Privacy notice

Who is responsible

Each school decides what it records about its learners, parents and staff and why. For that data the school is the data controller and Chuoni is its data processor: we handle it only on the school's instructions and to provide the service.

For our own website, enquiries and the invoices we send schools, Chuoni Technologies Ltd is the data controller.

What we handle

• Learners: name, admission number, class and stream, attendance, marks, CBE levels, report-card remarks, portfolio work and, where the school uses it, Chuoni Learn progress.
• Parents and guardians: name, phone number, email, relationship to the learner, payments and the consent recorded when they verify.
• Staff: contact details, role, qualifications, documents, attendance and leave; for payroll, ID, KRA PIN, NSSF and SHA numbers, bank or M-Pesa details and pay.
• Clock-in: the phone's location at the moment a staff member clocks in, compared with the school boundary. Chuoni does not track anyone's location at any other time.
• Payments: amounts, references and the payment provider's confirmation. Card numbers are entered with the payment provider and never reach Chuoni.

Why we use it

To run the school's work that the data belongs to: billing and receipting fees, teaching and reporting on learning, managing and paying staff, and keeping parents informed. Some processing is required by law, such as tax and statutory deductions. Parents are linked to their children only after verifying with a code sent to the phone number the school already holds, and their consent is recorded at that point.

We never sell personal data and never use it for advertising.

Who can see it

Every record belongs to one school and is visible only inside it. Parents see only their own children. Teachers see only the classes they teach. The bursar sees fees but not marks or attendance. Payroll and staff private details are limited to the head, administrators and the bursar, and views of them are logged.

We use trusted service providers to run Chuoni, under contracts that require them to protect the data: cloud hosting and database services, email and SMS delivery, and the payment providers a school chooses. We disclose data to authorities only when the law requires it.

Where it is stored

Chuoni runs on cloud servers that may be outside Kenya. Where data is transferred outside Kenya, we rely on providers that apply appropriate safeguards for its protection, as the Data Protection Act requires.

How long we keep it

For as long as the school uses Chuoni, and afterwards only as long as the law requires: for example, financial and payroll records are kept for the periods tax law sets. A school can ask for its data to be exported and then deleted when it leaves.

How we protect it

Access rules in the database itself, encrypted connections, encrypted backups, payment and staff credentials sealed with encryption, and an audit trail of every money action, approval and change. Money records can be voided with a reason but never quietly edited or deleted.

Your rights

You may ask to see the data held about you or your child, have it corrected or deleted, object to its use, or have it given to you in a usable form. Please contact your school first, as it decides about its records; you can also contact us and we will help the school respond. You may also complain to the Office of the Data Protection Commissioner.

Changes

We will update this notice when how we handle data changes, and show the date at the top.