Privacy Notice

1. Who we are and how to contact us

Elimu Sasa School is operated by Elimu Sasa Limited, a company registered in Kenya. Elimu Sasa Limited generally acts as the Data Controller for the personal data described in this notice. This means we decide why and how that information is used, and we are responsible for protecting it.

This notice is written to align with the Data Protection Act, 2019 of Kenya and its Regulations. It is subject to final legal review.

2. Who this notice covers

This notice applies to personal data about:

• visitors to elimusasa.com and learn.elimusasa.com;
• applicants and learners, and alumni after they complete a course;
• parents or guardians, where they are involved in an application;
• instructors, industry mentors and alumni mentors, and people who apply for those roles;
• sponsors, employer partners and industry partners, and their contact people; and
• anyone who contacts us by email, phone, WhatsApp, booking tools or our forms.

3. The information we collect

Public profiles and private records

Some information may appear publicly, but only with permission:

• Instructor and mentor profiles may show your name, photograph, role, professional biography, expertise, selected achievements and professional links. Your phone number, personal email, ID details, payment information, address, contract and internal notes stay private.
• Graduate portfolios are published only if the graduate gives explicit, recorded permission. Private mentor notes are never published.
• Certificate verification shows only what is needed to confirm a certificate is genuine. See our Assessment & Certification policy.

4. Sensitive personal data

We do not ask for sensitive personal data, such as health information, religious or political beliefs, ethnic origin or biometric data, as part of applications or ordinary learning. Please do not include it in free-text answers unless it is needed.

If you choose to tell us about a health condition or disability so that we can support you, for example by adjusting how you take part in sessions, we will use it only for that purpose, with your explicit consent, limit access to the people who need to know, and keep it no longer than necessary.

5. Why we use information and our lawful basis

We only use personal data where the law allows it. We do not rely on consent for everything; the basis depends on the purpose.

Where we rely on legitimate interests, we balance them against your rights and expectations. You can object, as explained in section 15.

6. Live online learning and recordings

Many of our programmes are delivered live online. During a live session, other participants may see or hear your name, voice, webcam image, screen sharing, chat messages and learning activity. You can usually choose to keep your camera off unless an activity needs it.

Where we record a session:

• Purpose: so learners in that cohort can catch up or revise, and for quality assurance and resolving concerns.
• Notice: we tell participants at the start of a recorded session.
• Access: recordings are available only to the cohort, its instructors and mentors, and authorised Elimu Sasa staff.
• Your obligations: learners must not record, download, screenshot or share sessions or other people’s contributions outside the cohort.
• Retention: our current target is to keep class recordings for up to 12 months after the cohort finishes, after which they are deleted unless needed for a specific complaint or legal matter.

Using a recording in marketing is a separate purpose and needs separate permission. See section 9.

7. Artificial intelligence and your information

Elimu Sasa is deliberately AI-enabled, and we are open about it.

• AI is taught in some of our programmes, and learners may use AI tools as explained in our Responsible AI Use policy.
• We may use AI-assisted tools to support legitimate educational and administrative work, such as drafting learning materials, summarising feedback or organising information.
• We avoid putting unnecessary personal data into AI tools, and we protect confidential and sensitive information, including information about other people.
• Important decisions about you, such as admissions, certification and discipline, are made by people. AI does not make those decisions on its own.

When you use AI tools yourself, do not enter other people’s personal data or confidential client information unless you are authorised to do so.

8. Marketing and your choices

We only send marketing, such as news about new courses, events, learning resources and opportunities, if you have opted in. Opting in is never required to apply or enrol, and the box is never ticked for you. We record when and how you opted in so we can show it.

You can opt out at any time by using the unsubscribe link in an email, replying STOP to a message, or emailing privacy@elimusasa.com. We keep a minimal record of your opt-out so we do not contact you again by mistake.

9. Testimonials, photographs and video

Enrolling on a course does not give us permission to use your testimonial, name, photograph, voice or video in marketing. We ask for that separately, explain how it will be used, and record your answer. You can withdraw permission for future use at any time, although we may not be able to recall materials already printed or published.

10. Who we share information with

We do not sell personal data. We share it only where needed, with:

• Service providers who help us run Elimu Sasa, such as website and email hosting, our learning platform, video conferencing, messaging, booking, payment processing and backup services. They may only use the information to provide their service to us;
• instructors and mentors, who see the information they need to teach, review and support learners;
• sponsors or employers who pay for your course, limited to enrolment, attendance and completion information, unless you agree to more;
• employers or partners you ask us to introduce you to, limited to what you agree to share, such as your portfolio and mentor assessment;
• people verifying a certificate, limited to the verification details described in our certification policy; and
• authorities, courts or advisers, where the law requires it or it is needed to establish, exercise or defend legal claims.

11. International transfers

Some of our service providers store or process information outside Kenya, for example email, video conferencing, booking and messaging services operated by international companies. Where personal data is transferred outside Kenya, we take steps required by Kenyan law, such as choosing providers with appropriate safeguards and contractual protections. You can ask us for more information about these safeguards at privacy@elimusasa.com.

12. How long we keep information

We keep information only as long as we need it for the purpose it was collected, including legal, accounting and certificate verification needs. These are our current working retention targets, which we review regularly:

13. How we protect information

We use appropriate technical and organisational safeguards to protect personal data, including access controls that limit who can see information, secure connections to our websites, protected storage for documents such as CVs, regular backups and software updates, and responsibilities for staff, instructors and mentors. No system is perfectly secure, so we review our safeguards as our services grow.

14. If something goes wrong

If we become aware of a personal data breach, we will investigate it, contain it, assess the risk, and fix the cause. Where the law requires, we will notify the Office of the Data Protection Commissioner and the people affected within the time the law sets. If you think your information has been exposed, please tell us straight away at privacy@elimusasa.com.

15. Your rights

Under Kenyan data protection law you have the right, where applicable, to:

• be informed about how your personal data is used, which is what this notice does;
• access the personal data we hold about you;
• object to processing of all or part of your personal data;
• correct false or misleading data;
• delete false, misleading or unnecessary data;
• withdraw consent where we rely on consent, without affecting processing that happened before;
• restrict processing in certain circumstances;
• data portability, receiving data you gave us in a structured, commonly used format; and
• not be subject to a decision based solely on automated processing that significantly affects you, with safeguards where such processing is used.

How to make a request

Email privacy@elimusasa.com and tell us what you would like us to do. We may need to confirm your identity before acting, and we will respond within the timeframes set by Kenyan law. Some information may need to be kept even after a deletion request, for example financial records or a certificate verification record, and we will explain if that applies.

Complaints to the regulator

We would like the chance to resolve any concern first. You also have the right to complain to the Office of the Data Protection Commissioner of Kenya: www.odpc.go.ke.

16. People under 18

Our standard minimum enrolment age is 18, and our application form asks applicants to confirm they are 18 or older. If an applicant tells us they are under 18, we do not complete an ordinary application. Any future programme for 16 and 17 year olds will require parent or guardian consent and additional safeguards. See our Safeguarding & Under-18s policy.

17. Cookies

Our Cookie Policy explains what our websites store in your browser and how to change your choices.

18. Changes to this notice

We will update this notice when our practices or the law change. The version and date at the top of this page show when it last changed. Where a change is significant, we will tell the people affected.