Privacy Policy

Effective date: 25 July 2026
Applies to: kisoma.co.ke, the Kisoma platform, and related Kisoma services

Kisoma ("Kisoma", "we", "us", or "our") provides a school-management platform used by schools, teachers, students, parents/guardians, and administrative staff ("Users", "you") to manage academics, attendance, fees, communication, transport, timetables, and related school operations.

This Privacy Policy explains how Kisoma collects, uses, stores, shares, and protects personal data when you interact with our website, platform, and related services.

We process personal data in accordance with applicable data-protection requirements, including the Kenya Data Protection Act, 2019 and its regulations.

1. Who This Policy Covers

This Privacy Policy applies to people and organizations that interact with Kisoma, including:

• Schools and educational institutions that subscribe to Kisoma;

• School administrators and staff who use Kisoma's administrative, academic, finance, communication, and operational tools;

• Teachers who use Kisoma for academic and school-management activities;

• Students whose academic, attendance, and related school records are managed through the platform;

• Parents and guardians who access student information or receive school communications;

• Website visitors who interact with kisoma.co.ke; and

• Other authorized users of Kisoma services.

For most student, parent/guardian, and staff information entered into Kisoma by a subscribing school, the school determines why and how the information is used. In these circumstances, the school generally acts as the data controller, while Kisoma acts as the data processor providing the technology and related services.

2. Information We Collect and Process

The information processed through Kisoma depends on the services and modules used by each school.

a) Account and Identity Information

This may include:

• Names;

• Admission numbers;

• Staff numbers;

• User roles;

• Login and account information;

• Phone numbers;

• Email addresses;

• Physical addresses; and

• Profile photographs, where provided.

b) Academic and School-Operations Information

Depending on the modules used by a school, Kisoma may process:

• Classes, grades, streams, sections, and curriculum assignments;

• Subjects and academic-year or term information;

• Examination results, assessments, grades, and report cards;

• Student and staff attendance information;

• Timetables;

• Assignments, homework, and lesson-planning information;

• Fee structures, invoices, payment records, and related financial information;

• Transport information, including routes and related identifiers;

• Student and staff ID-card information; and

• Other records required by a school to manage its operations.

c) Communications Information

Where communication features are enabled, Kisoma may process:

• Phone numbers and other recipient contact information;

• School announcements;

• Attendance notifications;

• Fee reminders;

• Academic notifications;

• Administrative notices;

• SMS communications;

• Email communications;

• WhatsApp communications;

• Message delivery information; and

• Support requests and correspondence with Kisoma.

d) Technical and Usage Information

When you use Kisoma or visit our website, certain technical information may be processed, including:

• IP address;

• Browser and device information;

• Login and activity timestamps;

• Pages or platform features accessed;

• Security and audit logs; and

• Cookies and similar technologies.

Kisoma primarily provides technology services to schools. Most student, parent/guardian, and staff information within the platform is provided and controlled by subscribing schools rather than collected directly by Kisoma from those individuals.

3. How We Use Personal Information

Kisoma processes personal information where necessary to:

• Provide, operate, maintain, and secure the Kisoma platform;

• Provide academic, attendance, fee-management, timetable, transport, communication, reporting, and related functionality;

• Authenticate users and manage role-based access;

• Generate academic reports, attendance records, fee statements, and other school documents;

• Facilitate school-authorized communications with parents, guardians, students, and staff;

• Facilitate authorized WhatsApp, SMS, and email notifications;

• Process school-fee payments and Kisoma subscription payments where applicable;

• Provide customer and technical support;

• Diagnose technical problems and maintain platform reliability;

• Protect accounts and systems from unauthorized access, fraud, misuse, and security threats;

• Maintain appropriate audit records;

• Improve and develop Kisoma features and services; and

• Meet applicable legal, regulatory, contractual, and compliance obligations.

Kisoma does not sell personal data.

We do not use student personal data for independent advertising purposes.

4. Legal Basis for Processing

Depending on the circumstances, Kisoma and subscribing schools may rely on one or more lawful bases for processing personal data, including:

Performance of a Contract

Information may be processed where necessary to provide services requested by a subscribing school or authorized user.

Consent

Consent may be relied upon where appropriate, including for certain communications or services where consent is required.

For example, a parent, guardian, staff member, or other recipient may consent to receive eligible communications through WhatsApp, SMS, or other channels.

Legal Obligations

Information may be processed or retained where required to meet applicable legal, regulatory, educational, accounting, or other statutory obligations.

Legitimate Interests

Information may be processed where reasonably necessary for purposes such as:

• Platform security;

• Fraud prevention;

• Service reliability;

• Technical troubleshooting; and

• Improving Kisoma services,

provided those interests are appropriately balanced against the rights and interests of affected individuals.

5. Children's and Student Data

Kisoma is designed for educational institutions and therefore processes records relating to students, including minors.

Student information is treated with heightened care.

In particular:

• Student accounts and records are generally created and managed by the subscribing school;

• Schools are responsible for ensuring they have an appropriate legal basis for collecting and using student information;

• Where parental or guardian consent is required, the school is responsible for obtaining it;

• Kisoma does not intentionally collect children's personal information independently for advertising purposes;

• Access to student information is restricted using role-based permissions;

• Student records are available only to appropriately authorized users; and

• Parents or guardians seeking to access, correct, or delete school-managed information about their child should generally contact the relevant school first.

Kisoma will reasonably assist subscribing schools with verified data-subject requests where required.

6. How We Share Information

Kisoma does not sell personal information.

Information may be shared or made available only where reasonably necessary for providing and securing our services or meeting legal obligations.

This may include:

Within a School

Information may be accessible to authorized school administrators, teachers, staff, parents/guardians, and students according to their assigned permissions.

Service Providers

Kisoma may use third-party providers for services such as:

• Cloud infrastructure and hosting;

• Payment processing;

• SMS delivery;

• Email delivery;

• WhatsApp messaging;

• Security and monitoring; and

• Other technical infrastructure.

Only information reasonably necessary for the relevant service is provided or made accessible.

Legal Requirements

We may disclose information where reasonably necessary to comply with applicable law, a valid court order, regulatory requirement, or other lawful request.

Business Changes

If Kisoma undergoes a merger, acquisition, restructuring, or transfer of relevant business assets, information may be transferred as part of that transaction subject to applicable data-protection requirements.

We do not provide student, parent/guardian, or staff information to third parties for their independent marketing purposes.

7. WhatsApp Business Platform

Where enabled, Kisoma may provide WhatsApp communication functionality to subscribing schools through the WhatsApp Business Platform provided by Meta Platforms and/or its affiliates.

Kisoma may facilitate WhatsApp communications on behalf of subscribing schools.

These communications may include:

• Attendance notifications;

• Fee and payment reminders;

• Academic updates;

• Examination-related information;

• Timetable information;

• School announcements;

• Administrative notifications;

• Transport-related notifications;

• Account or service notifications; and

• Other school-authorized communications.

To deliver WhatsApp messages, information such as the recipient's phone number, message content, message template information, and message delivery information may be processed by Kisoma and Meta or other providers involved in delivering the communication.

Authorization and Consent

Subscribing schools are responsible for ensuring that they have an appropriate lawful basis and, where required, appropriate consent or authorization before using Kisoma to communicate with recipients through WhatsApp.

Possession of a person's telephone number alone does not automatically authorize a school to send marketing or other communications where consent or another lawful basis is required.

Schools must not use Kisoma's WhatsApp functionality to send:

• Spam;

• Harassing communications;

• Fraudulent or misleading messages;

• Unauthorized bulk communications;

• Unlawful content; or

• Communications that violate applicable WhatsApp or Meta requirements.

Opting Out of WhatsApp Communications

Recipients may request to stop receiving applicable WhatsApp communications.

Depending on the communication and available functionality, recipients may opt out by:

• Following opt-out instructions included with the communication;

• Contacting the school responsible for the communication; or

• Contacting Kisoma through our published support channels.

Where a school controls the underlying recipient information, Kisoma may coordinate the request with that school.

Certain essential administrative or service-related communications may be handled differently where they are necessary to provide a requested service or meet a legal obligation.

Use of WhatsApp is also subject to applicable terms and privacy practices of Meta and WhatsApp.

8. Other Third-Party Services

Kisoma may integrate with third-party services to provide specific functionality.

These may include:

Third-party providers may change as Kisoma develops its services.

Where appropriate, we select providers based on factors including security, reliability, privacy, and service requirements.

9. Data Security

Kisoma implements technical and organizational measures intended to protect personal information from unauthorized access, loss, misuse, alteration, or disclosure.

These measures may include:

• HTTPS encryption for information transmitted between users and Kisoma;

• Role-based access controls;

• Authentication and authorization controls;

• Access restrictions;

• Security logging and audit trails;

• Backups;

• Infrastructure monitoring;

• Access reviews; and

• Other appropriate security safeguards.

No internet-connected system can guarantee absolute security.

Where Kisoma becomes aware of a personal-data breach, we will take appropriate steps to investigate and respond and will notify affected schools, users, regulators, or other parties where required by applicable law.

10. Data Retention

Personal information is retained for as long as reasonably necessary to provide Kisoma services and fulfill the purposes described in this Privacy Policy.

The applicable retention period may depend on:

• The duration of a school's subscription;

• Instructions from the school acting as data controller;

• The type of information involved;

• Academic-record requirements;

• Financial and accounting requirements;

• Security and fraud-prevention requirements; and

• Applicable legal or regulatory obligations.

When a school closes its Kisoma account, it may request export or deletion of eligible information, subject to applicable retention requirements.

Information that must legally be retained may be kept for the required period before being securely deleted or anonymized where appropriate.

11. International Data Transfers

Some service providers used by Kisoma, including cloud, communications, or technology providers, may process information outside Kenya.

Where personal information is transferred internationally, Kisoma will take reasonable steps to ensure that the transfer is handled in accordance with applicable data-protection requirements and appropriate safeguards.

Use of international communication platforms, including the WhatsApp Business Platform, may involve processing information through infrastructure operated outside Kenya.

12. Your Data Protection Rights

Subject to applicable law and relevant limitations, individuals may have the right to:

• Be informed about how their personal information is processed;

• Request access to their personal information;

• Request correction of inaccurate or outdated information;

• Request deletion of eligible personal information;

• Object to certain processing;

• Request restriction of certain processing;

• Withdraw consent where processing is based on consent;

• Opt out of applicable WhatsApp, SMS, email, or other communications; and

• Lodge a complaint with the relevant data-protection authority, including the Office of the Data Protection Commissioner (ODPC) in Kenya.

For information controlled by a subscribing school, users should generally contact the relevant school first.

Kisoma will reasonably assist schools with verified requests where required.

For information controlled directly by Kisoma, requests may be submitted through our published contact channels.

13. Data Deletion Requests

Users may request deletion of eligible personal information.

Where the requested information is controlled by a subscribing school, the request should generally be submitted to that school. Kisoma may assist the school in processing a verified deletion request.

Where Kisoma controls the information directly, users may submit a deletion request through our published support or privacy contact channel.

Before processing certain requests, we may need to verify the identity of the person making the request to protect information against unauthorized deletion.

A deletion request should, where appropriate, identify:

• The person making the request;

• Relevant contact information;

• The school associated with the account, where applicable; and

• Sufficient information to identify the relevant account or records.

Deletion requests may be subject to legal, regulatory, academic, financial, security, or contractual retention requirements.

Where information cannot immediately be deleted because retention is legally required, it may be retained only for the applicable purpose and period.

Additional instructions for requesting deletion may be provided on Kisoma's dedicated Data Deletion Instructions page.

14. Cookies and Similar Technologies

Kisoma's website and platform may use cookies and similar technologies to:

• Maintain user sessions;

• Keep users securely signed in;

• Remember preferences;

• Protect accounts and services;

• Understand platform usage; and

• Improve performance and reliability.

Users can manage cookies through their browser settings.

Disabling certain cookies may prevent some Kisoma functionality from operating correctly.

15. Role of Schools as Data Controllers

For most student, staff, parent/guardian, and school information entered into Kisoma:

The subscribing school generally acts as the data controller, and Kisoma generally acts as the data processor providing the technology platform.

This means that subscribing schools are generally responsible for:

• Determining why personal information is collected;

• Determining what information is entered into Kisoma;

• Ensuring an appropriate lawful basis exists for processing;

• Obtaining consent where required;

• Determining who within the school may access information;

• Ensuring information entered into Kisoma is appropriate and accurate;

• Managing communications with students, parents/guardians, and staff; and

• Responding to data-subject requests relating to school-controlled records.

Kisoma provides the technical platform and will reasonably assist schools with their data-protection obligations where appropriate.

16. Acceptable Use of Communication Services

Schools and authorized users must use Kisoma's communication functionality responsibly.

Kisoma communication services, including WhatsApp, SMS, and email functionality, must not be used to:

• Send spam;

• Send unsolicited marketing communications where authorization is required;

• Harass or threaten recipients;

• Impersonate another person or organization;

• Distribute fraudulent or deceptive content;

• Distribute unlawful content;

• Circumvent recipient opt-out requests; or

• Violate applicable laws or third-party platform requirements.

Kisoma may restrict or suspend access to communication functionality where necessary to protect users, comply with applicable requirements, or prevent misuse.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes to Kisoma services;

• New features or integrations;

• Changes to third-party services;

• Changes to our privacy practices; or

• Legal or regulatory requirements.

When this Privacy Policy is updated, the revised version will be published on kisoma.co.ke with an updated effective date.

Where changes materially affect subscribing schools or users, additional notice may be provided where appropriate.

18. Contact Us

For questions regarding this Privacy Policy, Kisoma's privacy practices, or requests concerning personal information, contact us through our official channels:

Kisoma
Website: kisoma.co.ke
Email: support@kisoma.co.ke

For information managed by a subscribing school, users should generally contact the relevant school's administration first.

Individuals in Kenya may also contact the Office of the Data Protection Commissioner (ODPC) regarding concerns about the processing of their personal information.