Privacy Policy

ALPHAX ACADEMY DATA PRIVACY POLICY

Last Updated:

May 2026

Data Controller:

Alphax Academy, Eldoret, Kenya

Registration Status:

Registered with the Office of the Data Protection Commissioner (ODPC), Republic of Kenya.

1. Introduction

Alphax Academy values your privacy and is committed to protecting the personal data of our students, parents, guardians, alumni, staff, and website visitors. This Privacy Policy outlines how we collect, use, store, and disclose personal data in strict compliance with Article 31 of the Constitution of Kenya 2010, the Kenya Data Protection Act, 2019 (DPA), and its associated General, Registration, and Complaints Regulations.

2. Personal Data We Collect

We collect data through our webforms, physical admission portals, and automated tracking cookies.

    2.1 General Information

• • Contact & Identification Data: Names, phone numbers, postal and physical addresses, and email addresses of parents, guardians, and web inquiries.

  • Statutory Data: National ID/Passport numbers and Kenya Revenue Authority (KRA) PINs where required for billing or statutory compliance.

  • Digital Data: IP addresses, browser types, and usage data collected via our GDPR compliance plugin tracking.

2.2 Special Categories of Personal Data & Minors' Data

Pursuant to Sections 52 & 53 of the Kenya DPA, the processing of personal data relating to minors (students under 18 years old) is treated with extreme confidentiality. We collect:

• • Student personal data (names, age, gender, date of birth).

  • Academic records, school attendance logs, and student performance metrics.

  • Limited health and dietary data to ensure student safety on school grounds.

Important Notice on Consent for Minors: Alphax Academy does not knowingly collect or process a child's personal data online without the explicit, affirmative consent of a parent or legal guardian.

3.  Lawful Basis for Processing Data

Under Section 30 of the DPA, we only process your data when a clear legal framework exists:

• • Consent: You or your guardian has given clear, unambiguous consent (e.g., ticking our webform submission agreements or opting into non-essential cookies).

  • Contractual Obligation: Processing is necessary to fulfill our educational service delivery agreement (e.g., student enrollment, school fees management).

  • Legal Obligation: Required to comply with Kenyan laws, including reporting to the Ministry of Education.

  • Legitimate Interest: To maintain school security, monitor website performance, and manage school outreach.

4. How We Share and Disclose Your Data

Alphax Academy does not sell or rent personal data to third-party commercial entities. Data is only shared with verified partners under strict data-sharing agreements, including:

• • National educational regulatory bodies and examination councils.

  • Secure cloud infrastructure providers hosting our student management databases.

  • Emergency medical service providers (strictly in life-threatening scenarios).

4.1 Cross-Border Transfers & Data Localization

In accordance with the ODPC Localization Regulations, all serving copies and core processing architectures of our student and administrative data are securely maintained within servers located in Kenya, or transferred internationally only where the destination country guarantees adequate data protection infrastructure.

5. Data Security and Retention

We implement robust technical and organizational security protocols - including SSL encryption, secure user access permissions, and database firewalls - to mitigate risks of unauthorized access, modification, or data breach.

5.1 Data Retention Periods

• • Website Inquiries: Retained for up to 12 months, then securely purged.

  • Student Academic Records: Retained permanently as part of historical archive obligations, or in line with regional statutory education guidelines.

  • Cookie Logs: Retained locally for up to 180 days.

6. Your Data Subject Rights

As a data subject under Section 26 of the Kenya Data Protection Act, you possess clear, enforceable rights. You can execute the following:

• • Right to Access: Confirm whether we hold your data and obtain a structured copy of it.

  • Right to Rectification: Request immediate correction of inaccurate, outdated, or incomplete data.

  • Right to Erasure ("Right to be Forgotten"): Request the total deletion of data that is no longer justified by a lawful processing basis.

  • Right to Object: Object to processing operations geared toward direct marketing or profiling.

To formally exercise any of these rights, please reach out directly to our designated data authority team below.

7. Contact Details and DPO Information

For all questions regarding this policy, to lodge a data lookup request, or to raise compliance feedback, contact:

The Data Protection Officer Desk

Institution: Alphax Academy

Location: Eldoret, Kenya

Email: dataofficer@alphaxacademy.sc.ke