Privacy Policy

EduVantage ("we", "us", or "our") is a school management platform operated by EduVantage Platform Ltd., a technology company registered in Kenya. We provide an integrated suite of tools for educational institutions, including academic management, fee collection, payroll, communication, and parent engagement services.

This Privacy Policy applies to all users of the EduVantage platform — including school administrators, teachers, parents, students, and platform super-administrators — who access our services via our web application at eduvantage.africa or any associated sub-domains.

2.1 Information You Provide

When schools, staff, or parents register and use the platform, we collect:

• School Information: Institution name, county, school type, curriculum type, NEMIS code, Safaricom Paybill/Till numbers, and bank account details for settlement purposes.
• Staff & Administrator Data: Full names, national ID numbers, phone numbers, email addresses, payroll details (salary, allowances, deductions), role and department assignments.
• Learner (Student) Data: Admission numbers, full names, date of birth, grade/class/stream, gender, medical notes, and national examination registration numbers.
• Parent & Guardian Data: Full names, phone numbers linked to registered students, and payment transaction history.
• Academic Records: Examination marks, grades, attendance records, academic performance history, curriculum pathway, and national exam predictions.
• Financial Data: Fee payment records, receipts, outstanding balances, payroll calculations, and settlement transaction logs.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, timestamps of logins, session durations, and audit trail logs of administrative actions.
• Device & Browser Data: IP address, browser type, operating system, and screen resolution for security and compatibility purposes.
• Cookies: Session cookies for authentication and optional analytics cookies. See Section 7 for details.

2.3 Payment Information

We collect M-Pesa transaction data via the Safaricom Daraja API, including phone numbers, transaction amounts, MPESA reference codes, and timestamps. We do not store raw M-Pesa PIN data; all payment processing is handled via Safaricom's secure gateway.

We use collected data solely to deliver, maintain, and improve the EduVantage platform. Specifically:

We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

4.1 Within Your School

Data is shared with authorized users within each school tenant — administrators, teachers, and parents — strictly based on their assigned role permissions. Data is tenant-isolated; no school can access another school's data.

4.2 Financial & Communication Third-Party API Processors (Important Notice)

• Turso & Cloudflare Infrastructure: Global edge network and database host operating under strict SOC 2 & ISO 27001 data processing agreements.

4.3 Legal Obligations

We may disclose personal data when required to do so by Kenyan law, court order, or regulatory authority, including the Office of the Data Protection Commissioner (ODPC).

4.4 Business Continuity

In the event of a merger, acquisition, or asset sale, user data may be transferred to the successor entity, subject to equivalent privacy protections.

We retain data for as long as a school's subscription is active and for a period thereafter as required by law or legitimate business purposes:

• Academic Records: Retained for a minimum of 7 years per Kenya Education Ministry guidelines.
• Financial Records (Receipts & Payroll): Retained for 7 years in compliance with the Kenya Revenue Authority (KRA) requirements.
• Audit Logs: Retained for 3 years for security and dispute resolution.
• Inactive Accounts: School accounts inactive for more than 24 months will receive a 90-day data deletion notice before permanent deletion.

Upon school account termination, anonymized statistical data may be retained for platform improvement analytics.

EduVantage employs multiple layers of technical and organizational security to protect your data:

• Cryptographic Integrity Locks: All report cards and payment receipts are cryptographically bound to the official student registry, preventing unauthorized document generation.
• Tenant Isolation: Each school operates in a fully isolated database namespace — cross-tenant data access is architecturally impossible.
• TLS Encryption: All data in transit is encrypted using industry-standard TLS 1.3.
• Role-Based Access Control (RBAC): Users can only access data pertinent to their assigned role (admin, teacher, parent, student).
• Audit Trail: All critical administrative actions (data edits, deletions, financial transactions) are logged immutably.
• Edge Architecture: We deploy on Cloudflare's global edge network, providing DDoS protection and 99.9% availability SLA.

Despite our best efforts, no system is 100% secure. We encourage schools to maintain strong password policies and promptly report any suspected security incidents to security@eduvantage.africa.

EduVantage serves educational institutions that enroll minor children. We take children's data protection with the utmost seriousness:

• Learner data is only entered and managed by authorized school administrators — minors do not directly register on the platform.
• Parent portal access is strictly limited to parents/guardians whose phone numbers are registered against a verified learner in the school registry.
• We do not use learner data for advertising, profiling, or any purpose beyond the direct delivery of educational management services.
• Student performance data is only accessible to the student's own school, assigned teachers, and verified parents — never made public or shared across schools.

Our practices are designed to comply with the Children Act 2022 (Kenya) and best practices for child data protection in educational technology.

We use the following types of cookies:

We do not use third-party advertising or tracking cookies. Analytics data is processed in aggregate and never linked back to individual users.

Under the Kenya Data Protection Act, 2019 and applicable regulations, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to Object: Object to processing of your data in specific circumstances.
• Right to Data Portability: Request your data in a structured, machine-readable format.
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, submit a written request to privacy@eduvantage.africa. We will respond within 21 days as required by the ODPC.

EduVantage operates as a payment aggregator under our central Safaricom Paybill. This means:

• Parent M-Pesa payment data (phone number, amount, reference) is processed through Safaricom's Daraja API and stored in your school's isolated payment ledger.
• A platform convenience fee of KES 50 is automatically deducted from each transaction as disclosed at the point of payment.
• School settlement disbursements (B2C/B2B) are processed via Safaricom's Business to Customer API to registered school bank accounts or Till numbers.
• No full payment card numbers are stored by EduVantage. Card processing (where applicable) is handled by PesaPal under PCI DSS compliance.

EduVantage primarily stores and processes data within Kenya and on Cloudflare's edge infrastructure, which may include servers in regions outside Kenya. Where international transfers occur, we ensure equivalent data protection standards apply through contractual data processing agreements with all sub-processors.

We may update this Privacy Policy periodically to reflect changes in our practices or legal obligations. We will notify registered school administrators via email and an in-platform banner at least 30 days before material changes take effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

For privacy-related inquiries, data requests, or to report a concern:

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.