How Smartious Homeschool collects, uses, and protects your personal data.
Smartious E-School Ltd ("Smartious", "we", "us", "our") is a private limited company registered in Kenya, with its principal place of business at Diamond Plaza I, Parklands, Nairobi. We operate the website smartioushomeschool.com and deliver homeschool, online and private tuition services to students worldwide. For the purposes of Kenya's Data Protection Act, 2019 and the EU General Data Protection Regulation (GDPR), Smartious is the Data Controller of the personal data you share with us.
We collect only the data we genuinely need to deliver education and communicate with families. This includes: (a) contact and identification data: student and parent names, email addresses, WhatsApp numbers, student date of birth, country of residence; (b) academic data: curriculum selection, current school, grade level, placement assessment answers and scores, progress reports; (c) payment data: we do not store full card numbers; Paystack processes all payments and we receive only the transaction reference and amount; (d) technical data: IP address, browser type, device type, pages visited, collected via cookies and analytics; (e) communication records: messages you send us by email, WhatsApp, contact form, or during consultation calls.
We use personal data only for: (i) delivering the programme you have enrolled in, matching tutors, scheduling lessons, issuing progress reports, sitting exams; (ii) communicating with you about your account, lessons, payments, and service updates; (iii) processing payments via Paystack; (iv) improving our website and teaching methods through anonymised analytics; (v) complying with Kenyan tax, education, and regulatory obligations. We do not sell personal data to third parties. Ever.
Under Article 6 of the GDPR and Section 30 of the Kenya Data Protection Act, we process your data on one of the following lawful bases: (a) Contract: to deliver the services you have enrolled in; (b) Consent: for marketing communications, which you can withdraw at any time; (c) Legitimate interests: for securing our systems, preventing fraud, and improving our services; (d) Legal obligation: for tax records, accounting, and regulatory compliance.
We share data only with parties essential to service delivery: (i) our assigned tutors and assessment teachers, who see only the data needed to teach your child; (ii) Paystack (Paystack Payments Limited, Lagos & Nairobi) for payment processing; (iii) Google (Firebase, Gmail, Drive) for our backend infrastructure, subject to Google's Cloud Data Processing Addendum; (iv) FormSubmit.co for form delivery; (v) MongoDB Atlas for database hosting; (vi) Netlify and Render for website and API hosting. All processors are bound by data processing agreements. We require them to meet or exceed our own data protection standards.
Some of our processors (Google, MongoDB Atlas, Netlify, Render) store data in the US or EU. Where data is transferred outside Kenya or the European Economic Area, we rely on appropriate safeguards , Standard Contractual Clauses approved by the European Commission, or equivalent mechanisms under the Kenya DPA , to ensure your data receives equivalent protection.
We keep data only as long as needed: (a) active student records: for the duration of enrolment plus 7 years after the last lesson, to comply with Kenyan tax law and academic record-keeping standards; (b) enquiry and consultation records: 24 months from last contact; (c) marketing subscribers: until you unsubscribe; (d) website analytics: 26 months (Google Analytics default). After these periods, data is securely deleted or anonymised.
Both the Kenya Data Protection Act and the GDPR give you the following rights: (i) Access: request a copy of all personal data we hold about you; (ii) Rectification: correct inaccurate data; (iii) Erasure: request deletion of your data, subject to our legal retention obligations; (iv) Restriction: limit how we process your data; (v) Portability: receive your data in a machine-readable format; (vi) Objection: object to specific types of processing, especially marketing; (vii) Withdraw consent at any time. To exercise any right, email hello@smartioushomeschool.com. We respond within 30 days as required by law.
Because many of our students are under 18, parental consent is required before any child is enrolled or assessed. The parent is the primary account holder and the primary contact. We do not knowingly collect personal data directly from children under 13 without parental involvement. If you believe we have done so inadvertently, contact us and we will delete the data immediately.
We use industry-standard safeguards: HTTPS (TLS 1.3) across the entire site, password hashing (bcrypt) for all accounts, role-based access control in our backend, encrypted database backups, and quarterly security reviews. Paystack handles payment data to PCI-DSS Level 1 standards , we never see or store full card details. No system is perfectly secure, but we work continuously to reduce risk.
In the unlikely event of a personal data breach affecting your rights, we will notify the Office of the Data Protection Commissioner (Kenya) within 72 hours as required by Section 43 of the Kenya DPA, and the affected individuals without undue delay, describing what happened, what data was affected, and the steps we are taking.
We may update this policy to reflect changes in law, our services, or our processors. When we make material changes we will notify active students and parents by email and update the "Effective" date at the top of this page. The most current version is always the one published here.
For any privacy question, data subject request, or complaint, email our Data Protection point of contact: hello@smartioushomeschool.com, phone +254 745 021 212, or write to Smartious E-School Ltd, Diamond Plaza I, Parklands, Nairobi, Kenya. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya (odpc.go.ke) or, if you are in the EU, with your national data protection authority.