Kenyan CBC Compliance & Data Protection

Privacy Policy

Effective Date: August 30, 2026

Elimu CBC Management & Compliance Software ("ECMS", "we", "us", or "our") is dedicated to safeguarding the privacy and personal data of school administrators, teachers, parents, and learners across Kenyan educational institutions in accordance with the Kenya Data Protection Act (2019) and Ministry of Education guidelines.

1. Information We Collect

• Institutional Information: School Name, Registration Code, County/Sub-County, Principal/Headteacher contact details, and Academic Calendar configurations.
• Learner Records: Learner Full Name, Admission/NEMIS/Assessment Number, Grade/Grade Stream, Gender, Assessment Performance Marks, and Strand Evaluations.
• Staff & Parent Contacts: Names, phone numbers, and official email addresses used for authentication, timetable assignment, and student report card distribution.

2. How We Use and Protect Personal Data

• CBC Assessment Processing: Calculating formative and summative competency evaluation metrics, generating CBC-standard report cards, and scheduling master timetables.
• PII Encryption at Rest: Sensitive Personally Identifiable Information (PII) including guardian contacts and phone numbers are encrypted locally and in transit.
• Role-Based Multi-Tenancy: Strict Firestore security rules isolate school data ensuring that only authorized school staff and assigned parents have access to their relevant records.

3. Cloud Synchronization & Offline Storage

The application employs an offline SQLite database architecture that reconciles with the Cloud over encrypted TLS connections. Local data cache is isolated to the application's secure sandbox environment.

4. Your Rights & Data Retention

School administrators may request data exports, updates, or record de-registration in compliance with Kenyan statutory education retention requirements. For privacy inquiries or data requests, contact your institution's data controller or email us at rebirthgroupp@gmail.com.

5. Account & Data Deletion Requests

In accordance with Google Play's user data protection standards, users can request account and data deletion via our dedicated online portal: Submit Account & Data Deletion Request. All requests are managed via a 30-day pending retention grace period before permanent erasure.