Last updated August 2026
Edu Maisha ("Edu Maisha", "we", "us") provides school management software to schools in Kenya. This policy explains what personal data passes through the platform, why, and who's responsible for it.
This distinction matters more than most of what follows, so it comes first.
Your school is the data controller. The school decides what student, staff, and guardian information to collect and why — Edu Maisha doesn't. If you're a parent, guardian, student, or staff member with a question about your own data, your first point of contact is the school that enrolled or employed you, not Edu Maisha directly.
Edu Maisha is the data processor. We store and process that data on the school's behalf, following their instructions, using the technical measures described below. We don't sell data, and we don't use one school's data for another school's benefit — each school's database is physically separate from every other school's (see Section 5).
| Category | Examples |
|---|---|
| Student records | Name, date of birth, gender, admission number, class, guardian relationships |
| Academic records | Assessment scores, competency ratings, exam results, report cards, attendance |
| Health records | Medical conditions, allergies, incidents logged by the school's matron/nurse |
| Financial records | Fee invoices, payment history, M-Pesa transaction references |
| Guardian/parent data | Name, phone number, email, relationship to student |
| Staff/employee data | Name, contact details, role, TSC number, KRA PIN, payroll and salary records. Staff may create their own account (self-registration, verified by email/SMS) before a school admin assigns them a role. |
| Account & usage data | Login email, password (hashed, never stored in plain text), sign-in history (time, IP address, device/browser) |
Most of the student data on this platform belongs to minors. Kenya's Data Protection Act, 2019 requires a parent or guardian's consent before processing a child's personal data, and extra care in how it's handled. In practice on this platform: a school enrolls a student and records their guardian's contact details as part of normal admission — the school, as the data controller, is responsible for having a lawful basis (typically the guardian relationship itself, formalized at enrollment) for that. [This section specifically needs a lawyer's confirmation that the enrollment process itself satisfies the Act's consent requirements, or what additional consent language a school should collect at admission.]
Data is used to run the school day to day: admissions, fee collection, academic records, communication with guardians, payroll, and reporting. Some of it is shared with third parties strictly to make specific features work:
We don't share data with advertisers, data brokers, or anyone outside these specific, feature-necessary integrations.
Each school's data lives in its own separate database, physically isolated from every other school's — a query that goes wrong for one school cannot expose another school's records. All traffic to the platform is encrypted (HTTPS). Passwords are hashed, never stored as plain text. Access within a school is role-based — what a given staff member can see and do is limited to their role (e.g. a teacher cannot see financial records; a librarian cannot see medical records), and every account can be deactivated immediately if someone leaves the school, without deleting their history. The platform keeps a record of sign-ins (time, IP address, device) and emails an account holder if their account signs in from a device it hasn't used before.
Hosting location: the platform currently runs on a server hosted in Germany (EU), via DigitalOcean. This means personal data about people in Kenya is transferred outside Kenya. [This needs specific legal review — Kenya's Data Protection Act restricts cross-border transfer of personal data unless the receiving country has adequate safeguards or another lawful basis applies. The EU's own data protection standard (GDPR) is generally considered strong, but this shouldn't be assumed adequate without a lawyer confirming it against the Act's actual requirements, or until hosting can move to Kenya.]
Automated backups of all school data are taken daily and retained for a short rolling period, stored on the same server. [Off-site backup storage is a planned improvement, not yet in place.]
Data is retained for as long as a school's account is active. A student's academic and financial records, and a school's financial (ledger) records, are not deletable through the platform at all once created — by design, not by accident — a mistake is corrected by editing or by changing a student's status (e.g. Transferred, Graduated, Inactive), never by erasing the record. This protects academic and financial history from being altered or lost, but it also means there is currently no "right to erasure" button a school can press for this data — a genuine deletion request would need to be handled manually, outside the platform. [Exact retention periods after a school leaves the platform, or after a student graduates/transfers, still need to be pinned down — proposed default is 12 months post-termination unless the school requests earlier deletion or the law requires longer, e.g. for financial records — and how the never-delete design above interacts with a valid erasure request under the Act still needs a lawyer's input before being treated as final.]
Under Kenya's Data Protection Act, you have the right to know what data is held about you, request a copy of it, ask for it to be corrected, and in some cases ask for it to be deleted. Because your school is the data controller, these requests should generally go to your school first. Edu Maisha supports schools in fulfilling these requests as their data processor.
The platform uses only the cookies necessary to keep you logged in and to protect against cross-site request forgery. There are no advertising or third-party tracking cookies.
If a breach affecting personal data occurs, affected schools will be notified without undue delay, and — where the law requires it — the Office of the Data Protection Commissioner will be notified too. [Exact notification timelines and process need to be formalized with legal input.]
Questions about this policy, or about Edu Maisha's role as a data processor, can be sent to [email protected] or +254 723 836 815. If your question is about your own personal data specifically, please contact your school directly first.
This policy may be updated as the platform and its legal review develop. Material changes will be reflected here with an updated date at the top of the page.