🔒 Privacy & Data Protection

Privacy Policy & Data Protection

Learn how Kakamega High School collects, uses, protects, and shares personal data in compliance with the Kenya Data Protection Act 2019 and international privacy standards.

Last updated: October 26, 2026
Data Collection Data Usage Data Sharing Security Children's Privacy Cookies Your Rights Contact DPO
Kenya Data Protection Act 2019
ODPC Registered
Student Data Protected
Parental Consent Required

Your Privacy Matters to Us

At Kakamega High School, we are committed to protecting the privacy and security of personal data belonging to our students, parents, staff, and website visitors. This policy explains how we handle your information in accordance with the Kenya Data Protection Act 2019 and international best practices.

Section 01

Information We Collect

We collect various types of personal data to fulfill our educational mission and comply with legal requirements. The data we collect includes:

Data Type Examples Purpose
Student Information Full name, date of birth, gender, national ID/passport number, admission number Enrollment, academic records, KNEC registration
Contact Details Address, phone numbers, email addresses Communication, emergency contact
Parent/Guardian Data Names, contact info, occupation, relationship to student Parent communication, fee management
Academic Records Grades, examination results, transcripts, reports Academic tracking, certification
Health Information Medical conditions, allergies, immunization records Student welfare, emergency care
Photographs & Media Student photos, videos, event coverage School records, website, publications
Financial Data Fee payment records, bank details, receipts Fee management, accounting
Website Usage Data IP address, browser type, pages visited, cookies Website analytics, security
Legal Basis: We collect data based on consent, contractual necessity, legal obligations, and legitimate interests in providing education services.
Section 02

How We Use Your Data

We use the collected personal data for the following specific purposes:

  • Educational Administration: Managing student enrollment, academic records, and certification
  • Communication: Sending updates, notices, reports, and emergency alerts to parents and students
  • Student Welfare: Providing healthcare, counseling, and support services
  • Safety & Security: Maintaining campus security, emergency response, and incident reporting
  • Legal Compliance: Meeting requirements from Ministry of Education, KNEC, and other regulatory bodies
  • Financial Management: Processing fee payments, issuing receipts, and financial reporting
  • School Publications: Creating yearbooks, newsletters, and website content (with consent)
  • Alumni Relations: Maintaining contact with former students for networking and events
We do not use personal data for purposes incompatible with the original collection purposes unless required by law or with explicit consent.
Section 04

Data Security Measures

We implement comprehensive technical and organizational measures to protect personal data:

  • Encryption: All sensitive data is encrypted during transmission and storage
  • Access Controls: Role-based access with multi-factor authentication for staff
  • Physical Security: Secure filing cabinets, locked offices, and restricted access areas
  • Staff Training: Regular data protection training and confidentiality agreements
  • Security Audits: Regular assessments and penetration testing of IT systems
  • Backup Systems: Secure, encrypted backups with disaster recovery protocols
  • Incident Response: Clear procedures for data breach notification and response
In the event of a data breach, we will notify affected individuals and the Office of the Data Protection Commissioner (ODPC) within 72 hours as required by law.

Special Protection for Student Data

As an educational institution serving minors, we apply enhanced protection measures for student data. All processing of student personal data requires parental consent where required by law. We maintain strict confidentiality and limit access to authorized staff only. Student data is never used for commercial purposes or shared without proper authorization.

Section 05

Children's Privacy & Parental Rights

As a secondary school serving students aged 13-19, we recognize the special protections required for minors' data:

  • Parental Consent: We obtain written consent from parents/guardians before collecting and processing student data
  • Photography Consent: Parents can opt-out of having their child's photo used in publications or website
  • Data Access: Parents have the right to access, review, and request corrections to their child's data
  • Age-Appropriate Processing: Data processing is limited to what is necessary for educational purposes
  • Minimal Data Collection: We collect only data essential for education and student welfare
Parents can withdraw consent at any time by contacting the school administration. However, withdrawal of consent may affect the school's ability to provide certain services or comply with legal obligations.
Section 06

Cookies & Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance user experience:

  • Essential Cookies: Required for website functionality (session management, security)
  • Analytics Cookies: Help us understand how visitors use our website (Google Analytics)
  • Preference Cookies: Remember user preferences and settings

You can control cookies through your browser settings. However, disabling certain cookies may affect website functionality.

We do not use cookies for targeted advertising or sell cookie data to third parties. Analytics data is used solely to improve our website.
Section 07

Your Data Protection Rights

Under the Kenya Data Protection Act 2019, you have the following rights regarding your personal data:

Right to Access

Request a copy of your personal data held by the school

Right to Rectification

Request correction of inaccurate or incomplete data

Right to Erasure

Request deletion of your data (subject to legal obligations)

Right to Restrict

Request limitation of data processing in certain circumstances

Right to Portability

Receive your data in a structured, machine-readable format

Right to Object

Object to processing of your data for specific purposes

Right to Withdraw Consent

Withdraw consent at any time (for consent-based processing)

Right to Lodge Complaint

File a complaint with the Data Protection Commissioner

To exercise any of these rights, please contact our Data Protection Officer at [email protected] or visit the school administration office. We will respond within 30 days.
Section 08

Data Retention Period

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

  • Student Academic Records: Retained permanently for certification and alumni records
  • Contact Information: Retained during enrollment plus 5 years after graduation
  • Financial Records: Retained for 7 years as required by tax laws
  • Health Records: Retained during enrollment plus 3 years after departure
  • Website Analytics: Retained for 26 months
  • Photographs: Retained indefinitely unless parent requests removal
After the retention period expires, data is securely deleted or anonymized. Legal obligations may require longer retention for certain records.
Section 09

Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in law, our practices, or operational needs. When we make material changes:

  • We will update the "Last updated" date at the top of this page
  • Significant changes will be communicated via email to parents and staff
  • Updated policy will be posted on our website with clear notification
  • Continued use of our services after changes constitutes acceptance
We encourage you to review this privacy policy periodically to stay informed about how we protect your data.

Data Protection Officer (DPO)

For any questions, concerns, or requests regarding your personal data or this privacy policy, please contact our Data Protection Officer:

Email DPO
[email protected]
General Email
[email protected]
Phone
+254 56 51721

Frequently Asked Questions

Common questions about our privacy policy and data protection practices

Kakamega High School collects personal data including student names, dates of birth, contact information, academic records, health information, parent/guardian details, photographs, and identification numbers. This data is collected for educational administration, communication, safety, and legal compliance purposes.

We implement comprehensive security measures including encrypted databases, access controls, staff training on data protection, secure physical storage, regular security audits, and compliance with Kenya Data Protection Act 2019. All staff members sign confidentiality agreements regarding student data.

Yes, parents and legal guardians have the right to access, review, and request corrections to their child's personal data held by the school. Requests can be made in writing to the school administration or data protection officer at [email protected]. We will respond within 30 days.

Student data is shared only with authorized parties including the Kenya National Examinations Council (KNEC), Ministry of Education, health providers for student welfare, and insurance companies as required. We do not sell or share student data for commercial purposes. All data sharing complies with Kenya Data Protection Act 2019.

Student academic records are retained permanently for certification and alumni purposes. Contact information is kept during enrollment plus 5 years after graduation. Financial records are retained for 7 years as required by tax laws. Health records are kept during enrollment plus 3 years. After retention periods expire, data is securely deleted or anonymized.

Yes, parents can request removal of their child's photos from the website at any time. Please contact our communications office at [email protected] with your child's name and class. We respect family privacy and will accommodate reasonable requests promptly.

In the event of a data breach, we have clear incident response procedures. We will notify affected individuals and the Office of the Data Protection Commissioner (ODPC) within 72 hours as required by law. We will also take immediate steps to contain the breach, investigate the cause, and implement measures to prevent future incidents.

Yes, Kakamega High School is fully compliant with the Kenya Data Protection Act 2019. We are registered with the Office of the Data Protection Commissioner (ODPC), have appointed a Data Protection Officer, maintain comprehensive data protection policies, and regularly train staff on data handling best practices. We conduct regular audits to ensure ongoing compliance.