Your rights under the EU General Data Protection Regulation and Kenya's Data Protection Act, 2019.
The EU General Data Protection Regulation (GDPR) is the world's strictest privacy law. It applies to Smartious whenever we process personal data of people in the European Union , for example, a family who moves to Germany while their child is enrolled with us, or a parent in France enquiring about IUFP. Kenya's own Data Protection Act, 2019 is closely modelled on the GDPR, so the rights described here apply to all our students regardless of country.
As a data subject, you have eight specific rights: (i) the right to be informed: which is what this page is for; (ii) the right of access: you can request a copy of everything we hold about you; (iii) the right to rectification: correct inaccurate data; (iv) the right to erasure ("right to be forgotten") , ask us to delete your data, subject to legal retention obligations like tax records; (v) the right to restrict processing: pause our use of your data while a dispute is resolved; (vi) the right to data portability: receive your data in a machine-readable format to transfer to another provider; (vii) the right to object: to direct marketing or to processing based on legitimate interests; (viii) rights related to automated decision-making, we do not make any decision about your child based solely on automated processing, so this right does not currently come into play.
We process personal data on one of four lawful bases under Article 6 GDPR: (a) Contract: processing necessary to deliver the educational services you have enrolled in; (b) Consent: for optional marketing emails and analytics cookies, which you can withdraw at any time; (c) Legitimate interests: for preventing fraud, securing our systems, and improving our services, where our interests do not override your rights; (d) Legal obligation: for tax and regulatory record-keeping.
Because Smartious is not a large-scale processor of special-category data, we are not legally required to appoint a formal Data Protection Officer. We have instead designated a Data Protection Point of Contact: Alfred Ouko (Founder), reachable at hello@smartioushomeschool.com or +254 745 021 212. All data subject requests are handled by this contact.
We are based in Kenya. Data you share with us crosses the EU and Kenya border. Kenya does not yet have a formal adequacy decision from the European Commission. We rely on the European Commission's Standard Contractual Clauses (SCCs) as the lawful safeguard for transfers. Our third-party processors (Google, MongoDB, Netlify, Render, Paystack) are all bound by SCCs or equivalent frameworks and meet or exceed EU data protection standards.
We collect the minimum data necessary for each purpose. For example, we ask for a student's date of birth to assign the correct academic level, but we do not ask for national ID numbers or passport details unless required for university applications. We routinely delete data we no longer need.
Under Article 33 GDPR, we will notify the competent supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. Under Article 34, we will notify affected individuals without undue delay if the breach is likely to result in a high risk. We will describe what happened, what data was affected, the likely consequences, and the steps we are taking.
To exercise any GDPR right , access, rectification, erasure, restriction, portability, objection , email hello@smartioushomeschool.com. Include: (a) the right you wish to exercise; (b) enough information for us to verify your identity (email associated with your Smartious account, plus one recent transaction reference if applicable); (c) any specific details about the request. We respond within 30 days. This service is free unless requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act.
If you believe we have not handled your personal data properly, we want to hear first and put it right. Email hello@smartioushomeschool.com. If you remain dissatisfied, you have the right to lodge a complaint with: (i) the Office of the Data Protection Commissioner of Kenya at odpc.go.ke; (ii) the data protection authority of your EU country of residence , a list is maintained at edpb.europa.eu/about-edpb/board/members.
This page was last reviewed on 20 April 2026. We review our GDPR compliance at least once every 12 months and whenever we materially change how we process data.