Introduction
Elyton International School (“the School”, “we”, “us” or “our”) is committed to protecting the privacy and personal data of our pupils, parents and guardians, staff, job applicants, alumni, and visitors to our website. This Data Privacy Notice explains what personal data we collect, why we collect it, how we use and protect it, and the rights available to you under the Data Protection Act, 2019 of Kenya (the “DPA”) and its subsidiary regulations.
This Notice applies to personal data collected through our website, admissions process, school operations, and any other interaction you have with the School, whether online or offline.
Who we are — the data controller
The data controller responsible for your personal data is Elyton International School.
Data Protection Officer / privacy contact
Andrew Nandi; email privacy@elytonschools.org, telephone +254 727 856 146.
Personal data we collect
We collect and process the following categories of personal data:
| Category | Examples |
|---|---|
| Pupil data | Full name, date of birth, nationality, admission and enrolment records, academic performance and reports, examination results, attendance records, disciplinary and behavioural records, special educational needs and learning support information, co-curricular and extracurricular participation, photographs and videos. |
| Health and medical data (special category) | Immunisation records, allergies, medical conditions, medication, dietary requirements, and information provided in medical emergencies. |
| Parent / guardian data | Full name, national ID/passport number, contact details, home and work address, relationship to pupil, emergency contact details, employment and billing information, payment and banking details. |
| Website and online data | IP address, browser and device type, pages visited, cookies and similar tracking technologies, and information you submit through online forms (e.g. admissions enquiries, newsletter sign-ups). |
| Job applicant and staff data | Curriculum vitae, references, qualifications, identification documents, and other information submitted as part of recruitment or employment. |
| CCTV and security data | Images captured by closed-circuit television cameras operating on School premises for safety and security purposes. |
Health, biometric, and similar sensitive data are treated as “sensitive personal data” under the DPA and are processed only with explicit consent, or where necessary to protect the vital interests of the pupil (for example, in a medical emergency), and subject to additional safeguards.
How we collect personal data
- Directly from parents/guardians and pupils, through admission forms, enrolment documents, medical forms, and correspondence.
- Through our website, when you complete an enquiry, admissions, or contact form, or subscribe to communications.
- Automatically, through cookies and similar technologies when you browse our website (see Section 12).
- From previous schools, examination bodies, or referees, with appropriate consent, as part of the admissions process.
- Through CCTV cameras operating on School premises.
- From job applicants and staff, in the course of recruitment and employment.
Purposes and legal basis for processing
We process personal data for the following purposes, relying on the lawful bases indicated:
| Purpose | Legal basis |
|---|---|
| Admissions and enrolment | Contract / consent |
| Delivery of education, pastoral care and co-curricular activities | Contract / legitimate interest |
| Health, safety and medical emergencies | Vital interests / consent |
| Fee billing and payment processing | Contract / legal obligation |
| Communications with parents/guardians | Contract / legitimate interest |
| Compliance with the Ministry of Education, examination bodies (e.g. KNEC, Cambridge, IB) and other regulators | Legal obligation |
| School safety and security (including CCTV) | Legitimate interest |
| Marketing the School (e.g. website, prospectus, social media, photographs) | Consent |
| Website analytics and improvement | Consent (cookies) / legitimate interest |
| Recruitment and management of staff | Contract / legal obligation |
Children’s data and parental consent
Most of the personal data we hold relates to pupils who are children under the DPA. Where our processing of a child’s personal data requires consent (for example, the use of a pupil’s photograph in marketing materials), we obtain that consent from the pupil’s parent(s) or legal guardian(s).
Rights conferred on a pupil as a data subject under the DPA (see Section 14) may be exercised on the pupil’s behalf by a person with parental authority or a guardian, in accordance with section 27 of the DPA.
We collect only the personal data about pupils that is necessary and proportionate for their education, safety, and wellbeing, and we take particular care with sensitive categories such as health and special educational needs data.
Photographs, videos and marketing
From time to time, we take photographs and videos of pupils for use in the School’s prospectus, website, newsletters, yearbooks, and official social media channels, and to celebrate school events and pupil achievements.
We will seek explicit, separate consent from parents/guardians before using a pupil’s image or name in any external marketing or publicity material. Consent may be withdrawn at any time by contacting us using the details in Section 15; withdrawal will not affect material already published before the withdrawal was received, but we will take reasonable steps to remove the image from future publications and, where practicable, from our website.
Sharing your personal data
We may share personal data, on a need-to-know basis and subject to appropriate safeguards, with:
- The Ministry of Education, Teachers Service Commission, Kenya National Examinations Council (KNEC), and other examination or curriculum bodies (e.g. Cambridge Assessment International Education, the International Baccalaureate), as required by law or for the pupil’s academic record.
- Service providers who support our operations, such as school management/information systems, payment processors and banks, cloud email and productivity platforms, SMS/communication providers, transport providers, and CCTV/security monitoring companies, under contracts that require them to protect personal data.
- Medical practitioners, hospitals, and insurers, where necessary for a pupil’s health, safety, or medical treatment.
- Professional advisers, including auditors, lawyers, and consultants, on a confidential basis.
- Government authorities and regulators, including the Office of the Data Protection Commissioner, where required by law or to comply with a legal obligation, court order, or lawful request.
We do not sell personal data to third parties.
International data transfers
Some of our service providers (for example, cloud-based school management, email, or payment systems) may store or process personal data outside Kenya. Where this occurs, we will only transfer personal data to a country with adequate data protection safeguards, or where appropriate contractual or other legal safeguards are in place, in accordance with section 48 of the DPA and the Data Protection (General) Regulations, 2021.
Data retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Retention periods include: academic records, for the duration of enrolment plus 6 years; financial records, 8 years; and CCTV footage, 30 days, unless required for an investigation.
Data security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or disclosure, including access controls, staff confidentiality obligations, and secure storage of physical and electronic records. In the event of a personal data breach likely to result in a risk to data subjects, we will notify the Office of the Data Protection Commissioner and affected individuals in accordance with the DPA and the Data Protection (General) Regulations, 2021.
Cookies and website analytics
Our website may use cookies and similar technologies to remember your preferences, understand how visitors use the site, and improve its functionality. You can control or disable cookies through your browser settings; please note that some features of our website may not function properly if cookies are disabled.
CCTV and campus security
CCTV cameras operate in designated areas of the School premises for the safety and security of pupils, staff, and visitors. Footage is stored securely, accessed only by authorised personnel, and retained for a limited period unless required for an investigation, disciplinary matter, or legal process.
Your rights under the Data Protection Act, 2019
Subject to certain exceptions, you (or, for a pupil, your parent/guardian) have the right to:
- be informed of the use to which your personal data will be put;
- access and obtain a copy of your personal data held by us;
- object to the processing of all or part of your personal data;
- request correction of false, inaccurate, or misleading data;
- request deletion of false or misleading data about you;
- restrict processing of your personal data in certain circumstances;
- request that your personal data be transferred to you or another controller in a structured, commonly used format (data portability); and
- object to the processing of your personal data for direct marketing purposes at any time.
Where the data subject is a minor, these rights may be exercised by a person with parental authority or a guardian.
How to exercise your rights
Contact our Data Protection Officer
To exercise any of the above rights, or if you have any questions about this Notice or how we handle your personal data, please contact our Data Protection Officer / privacy contact at privacy@elytonschools.org or +254 727 856 146. We will respond to requests within the timeframes prescribed by the Data Protection (General) Regulations, 2021 (currently seven days for confirmation of holding data, extendable in certain circumstances).
Changes to this notice
We may update this Data Privacy Notice from time to time to reflect changes in our practices or legal requirements. We will publish the updated Notice on our website with a revised “Last updated” date. We encourage you to review this Notice periodically.