Privacy Policy

EduVantage ("we", "us", or "our") is an institutional educational operating system and multi-curriculum school management platform operated by EduVantage Platform Ltd., a technology company incorporated and headquartered in Nairobi, Kenya.

We provide a centralized, cloud-native suite of services for primary, secondary, international, and tertiary institutions across Africa. Our platform automates academic administration (CBE/CBC, 8-4-4, Cambridge, British, IB, US Common Core, and TVET), mobile fee collection and bank reconciliation, staff payroll, campus welfare, communication broadcasts, and parent-teacher engagement.

This Privacy Policy applies to all users accessing or utilizing the EduVantage platform — including school directors, headteachers, principals, teachers, bursars, administrative staff, parents, legal guardians, students, and system administrators — across our primary domain eduvantage.africa, associated sub-domains, and client portals.

2.1 Information Provided by Educational Institutions

When a school registers a tenant account or administers its portal, we collect and process:

• Institutional Profile: School legal name, registration/NEMIS code, county, sub-county, postal address, official contact emails, phone numbers, school logo, principal/headteacher digital signatures, official school seal/stamp, curriculum frameworks, and academic term schedules.
• Staff & Administrator Credentials: Full names, national identification or passport numbers, institutional email addresses, mobile telephone numbers, employment roles, departmental assignments, teaching subject allocations, and biometric or PIN authentication credentials for secure financial actions.
• Learner (Student) Records: Unique admission numbers, full legal names, dates of birth, gender, grade/form, stream, hostel/dormitory allocation, transport route, attendance records, disciplinary logs, and extracurricular awards.
• Academic & Evaluation Data: Formative assessment rubrics (Exceeding, Meeting, Approaching, Below Expectation), summative test scores, converted percentages (including custom-scored exams e.g. out of 50 or 40), class ranks, subject mean scores, teacher remarks, and automated pathway predictions (STEM vs. Social Sciences).
• Financial & Fee Records: Student fee ledgers, tuition structures, transport/boarding/canteen fee balances, scholarship allocations, payment receipts, invoice history, and payroll registers (salaries, statutory deductions for PAYE, SHIF, NSSF, and Housing Levy).

2.2 Information Provided by Parents & Guardians

When parents or legal guardians access the Parent Portal or interact with school communications, we collect:

• Guardian Identification: Full names, mobile phone numbers registered with the student's admission record, email addresses, and residential/pickup locations for transport logistics.
• Payment & Transaction Information: Mobile money transaction reference codes (e.g. M-Pesa receipts), payment timestamps, student admission numbers associated with payments, payment amounts, and bank deposit references. We do not collect or store parent mobile money PINs or banking passwords.
• Parent Feedback & Inquiries: Inbound communications, meeting requests, and acknowledgment receipts for term circulars and fee requirement sheets.

2.3 Information Collected Automatically & Offline Cache

• Client-Side Local Cache (Offline Mark Entry): To prevent data loss during school Wi-Fi or cellular network drops, our teacher markbooks temporarily store entered marks, grade drafts, and attendance logs in the browser's local memory (`localStorage` and `IndexedDB`). This cache is encrypted in local browser memory and synchronized with the cloud once network connectivity is re-established.
• Audit & Security Telemetry: Immutable audit logs capturing administrative actions, mark edits, score overrides, fee adjustments, login timestamps, IP addresses, user agents, and cryptographic integrity lock verifications.
• Device & Network Data: Browser engine, device operating system, screen dimensions, network latency, and connection states to deliver responsive layouts and optimize bandwidth for low-connectivity environments.

We process collected data strictly for legitimate educational, administrative, and contractual purposes:

EduVantage partners with vetted, enterprise-grade third-party infrastructure and API providers to deliver financial clearing, telecommunications, and edge cloud security. We do not sell, rent, or trade your personal or institutional data to any third party for marketing or advertising purposes.

EduVantage uses cookies, session storage, and client-side storage technologies to provide a fast, secure, and reliable educational platform. We believe in complete transparency regarding the data stored on your device.

5.1 Classification of Cookies & Local Storage

5.2 Absolute Prohibition on Third-Party Advertising Cookies

EduVantage NEVER places third-party advertising cookies, retargeting pixels, social media tracking beacons, or data broker scripts on any part of our platform. We do not sell user behavioral data to any commercial network.

5.3 How to Control and Manage Cookies

Most modern web browsers allow you to manage or delete cookies via your browser settings:

• Google Chrome: Settings → Privacy and Security → Third-party cookies.
• Apple Safari: Preferences → Privacy → Manage Website Data.
• Mozilla Firefox: Settings → Privacy & Security → Enhanced Tracking Protection.
• Microsoft Edge: Settings → Cookies and Site Permissions.

Note: Disabling strictly essential cookies will prevent authentication and make it impossible to log in to your EduVantage school or parent portal.

Because EduVantage serves primary, secondary, and kindergarten institutions, we enforce stringent student data privacy safeguards designed in compliance with the Children Act 2022 (Kenya), the Kenya Data Protection Act 2019, and global educational standards:

• No Direct Commercial Enrolment: Minors cannot create self-service commercial accounts on EduVantage. Student records are created solely by vetted, authorized school administrators acting under legitimate educational mandate.
• Verified Parental Access: Parents and legal guardians can only access records for children linked to their verified mobile phone number in the school's official student registry.
• Zero Commercial Exploitation: Student academic records, attendance history, health notes, and photos are never monetized, never used for behavioral profiling, and never exposed to external search engines or third-party ad networks.
• Data Minimization: We only collect educational, demographic, and contact information strictly necessary to administer schooling, verify academic milestones, and ensure child welfare.

We retain personal and educational records only for as long as required to fulfill educational services and meet statutory Kenyan record-keeping laws:

• Academic Transcripts & Report Cards: Retained for a minimum of 7 years following student graduation to allow former students to obtain verified certified transcripts and transition records per Kenya Ministry of Education guidelines.
• Financial Books, Fee Receipts & Payroll Ledgers: Retained for 7 years in strict compliance with the Kenya Revenue Authority (KRA) and the Public Finance Management Act.
• Security Audit Trails & Integrity Logs: Retained for 3 years for fraud investigation, security forensics, and dispute resolution.
• Inactive Institutional Tenants: School tenant accounts inactive for over 24 months are flagged for archival and will receive a 90-day written notice prior to permanent cryptographic deletion.

EduVantage maintains multi-layered technical, physical, and organizational safeguards:

• Cryptographic Integrity Locks & QR Verification: All generated student report cards and official receipts are embedded with tamper-evident QR verification codes linking directly to the institution's immutable cloud record. Any unauthorized modification to printed marks is immediately detected.
• Tenant Database Isolation: Each school operates within its own cryptographically isolated namespace. Cross-tenant database queries are architecturally blocked.
• End-to-End Encryption: All data transmitted between user devices and our servers is encrypted using TLS 1.3 with modern cipher suites. Database records and attachments on AWS S3 are encrypted at rest using AES-256.
• Permanent Disbursement Lock: Adhering to strict financial engineering invariants, settlement records marked as disbursed can never be downgraded, reversed, or overwritten by any background sync or retry process.
• Role-Based Access Control (RBAC): Granular permissions ensure teachers, bursars, administrators, and parents only access data relevant to their specific role.

Under the Kenya Data Protection Act, 2019 and international data privacy principles (including GDPR), data subjects (parents, staff, and adult learners) hold the following enforceable rights:

• Right to be Informed: The right to know what personal data is collected, how it is processed, and who receives it.
• Right of Access: The right to request a verifiable copy of all personal data held about you by submitting a request to our Data Protection Office.
• Right to Rectification: The right to request the prompt correction of inaccurate, outdated, or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): The right to request the deletion of your personal data where it is no longer required for legitimate educational or statutory retention purposes.
• Right to Data Portability: The right to receive your institutional and student records in a structured, commonly used, machine-readable format (CSV/JSON/PDF).
• Right to Object or Restrict Processing: The right to object to specific data processing activities where processing is based on legitimate interest or consent.

To exercise any of these rights, contact our Data Protection Office at privacy@eduvantage.africa. We will acknowledge receipt within 48 hours and provide a full determination within 21 calendar days as mandated by Kenyan statutory guidelines.

EduVantage primarily stores and processes institutional records within Kenyan cloud regions and on Cloudflare's distributed edge infrastructure. Where sub-processors (such as Cloudflare, Amazon Web Services, or Twilio) route or store data outside the Republic of Kenya, we ensure that such transfers comply with Section 48 of the Kenya Data Protection Act, 2019 through contractual Standard Contractual Clauses (SCCs) and verified SOC 2 / ISO 27001 data processing safeguards.

We may amend this Privacy Policy periodically to reflect technological advances, new platform modules, or changes in legal regulations. When material amendments occur, we will post an advance notification banner within administrator and parent portals at least 30 calendar days prior to the effective date and dispatch an email summary to all registered institutional contacts.

For data privacy inquiries, subject access requests, or security concerns, reach out to our dedicated officers:

If you believe your data privacy rights have been infringed and our Data Protection Office has not resolved your concern within 21 days, you have the right to lodge a formal complaint with the statutory authority:
Office of the Data Protection Commissioner (ODPC)
Britam Tower, 13th Floor, Hospital Road, Upper Hill, P.O. Box 30920-00100, Nairobi, Kenya
Website: www.odpc.go.ke · Email: info@odpc.go.ke