Data processing terms
How NyotaSkul processes school data on a school's behalf, as section 42 of the Data Protection Act, 2019 requires.
Last updated 25 October 2026. These terms form part of our terms of service.
1. Scope and roles
These terms apply when NyotaSkul ("NyotaSkul") processes personal data in a school's workspace on behalf of the school. For that data, the school is the data controller and NyotaSkul is the data processor under the Data Protection Act, 2019 (the "Act"). They follow the contract requirements in section 42 of the Act and the ODPC's Guidance Note for the Education Sector.
2. Details of the processing
| Subject matter | Providing the NyotaSkul school platform and the Nyota assistant to the school |
|---|---|
| Duration | The school's subscription, plus the export and deletion periods in section 10 |
| Nature and purpose | Hosting, storing, organising, displaying, backing up, retrieving and deleting school data, and generating planning drafts, so the school can run its administration and teaching |
| Data subjects | Learners (mostly children), parents and guardians, staff, and other users the school invites |
| Types of personal data | Identity and contact details, admission and class details, guardian links, attendance, assessments and report cards, fee records, staff roles and assignments, account and audit data, and any other data the school chooses to enter |
| Sensitive data | Only if the school chooses to record it, for example health or special needs information, on the school's own lawful ground |
3. Instructions
- We process school data only on the school's documented instructions. The school's use of the platform's features, its settings, and these terms are its instructions.
- We do not process school data for our own purposes, including advertising, profiling, marketing or selling data.
- If we believe an instruction breaks the Act, we will tell the school. If the law requires us to process data in another way, we will tell the school first unless the law prevents us.
4. Confidentiality
Everyone at NyotaSkul who can access school data is authorised to do so only as their job needs, and is bound by a duty of confidentiality that continues after they leave.
5. Security
We maintain technical and organisational measures appropriate to the risk, as sections 41 and 42 of the Act require, including encryption in transit, a separate workspace per school, role-based access, audit records, backups, restricted administrative access, staff confidentiality and secure server management. Our current measures are described in section 12 of our privacy policy. We review them regularly and won't reduce the overall level of protection during the school's subscription.
6. Sub-processors
- The school authorises us to use sub-processors for hosting and backup, email delivery, AI model services and customer messaging.
- Each sub-processor is bound by a written contract with data protection obligations no less protective than these terms, and we remain responsible to the school for its work.
- We keep a list of current sub-processors and give it to the school on request. We will tell the school at least 30 days before adding or replacing a sub-processor. If the school has a reasonable data protection objection, we will work with it to find a solution; if we can't, the school may end its plan and receive a refund for the unused part of the billing period.
7. Location and transfers
Our platform runs on servers operated by a professional cloud hosting provider, and some of our service providers are located outside Kenya. Where personal data is transferred or stored outside Kenya, we do so only where the conditions in sections 48 to 50 of the Data Protection Act, 2019 are met, including appropriate safeguards for the security and protection of the data.
Regulation 26 of the Data Protection (General) Regulations, 2021 requires personal data processed for early childhood and basic education to be processed through a data centre in Kenya, or at least one serving copy to be stored in a data centre in Kenya. We are putting arrangements in place to keep a serving copy of school data in a data centre in Kenya before the platform's general launch.
8. Helping the school
Taking into account the nature of the processing, we will help the school to:
- respond to requests from data subjects to exercise their rights, within the times set by the General Regulations, and pass on any request we receive directly;
- keep school data secure, and handle breaches;
- carry out data protection impact assessments under section 31 of the Act, and consult the Data Commissioner where needed;
- respond to enquiries from the Office of the Data Protection Commissioner about the processing.
9. Breaches
If we become aware of a breach affecting school data, we will notify the school without delay and, where reasonably practicable, within 48 hours, as section 43(2) of the Act requires. We will tell the school what happened, what data and how many people may be affected, the likely consequences, and what we are doing about it, and will give updates as we learn more. We will help the school notify the Data Commissioner within 72 hours and inform affected people.
10. Return and deletion
- The school can export its data at any time during its subscription and for 60 days after it ends.
- After that, we delete school data within a further 30 days, and it leaves our rolling backups within 90 days, unless the law requires us to keep it.
- On request, we confirm deletion in writing.
11. Records and audits
We keep records of our processing on the school's behalf. On reasonable written request, and not more than once a year unless there has been a breach or the Data Commissioner requires it, we will provide the information the school needs to show that these terms are being met, and allow reasonable audits by the school or an auditor it appoints, under a duty of confidentiality and at the school's cost.
12. Liability
Each party's liability under these terms is subject to the limits in section 17 of our terms of service. If we process school data outside the school's instructions, we are treated as a data controller for that processing, as section 42 of the Act provides.
Schools that need these terms signed as a separate document can request a copy from admin@nyotaskul.com.