for analytics and tracking
- • Withdrawal of consent at any time
6.2 Contract Performance
- • Service delivery and system operation
- • Fee collection and payment processing
- • User account management
- • Technical support and maintenance
- • Integration with third-party services
6.3 Legal Obligations
- • Compliance with education regulations
- • Government reporting requirements
- • Tax and financial record keeping
- • Data protection law compliance
- • Court orders and legal requests
6.4 Legitimate Interests
- • System security and fraud prevention
- • Service improvement and development
- • Analytics and performance monitoring
- • User experience optimization
- • Business operations and administration
7. Data Sharing and Disclosure
7.1 Within Your School
- • Authorized school administrators and staff
- • Teachers and educational personnel
- • Students (their own data only)
- • Parents (their children's data only)
- • School board members (aggregated data)
7.2 Government Authorities
- • Ministry of Education (NEMIS/KEMIS)
- • Kenya National Examinations Council (KNEC)
- • Teachers Service Commission (TSC)
- • Office of the Data Protection Commissioner
- • Law enforcement (with proper legal process)
7.3 Service Providers
- • Cloud hosting and storage providers
- • Payment processors (Paystack, banks)
- • SMS and email service providers
- • Analytics and monitoring services
- • Technical support and maintenance providers
7.4 Legal Requirements
- • Court orders and subpoenas
- • Regulatory investigations
- • Legal proceedings and disputes
- • Emergency situations and safety concerns
- • Compliance with applicable laws
8. Data Security
8.1 Technical Security
- • End-to-end encryption for data in transit and at rest
- • Multi-factor authentication for sensitive operations
- • Role-based access control (RBAC)
- • Regular security audits and penetration testing
- • Intrusion detection and prevention systems
- • Secure coding practices and vulnerability management
8.2 Organizational Security
- • Employee training on data protection
- • Background checks for personnel with data access
- • Confidentiality agreements and policies
- • Regular security awareness programs
- • Incident response procedures
- • Business continuity planning
8.3 Physical Security
- • Secure data centers with 24/7 monitoring
- • Access controls and biometric authentication
- • Environmental controls and fire suppression
- • Redundant power and network systems
- • Regular backup and disaster recovery testing
- • Cross-region data replication
9. Your Rights
9.1 Access and Information
- • Right to access your personal data
- • Right to information about data processing
- • Right to know the legal basis for processing
- • Right to know data retention periods
- • Right to know third-party recipients
9.2 Control and Correction
- • Right to rectification of inaccurate data
- • Right to erasure (subject to legal requirements)
- • Right to restrict processing
- • Right to data portability
- • Right to object to processing
9.3 Consent and Withdrawal
- • Right to withdraw consent at any time
- • Right to opt-out of marketing communications
- • Right to object to automated decision-making
- • Right to lodge complaints with authorities
- • Right to seek legal remedies
10. Data Retention
10.1 Retention Periods
- • Student records: 7 years after graduation/withdrawal
- • Financial records: 7 years for tax compliance
- • Academic records: 7 years for regulatory compliance
- • Audit logs: 3 years for security monitoring
- • Marketing data: Until consent withdrawal
- • Backup data: 30 days for disaster recovery
10.2 Deletion and Destruction
- • Secure deletion of data after retention period
- • Physical destruction of storage media
- • Verification of complete data removal
- • Documentation of deletion processes
- • Compliance with legal deletion requirements
11. International Data Transfers
11.1 Transfer Safeguards
- • Adequacy decisions for recipient countries
- • Standard contractual clauses (SCCs)
- • Binding corporate rules (BCRs)
- • Certification schemes and codes of conduct
- • Prior authorization from ODPC when required
11.2 Transfer Locations
- • Primary hosting: AWS Africa (Cape Town)
- • Backup locations: Multiple AWS regions
- • CDN services: Global distribution
- • Analytics services: EU/US providers
- • Support services: Local and international
12. Children's Privacy
12.1 Special Protections
- • Parental consent required for students under 18
- • Enhanced security measures for child data
- • Age-appropriate privacy notices
- • Limited data collection for children
- • Special deletion rights for child data
12.2 Parental Rights
- • Right to review child's data
- • Right to request deletion of child's data
- • Right to withdraw consent
- • Right to restrict processing
- • Right to object to processing
Contact Information
Data Protection Officer
Email: dpo@sasatech.com
Phone: +254 XXX XXX XXX
Address: Nairobi, Kenya
Privacy Support
General Privacy: privacy@sasatech.com
Data Rights: rights@sasatech.com
Complaints: complaints@sasatech.com