Privacy Policy

Last updated: August 25, 2026

This Privacy Policy explains how DCK Solutions ("we", "us", "our") collects, uses, stores, and protects personal data through the School Management System ("System") operated on behalf of client schools. It applies to students, parents/guardians, staff, and all other data subjects whose information is processed through the System. We operate in compliance with the Kenya Data Protection Act, 2019 (No. 24 of 2019) and its subsidiary regulations.

1. Data Controller

Each client school using the System is the Data Controller for the personal data of its students, parents, and staff. DCK Solutions acts as a Data Processor on behalf of each school. Contact your school's administration for data-related requests.

2. Personal Data We Collect

• Students: Name, date of birth, gender, contact details, class enrolment, attendance records, academic results, and CBC assessment data.
• Parents / Guardians: Name, national ID, relationship to student, phone number, and email address.
• Staff: Name, staff ID, role, contact details, employment information, and payroll data.
• Health Data (Special Category): Blood group, allergies, chronic conditions, disabilities, vaccination records, and clinic visit records. This data is encrypted at rest and accessible only to authorised health staff.
• Financial Data: Fee payment records, invoice history, and M-Pesa transaction references. Card payments are processed through Stripe; no card numbers are stored on our servers.
• Biometric Data (where enabled): Fingerprint attendance records. Stored only in hashed/tokenised form.

3. Purposes of Processing

• Administration of academic records, enrolment, and timetabling.
• Fee collection and financial reporting.
• Attendance tracking and reporting to parents/guardians.
• Health monitoring and emergency contact management.
• Communication of notices, results, and school events via SMS and email.
• Compliance with Kenya's national education reporting requirements (NEMIS, KNEC, CBC).

4. Legal Basis for Processing

Processing is carried out on the basis of: (a) performance of a contract (student enrolment); (b) compliance with a legal obligation (NEMIS reporting, KNEC examinations); (c) legitimate interests of the school; and (d) consent, where required — including for bulk SMS/email communications.

5. Communication Opt-Out

Parents and guardians may opt out of bulk SMS or email communications at any time by contacting the school administration. Operational messages (fee invoices, examination timetables, emergency alerts) may still be sent regardless of opt-out status as they relate to the performance of the enrolment contract.

6. Data Sharing

We do not sell personal data. Data may be shared with: Safaricom (M-Pesa payment processing), Stripe (card payment processing), SMS gateway providers (for SMS delivery), and Kenya government bodies (NEMIS, KNEC) as required by law. All third-party processors are bound by data processing agreements.

7. Data Retention

Student academic records are retained for a minimum of 7 years after graduation in accordance with Kenya's Education Act. Health records are retained for 10 years. Financial records are retained for 7 years under the Income Tax Act. Data is securely deleted upon expiry of the retention period.

8. Data Subject Rights

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access your personal data held by the school.
• Correct inaccurate or incomplete data.
• Request deletion of data (subject to legal retention requirements).
• Object to or restrict certain types of processing.
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

9. Security

We implement technical safeguards including: AES-256 encryption for sensitive health and financial credentials at rest; HTTPS in transit; session-based authentication; role-based access control; and regular security reviews. Despite these measures, no system is completely immune to risk. We will notify affected parties promptly in the event of a data breach as required by Section 43 of the Kenya Data Protection Act, 2019.

10. Cookies

The System uses a single session cookie to maintain your login session. No tracking or advertising cookies are used.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through the System or by email. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact

For data-related enquiries, contact your school's administration or reach DCK Solutions at danchilia16@gmail.com.

Back to Login