Institutional Data Protection Policy

ALPHAX ACADEMY
MASTER DATA PROTECTION & PRIVACY POLICY

Policy Version:

v1.0

Commencement Date:

18 May 2026

Approved By:

Board of Directors, Alphax Academy

Policy Owner:

Data Protection Officer (DPO)

Regulatory Jurisdiction:

Republic of Kenya (Data Protection Act, 2019)

In this document, ‘the School’ means Alphax Academy and includes its management, staff, agents, and authorized third parties acting on its behalf.

1.  INTRODUCTION

This Data Protection Policy ('Policy') is formally adopted by the School to ensure full compliance with the Data Protection Act, 2019 of Kenya, the Data Protection (General) Regulations, 2021, and the statutory ODPC Guidance Note on Processing Children’s Personal Data. The School is fully committed to safeguarding the foundational rights, privacy, and digital security of its students, parents, staff members, and institutional partners.

2.  DEFINITIONS

• • Personal Data: Any information relating to an identified or identifiable natural person.

  • Sensitive Personal Data: Data revealing a natural person’s race, health status, ethnic origin, social origin, conscience, belief, genetic data, biometric data, property details, marital status, or family details including the names of the person's children, parents, spouse or spouses, sex, or sexual orientation.

  • Child: Any natural person who has not attained the age of 18 years (minor status).

  • Data Subject: The autonomous individual to whom personal data relates (including Students, Parents, Guardians, and Staff).

  • Processing: Any operation or set of operations performed on personal data, including collection, recording, storage, adaptation, retrieval, disclosure, dissemination, erasure, or destruction.

3.  PRINCIPLES OF DATA PROTECTION

The School mandates that all operational entities process personal data strictly under the following statutory principles:

• • Processed lawfully, fairly, and in a transparent manner.

  • Collected for explicit, specified, and legitimate purposes and not processed incompatibly.

  • Adequate, relevant, and limited to what is necessary in relation to processing purposes (Data Minimization).

  • Accurate and kept up to date; erased or rectified without undue delay.

  • Retained in a form which permits identification for no longer than is necessary.

  • Secured against unauthorized or unlawful processing, accidental loss, destruction, or damage using appropriate technical and organizational measures.

4.  LAWFUL BASIS FOR PROCESSING

All institutional processing activities must be grounded in at least one of the following statutory bases:

• • Consent: Explicit, freely given, specific, and informed affirmative action by the data subject or legal guardian.

  • Performance of a Contract: Necessary for entering into or executing an agreement, including student admission contracts and employee service contracts.

  • Legal Obligation: Mandated by law, regulatory standards, or statutory frameworks, including mandatory data returns to the Ministry of Education or the Kenya Revenue Authority (KRA).

  • Vital Interests: Critically required to protect the life or health of the data subject during medical emergencies where obtaining immediate consent is impossible.

  • Public Interest: Required for the performance of statutory educational metrics, national testing frameworks, or public health safeguards.

  • Legitimate Interests: Undertaken for the secure, efficient administrative and physical management of the school infrastructure (e.g., deploying closed-circuit television (CCTV) systems for perimeter security and student safeguarding), provided such operations do not override the fundamental rights and freedoms of the data subjects.

5.  PROCESSING OF CHILDREN’S DATA

As an educational institution processing data belonging to minors, the School enforces specialized safeguards aligned with ODPC guidance:

• • The processing of a child’s personal data is strictly unlawful unless explicit, written, affirmative consent is granted by the child’s parent or verified legal guardian.

  • The School implements appropriate technical age-verification mechanisms and guardian-matching protocols on all web intake and physical portals.

  • All public-facing and platform-specific privacy notices shall be designed using clear, age-appropriate language to empower comprehension.

6.  RIGHTS OF DATA SUBJECTS

The School formally recognizes and upholds the following statutory rights of data subjects under Section 26 of the DPA:

• • Right to be Informed: The right to receive clear, concise information regarding data collection workflows.

  • Right of Access: The right to request and obtain a structural copy of all personal records maintained by the School.

  • Right to Rectification: The right to request the updating or correcting of inaccurate, outdated, or incomplete records.

  • Right to Erasure: The right to request the absolute deletion of data where its processing is no longer legally justified.

  • Right to Object: The right to object to processing based on legitimate interests or direct institutional marketing.

  • Right to Data Portability: The right to receive personal data in a structured, electronic, machine-readable format.

  • Right to Withdraw Consent: The right to seamlessly retract previously granted processing approvals at any time.

6.1 Statutory Rights Execution Window & Turnaround Protocols

Data subjects or their legal guardians may exercise their rights free of charge by filing an official request to the Data Protection Officer. The School shall acknowledge all requests immediately and complete the formal execution process within thirty (30) calendar days from the date of identity verification.

6.2 Right to Lodge a Formal Complaint with the Regulator

If a data subject feels that the School has not addressed a data privacy concern adequately, they retain the statutory right to file a regulatory appeal directly with the Office of the Data Protection Commissioner (ODPC) via complaints@odpc.go.ke or through www.odpc.go.ke.

7.  PHOTOGRAPHY AND SOCIAL MEDIA

• • Explicit Opt-In: The School mandates prior written, granular, opt-in consent from parents/guardians before taking, capturing, or publishing photographic media or video recordings of students for digital marketing, web publishing, or promotional pamphlets.

  • Right of Withdrawal: Parents maintain the right to withdraw social media consent at any point. Upon notification, the School shall scrub and delete the respective media files from its active digital platforms within a reasonable, immediate timeframe.

  • Closed-Circuit Television (CCTV): All perimeter surveillance systems deployed for physical protection shall be bounded by highly visible signage warnings and governed exclusively under a dedicated, specialized CCTV Security Policy.

8.  DATA RETENTION SCHEDULE

The School enforces an absolute data minimization standard. Internal storage limits are strictly categorized as follows:

• • Academic Transcripts & Graduation Records: Permanent archiving (as mandated by the Ministry of Education statutory standards).

  • Unsuccessful Admission Applications: Safely purged 12 months following the closure of the active application portal window.

  • Financial & Fee Payment Records: Retained for 7 years (pursuant to statutory tax, auditable, and accounting regulations).

  • Personnel & Staff Records: Maintained for 6 years following the formal termination or expiration of the employment service agreement.

  • Student Health & Medical Dossiers: Safely stored until the student attains the age of 25, or 7 years following their formal departure from the institution, whichever threshold occurs later.

9.  THIRD-PARTY DATA SHARING

The School shall not share, lease, or distribute personal data to third parties unless a valid lawful basis applies. All external data processing entities - including automated school transport trackers, cloud-hosted platform hosts, software-as-a-service providers, and security vendors - must be legally bound by formal, comprehensive Data Processing Agreements (DPAs) executed in compliance with Section 42 of the Data Protection Act.

10.  INTERNATIONAL DATA TRANSFERS & LOCALIZATION

In accordance with the Data Protection (Relations) Regulations, the School ensures that core identity and health processing systems reside within localized servers inside the Republic of Kenya. Cross-border transfers (e.g., foreign curriculum management like IGCSE/IB platforms, or core system providers like Google Workspace or Microsoft 365) shall only be executed if the destination jurisdiction guarantees adequate regulatory oversight or the vendor satisfies approved Standard Contractual Clauses (SCCs) endorsed by the ODPC.

11.  DATA BREACH MANAGEMENT & NOTIFICATION TIMELINES

• • Immediate Internal Escalation: Any faculty member, administrative staff, or operational partner who detects or suspects a data security incident must notify the Data Protection Officer immediately.

  • Mandatory ODPC Escalation: The School shall formally notify the Office of the Data Protection Commissioner within seventy-two (72) hours of detecting any data breach that introduces a threat to the rights and freedoms of natural persons.

  • Affected Individual Escalation: Where a data breach presents a elevated risk of identity fraud, financial risk, or harm, the School shall deliver a transparent notification alert directly to the affected parents, guardians, or individuals without undue delay.

12.  PHYSICAL, TECHNICAL, AND ORGANIZATIONAL SAFEGUARDS

The School implements rigorous multi-layered defense controls to preserve the integrity of personal records:

• • Administrative Safeguards: Mandatory data governance onboarding for all teaching and administrative personnel, restricted access matrices based on job descriptions, and routine policy revisions.

  • Technical Safeguards: Deployment of end-to-end data encryption across all intake forms, active secure socket layer (SSL/HTTPS) configurations, system access logs, firewalls, and complex multi-factor authentication (MFA) parameters for student information portal access.

  • Physical Safeguards: Strictly locked physical server cabinets, restricted physical entry to the headteacher’s designated strong room and Matron's diagnostic medical files, and secure disposal protocols for print media.

13.  INSTITUTIONAL GOVERNANCE & EXECUTION CONTACTS

• • ODPC Registration: The School maintains and guarantees a continuously active, updated annual registration status as a certified Data Controller with the ODPC.

  • Impact Assessments (DPIA): The School mandates a comprehensive Data Protection Impact Assessment (DPIA) before deploying any structural high-risk technological system, including large-scale biometric tracking or perimeter surveillance arrays.

14.  DATA PROTECTION OFFICER (DPO) CONTACTS

For any inquiries regarding this policy, to exercise your statutory data subject rights, or to submit formal compliance queries, please reach out directly to our designated compliance desk:

• • Designated Authority: The Data Protection Officer (DPO)

  • Physical Location: Head Office, Administration Block, Alphax Academy Campus, Off Iten Road, Eldoret

  • Postal Address: P.O. Box 6516-30100, Eldoret, Kenya

  • Dedicated Compliance Email: dataofficer@alphaxacademy.sc.ke