Privacy Policy

Part A

This website

This section covers only what happens when you use educoreafrica.com itself — not the application schools use once enrolled, which is covered in Part B below.

What we collect

If you use the contact/demo request form on this site, we collect the information you provide: your name, school name, role, email address, and phone number, how you would like us to contact you, and, if you choose, a preferred day and time for your demo, your approximate student numbers, and a message. The form has two steps. When you press Continue after the first step (name, school, phone, and email), we save those details straight away so our team can follow up about your demo, even if you don't finish the second step. If you don't complete the form, we delete those saved details after 60 days. If you arrived via a marketing link containing campaign parameters (for example, from an ad or a shared link), we also record which campaign referred you at the time you continue or submit the form, so we understand which channels are helpful. We do not collect this information anywhere else on the marketing site — pages you simply browse do not submit any personal information to us. (Browsing is counted anonymously, as described below.)

How we store and use it

Demo request submissions, and first-step details from people who started but didn't finish the form, are stored in dedicated database tables, separate from any school's student, academic, or financial records, and are only ever written to, never read back, by this website's public pages. Access is restricted to the EduCore team, and used to respond to your enquiry and arrange a demo. The campaign tags and, if you had not declined cookies, the ad click identifier described under “Error monitoring, analytics, and cookies” below are stored with it so we can measure which ads work. We do not sell this information, and we do not use your contact details for advertising.

Error monitoring, analytics, and cookies

This site uses Sentry to detect and diagnose technical errors. Default collection of personal data (such as IP addresses) is deliberately switched off in this configuration; Sentry receives only what is needed to identify and fix bugs, via an EU-region endpoint (see Section 9 in Part B for what that means for cross-border transfer).

This site uses Google Analytics (via Google Tag Manager) to understand aggregate visitor traffic — pages viewed, how visitors arrived, and general engagement — so we can see how the site is performing. This sets analytics cookies in your browser when you visit educoreafrica.com. It is scoped to this marketing website and the free-trial sign-up page only; it is never active in the EduCore application that enrolled schools and families use, which has no analytics or tracking of any kind. When you submit the contact/demo form or create a free-trial account, Google Analytics separately records that a form was submitted or an account was created, along with which page and marketing campaign or link brought you there and, for sales-qualified submissions, which pricing tier CTA you came from — so we can measure how many visitors convert into enquiries and which channels drive that. It does not receive the name, email, phone number, or message you entered, or the role you selected in the form. We do not share the data it collects with any third party beyond Google.

Separately from Google, we run our own simple visit counter on this marketing website and the free-trial sign-up page, so we can see how many people visit each day, including people who decline analytics cookies. Each page view records the page address (without any query string), the time, your country and broad device type (phone, tablet or computer), the website that referred you, any campaign tags on the link you used, and whether you arrived from a Google or Meta advertisement. It sets no cookie and stores nothing on your device. To count distinct visitors, your IP address and browser details are combined with a random value that changes every day and then irreversibly scrambled; the IP address and browser details themselves are never stored, and the scrambled value cannot be linked across days. These records are kept for 90 days, are not shared with anyone, and are not collected if your browser sends a Do Not Track or Global Privacy Control signal.

We advertise on Google Search (Google Ads). When you click one of our ads, Google adds a click identifier (such as gclid) to the address of the page you land on. Unless you decline cookies (see below), Google Analytics and Google Ads use cookies and that identifier to recognise that a visit came from one of our ads, so we can measure which ads lead to a demo request, a checklist download, or a free-trial sign-up. We also store the campaign tags from the link and, unless you declined cookies, the click identifier alongside that demo request, checklist download, or free-trial account, so we can tell which ads bring in real schools and report those results back to Google Ads. The click identifier is a code issued by Google; it does not contain your name, email address, or phone number, and we do not send those to Google Ads. We may also use Google's audience features (remarketing) to show our ads to people who have previously visited this site; you can turn off ad personalisation in your Google Ads Settings (adssettings.google.com).

Your cookie choice. When you first visit, a notice lets you accept or decline analytics and advertising cookies; until you decline, they are on. If you decline, we tell Google's tags not to set or read those cookies on your later page views, we delete the Google cookies this site has already set where your browser allows, and we do not store the ad click identifier. Google may still receive limited signals that do not use cookies, such as the fact that a page was visited. Your choice is remembered in your browser and you can change it at any time using “Cookie settings” in the footer of this site.

1. Who this is for, and who does what

EduCore is used by Schools (the paying customer — a school, or group of schools) and by Users the School authorises: school owners, principals, administrators, teachers, finance and support staff, parents/guardians, and students.

For personal data relating to students, parents/guardians, and staff (“School Personal Data”), the School is the data controller under Kenya's Data Protection Act, 2019 (the “DPA”) — the School decides what data to collect and why. EduCore is the data processor — we process School Personal Data only to provide the Service, on the School's instructions, as set out in our Terms of Service and any Data Processing Addendum.

For personal data EduCore collects directly about the School itself as our customer (e.g., the school's own contact details, billing information, and the accounts of the individuals who administer the Account), EduCore is the data controller.

If you are a parent, guardian, student, or staff member and have a question about your own data, your school is your first point of contact — they control what's collected and why, and can action most requests directly. If your school is unable to help, you may also contact us using the details in Section 13.

2. What we collect

Depending on which modules the School enables, the Service may process:

We do not decide which of these categories a School collects — that is the School's decision, reflecting its own operations and legal obligations. We built the Service so a School only sees the modules (and therefore the data categories) it has actually enabled.

3. Sensitive personal data

Under the DPA, biometric data and data concerning health are “sensitive personal data,” subject to stricter requirements than general personal data. Where a School enables biometric attendance or health/medical record-keeping, the School is responsible for obtaining explicit consent (from a parent/guardian for a student, or from staff for their own data) before that data is collected, consistent with DPA requirements for sensitive personal data. We support this technically (these modules are opt-in per School, and access to this data is more tightly restricted within the Service than general records), but the underlying consent is the School's responsibility to obtain and record.

4. Children's data

Most students using the Service are children under Kenyan law (under 18). Consistent with DPA section 33, personal data relating to a child may only be processed with the consent of the child's parent or guardian, and where the processing is in the best interests of the child. This consent is obtained and recorded by the School as part of enrolment, not directly by EduCore — we are a processor acting on the School's instructions, not the party collecting consent from families. Schools should ensure their own enrolment/consent processes meet this standard.

5. Why we process this data

We (as processor, on the School's instructions as controller) process School Personal Data for purposes including: delivering the modules the School has enabled (admissions, academics, attendance, finance, communication, staffing, etc.); enabling the School to communicate with parents/guardians; processing fee payments via M-Pesa and reconciling them against invoices; generating reports for the School's own use; maintaining the security and integrity of the Service; and complying with legal obligations that apply to us as a processor. The lawful basis for each of these (performance of a contract, legitimate interest, consent, or legal obligation, per DPA section 30) is ultimately the School's determination, since the School is the controller — our Data Processing Addendum sets out the basis on which we act.

6. AI-assisted processing

The Service uses AI to draft report-card narrative comments (grounded in a student's recorded academic performance) and draft parent-facing WhatsApp/SMS messages. These drafts are always reviewed and approved by School staff before being finalised or sent — no AI-generated content reaches a parent, student, or permanent record without human review. We do not use automated processing to make decisions with legal or similarly significant effects on any individual (e.g., admissions, grading, or disciplinary outcomes) without meaningful human involvement.

7. Who we share data with (sub-processors)

We use the following categories of third-party service to operate the Service. None of them are permitted to use School Personal Data for their own purposes.

We will update this list, and notify the School, if we change sub-processors in a way that affects how School Personal Data is handled.

8. Data retention

We retain School Personal Data for as long as the School's Account is active, and for the periods described in our Terms of Service following termination (30 days for export, then deletion from active systems within a further 60 days, subject to legal retention requirements and normal backup-rotation timing). Some records (e.g., payroll data relevant to tax obligations) may be subject to longer statutory retention periods, which are the School's responsibility to specify to us if they exceed our default schedule.

9. International data transfers — current status

Our database infrastructure (Supabase) is hosted in the eu-central-1 region (Frankfurt, Germany), and our error-monitoring provider (Sentry) also uses an EU-region ingest endpoint. This means data is transferred outside Kenya as part of normal Service operation — for Supabase, this includes the full range of School Personal Data; for Sentry, this is limited to technical error data with default PII collection explicitly disabled, which reduces but does not eliminate the transfer question, since error payloads can still incidentally include identifiers depending on where an error occurs.

This is flagged here deliberately, not glossed over. The DPA's cross-border transfer regime (sections 48–50) requires either an adequacy determination, appropriate safeguards, or another lawful transfer ground, before personal data leaves Kenya. Section 50 additionally imposes a heightened, specific requirement for certain categories of data controller/processor — including providers of basic (primary/secondary) education under the Basic Education Act — to keep at least one serving copy of personal data in a data centre located in Kenya. As a school-management platform serving Kenyan basic-education institutions, EduCore likely falls within that category, and we do not currently have a Kenya-based serving copy of the database. This is a genuine, unresolved item, not a documentation formality, and we are working through the engineering and legal steps required to address it.

10. Data security

We maintain technical and organisational measures appropriate to the sensitivity of School Personal Data, including per-school data isolation at the database level (row-level security policies scope every school's data to that school), encryption of data in transit and at rest, role-based access control within the Service, security-definer database functions with pinned search paths and least-privilege grants to prevent privilege-escalation between tenants, restricted and encrypted access to M-Pesa credentials, and regular dependency and vulnerability review.

11. Data breach notification

If we become aware of a security incident affecting School Personal Data, we will notify the affected School without undue delay, so the School can meet its own breach-notification obligations — including, where applicable, notifying the Office of the Data Protection Commissioner within the DPA's required timeframe and affected data subjects where required.

12. Data subject rights

Individuals whose data is processed through the Service (students, via their parent/guardian; parents/guardians themselves; staff) have rights under the DPA, including to be informed of how their data is used, to access it, to request correction of inaccurate data, to object to certain processing, and to request erasure or data portability, subject to the conditions in the DPA.

Because the School is the data controller, these requests should generally go to the School first — they hold the records and are best placed to action most requests directly within the Service. Where a request requires our assistance, we support the School in fulfilling it. If you're unable to resolve a request with your school, you may contact us at support@educoreafrica.com.

13. Contact and Data Protection Officer

Email: support@educoreafrica.com
Data Protection Officer: James Maina, Founder
ODPC registration: EduCore Technologies Ltd is registered with the Office of the Data Protection Commissioner as required under the Data Protection Act, 2019.

14. Changes to this policy

We will update this policy as the Service or our data practices change, and will notify Schools of material changes with reasonable notice, consistent with our Terms of Service.