Privacy policy

Last updated 25 October 2026.

1. Summary

• On our website, we collect very little. The demo request form doesn't send or store anything: it opens WhatsApp or your email app with a message for you to send. We don't use advertising, tracking or analytics cookies.
• On the NyotaSkul platform, each school decides what personal data about its learners, parents and staff goes into its workspace. The school is the data controller for that data, and we process it on the school's behalf as its data processor.
• Children's data is processed only for the school's education purposes, with the protections in section 33 of the Data Protection Act, 2019. We never use it for advertising, profiling or marketing, and we never sell personal data.
• You have rights to access, correct, delete, restrict and object to the use of your data, and to complain to the Office of the Data Protection Commissioner (ODPC).

2. Who we are

"NyotaSkul", "we", "us" and "our" refer to NyotaSkul, the provider of the NyotaSkul website at www.nyotaskul.com and the NyotaSkul school platform, including school workspaces at addresses such as yourschool.nyotaskul.com and the Nyota assistant.

This policy is written to meet the Data Protection Act, 2019 (the "Act"), the Data Protection (General) Regulations, 2021 and the guidance of the Office of the Data Protection Commissioner, including its Guidance Note for the Education Sector.

3. Our role and your school's role

When we act as a processor, we follow the school's documented instructions and our data processing terms, which set out the protections required by section 42 of the Act. If you are a parent, guardian, learner or staff member and have a question about the records your school keeps, please contact your school first. We will help the school respond.

4. Personal data we collect

4.1 When you visit our website

• Technical data: our web server records your IP address, the page requested, the date and time, your browser type and the referring page. We use this to keep the website secure and working.
• The demo request form: what you type stays on your device. When you press send, your browser opens WhatsApp or your email app with the message filled in. We receive it only if you send it.

4.2 When you contact us or ask for a demo or quote

Your name, role, school, county, phone or WhatsApp number, email address, number of learners, preferred demo time and anything else you choose to tell us.

4.3 When a school uses the platform

• Account data: names, work email addresses, phone numbers, roles and sign-in details of staff and guardians who are given access.
• School records entered or imported by the school, which may include: learner names, admission numbers, dates of birth, gender, class and stream, guardian links, attendance, assessment results, report card remarks, and fee charges, receipts and balances; staff names, roles and teaching assignments.
• Teaching content: curriculum designs the school uploads, schemes of work, lesson plans, records of work and reflections.
• Activity and audit records: who did what and when (for example, who approved a scheme), kept for accountability and security.
• Technical data: IP address, device and browser type, and session information needed to keep you signed in securely.

We ask schools to enter only what they need for their education and administration purposes, in line with the data minimisation principle in section 25 of the Act.

5. How we use personal data, and our legal grounds

Section 30 of the Act allows personal data to be processed only on a lawful ground. We rely on one ground for each purpose, as below.

We will not use personal data for a purpose that is incompatible with the purpose it was collected for.

6. Children's data

Most learners whose records are kept on NyotaSkul are children. Section 33 of the Act requires that a child's data is processed only with the consent of a parent or guardian, in a way that protects and advances the child's best interests, and with appropriate age verification. The Children Act, 2022 also requires that the best interests of the child come first.

• The school's responsibility: as the data controller, the school is responsible for having a lawful basis for each learner's records, including obtaining parental or guardian consent where consent is the basis, and for giving parents its own privacy notice, as the ODPC's education guidance requires.
• Our commitments: we process children's data only to provide the school's education and administration services. We never use children's data for advertising, direct marketing or profiling, we never sell it, and we never share one school's data with another school.
• Learners do not have their own accounts on NyotaSkul today. Access is given to school staff and to parents and guardians invited by the school.
• Exam results and photos: NyotaSkul does not publish results or images publicly. Report cards are available only to the school and to the guardians linked to the learner.
• Exercising a child's rights: a parent or guardian can exercise rights on the child's behalf. We or the school will take reasonable steps to confirm the person is the child's parent or guardian.

7. Sensitive personal data

Sensitive personal data under the Act includes health, disability, religious belief, ethnicity, biometric and genetic data. NyotaSkul does not require any of it. If a school chooses to record sensitive information (for example, a learner's medical condition or special needs, so staff can respond to them), the school must have a ground under sections 44 to 46 of the Act, such as explicit consent from the parent or guardian, and should limit access to the staff who need it. We do not collect biometric data.

8. Nyota, our AI assistant

• What it does: Nyota drafts lesson plans from the school's approved scheme of work, helps read curriculum designs into a structure staff can review, and answers questions in the teacher workspace.
• What it needs: curriculum and planning information, such as grade, learning area, outcomes and lesson length. It does not need learners' personal data to draft a lesson plan, and we design our prompts to leave it out.
• People decide: Nyota only proposes. Nothing it drafts is saved or published until a member of staff reviews and confirms it, and we record who confirmed it. NyotaSkul does not make decisions about anyone based solely on automated processing, so the rights in section 35 of the Act are not affected.
• AI providers: to generate drafts, we send the minimum necessary content to AI model providers acting as our sub-processors, under terms that do not allow them to use it to train their models. We do not use school data to train AI models.

9. Who we share personal data with

We do not sell personal data. We share it only as follows:

• Service providers (sub-processors) who help us run NyotaSkul, under written contracts that require confidentiality and security: cloud hosting and backup, email delivery, AI model providers, and customer messaging (WhatsApp, when you choose to message us). We give them only what they need.
• Within your school: people your school gives access to see only what their role allows.
• Authorities: when the law requires it, for example a court order, or a lawful request from a public body. Where we receive a request about school data, we refer it to the school unless the law prevents us.
• Professional advisers such as auditors and lawyers, under duties of confidentiality.
• A change of ownership: if NyotaSkul's business is sold or merged, personal data may pass to the new owner, who must continue to protect it under this policy and the Act.

Schools can ask us for the current list of sub-processors at any time.

10. Where data is stored

Our platform runs on servers operated by a professional cloud hosting provider, and some of our service providers are located outside Kenya. Where personal data is transferred or stored outside Kenya, we do so only where the conditions in sections 48 to 50 of the Data Protection Act, 2019 are met, including appropriate safeguards for the security and protection of the data.

Regulation 26 of the Data Protection (General) Regulations, 2021 requires personal data processed for early childhood and basic education to be processed through a data centre in Kenya, or at least one serving copy to be stored in a data centre in Kenya. We are putting arrangements in place to keep a serving copy of school data in a data centre in Kenya before the platform's general launch.

Sensitive personal data is transferred outside Kenya only with the consent of the person concerned (or their parent or guardian) and with appropriate safeguards, as section 49 of the Act requires.

11. How long we keep personal data

We keep personal data only as long as reasonably necessary for its purpose (section 39 of the Act and regulation 19 of the General Regulations), then delete, anonymise or pseudonymise it.

Each school sets its own retention periods for learner and staff records in line with education law and policy, and can delete records from its workspace.

12. How we protect personal data

Section 41 of the Act requires data protection by design and by default. Our measures include:

• encryption in transit (HTTPS) for the website and every school workspace;
• a separate workspace for each school, with data scoped to that school;
• role-based access, so people see only what their role needs;
• two-person rules for publishing curriculum content and approving schemes of work;
• audit records of sensitive actions;
• regular backups and tested restore procedures;
• access to production systems limited to authorised staff, protected by strong authentication, and bound by confidentiality duties;
• security updates, firewalls and monitoring of our servers.

No system is completely secure. Please keep your password private and tell us straight away at support@nyotaskul.com if you think your account has been misused.

13. Data breaches

If a personal data breach creates a real risk of harm, we will act as section 43 of the Act requires:

• for data we control, we will notify the Data Commissioner within 72 hours of becoming aware of it, and tell affected people in writing within a reasonable time, with the information they need to protect themselves;
• for school data, we will notify the school without delay and, where reasonably practicable, within 48 hours, and help the school meet its own duties.

14. Your rights

Under section 26 of the Act and the General Regulations, you have the right to:

To use a right, email admin@nyotaskul.com or WhatsApp +254 723 782 623. We may ask you to confirm your identity. For records your school keeps, we will pass your request to the school, which decides on it as the controller, and help it respond within these times. If we can't meet a request, we will tell you why.

15. How to ask for deletion

1. Email admin@nyotaskul.com with the subject "Data deletion request".
2. Tell us your name, how you dealt with us (for example, a demo request, or the school you're linked to), and the phone number or email we have for you.
3. We confirm receipt, check your identity, and delete the data within 14 days, or pass the request to your school if it controls the data.
4. We confirm in writing what we deleted, and anything we must keep by law (for example, invoices) and for how long.

Schools can delete records themselves in their workspace, or ask us to close their workspace and delete all their data.

16. Nyota Champions programme

• Champions: we process your name, contact details, county, KRA PIN, M-Pesa or bank details, declared connections, and records of your leads, referrals, rewards and payouts. We use them to review your application, run the programme, pay you and meet our tax obligations. Our legal grounds are our contract with you and our legal obligations under tax law. We keep payout and tax records for at least five years, as tax law requires, and other programme records for up to 24 months after you leave the programme.
• Referred schools: we tell a Champion or referring school only the referred school's name, its referral status and the rewards earned. We never share a school's workspace, records or the personal data of its learners, parents or staff.
• Leads: when a Champion registers a lead, we receive a contact person's name and details from the Champion. We use them only to contact that person about NyotaSkul once, and stop if they ask.
• Referral codes on our website: if you arrive through a referral link, your browser stores the referral code (not any personal data) for up to 90 days, so the right referrer is credited if your school registers. You can clear it by clearing your browser's site data.

17. Marketing messages

We send news about NyotaSkul only to people who have agreed to receive it, never to learners or about children. Every marketing message tells you how to opt out, and opting out is free and takes one step: reply STOP, use the unsubscribe link, or email admin@nyotaskul.com. We act on opt-outs within 7 days. Messages about your school's account, service and security are not marketing and continue while you use NyotaSkul.

18. WhatsApp, phone and email

When you contact us on WhatsApp, WhatsApp (Meta) processes your messages under its own terms and privacy policy. We use the messages only to reply to you and to keep a record of our conversation. If a school uses NyotaSkul to message parents, the school is responsible for having parents' agreement to be contacted on that channel.

19. Cookies and browser storage

• Website: www.nyotaskul.com does not set cookies and does not use analytics, advertising or tracking tools. The only thing it stores in your browser is a referral code, if you arrive through a referral link (see section 16). If we add privacy-friendly analytics in future, we will update this policy first, and ask for your consent where the law requires it.
• Platform: school workspaces use strictly necessary cookies to keep you signed in and to protect forms against misuse. They can't be switched off without breaking sign-in, and they are not used for tracking or advertising.

20. Complaints

If you're unhappy with how we've handled your personal data, please contact us first at admin@nyotaskul.com so we can try to put it right. You also have the right to complain to the Office of the Data Protection Commissioner:

Office of the Data Protection Commissioner, 13th Floor, Britam Tower, Hospital Road, Upper Hill, Nairobi. P.O. Box 30920-00100 GPO, Nairobi. Phone 020 780 1800. Email info@odpc.go.ke. Website www.odpc.go.ke.

21. Changes to this policy

We will update this policy when our services or the law change. The date at the top shows the latest version. For significant changes, we will tell schools by email or in the platform at least 30 days before the change takes effect.

22. Contact us

Privacy and data protection: admin@nyotaskul.com
Support for schools: support@nyotaskul.com
General: info@nyotaskul.com
Phone and WhatsApp: +254 723 782 623