Privacy Policy for CAMBRIDGE MEVIC SCHOOLS

Last Updated: July 9, 2025

CAMBRIDGE MEVIC SCHOOLS (“we,” “us,” or “the School”) is committed to protecting the privacy and personal data of our students, parents, staff, and website visitors in compliance with the Data Protection Act, 2019, Article 31 of the Constitution of Kenya, 2010, and other applicable laws. This Privacy Policy explains how we collect, use, store, and protect personal data through our website (www.cambridge.sc.ke) and related services, including student portals and online learning platforms.

1. Definitions

  • Personal Data: Information relating to an identified or identifiable individual, such as names, contact details, or student IDs.

  • Sensitive Personal Data: Data requiring special protection, such as health or biometric information.

  • Data Subject: Individuals whose data we process, including students, parents, staff, and website visitors.

  • Data Controller: CAMBRIDGE MEVIC SCHOOLS, which determines the purpose and means of processing personal data.

  • Data Processor: Third parties processing data on our behalf, such as cloud service providers.

  • Data Processing: Activities like collecting, storing, or sharing personal data.

2. Scope and Applicability

This Privacy Policy applies to all personal data collected via our website, student portals, and related services from students, parents, staff, and visitors, whether processed within or outside Kenya, in accordance with Kenyan laws.

3. Types of Personal Data Collected

We may collect the following categories of personal data:

  • Students: Name, date of birth, student ID, academic records, attendance, health data (e.g., medical conditions), biometric data (if applicable).

  • Parents/Guardians: Name, phone number, email address, physical address.

  • Staff: Name, employment records, contact details, identification numbers.

  • Website Visitors: IP address, browser type, device information, access times.

  • Sensitive Personal Data: Health records, religious beliefs (if relevant to school activities, e.g., dietary needs).

4. Purpose of Data Collection

We collect and process personal data for the following purposes:

  • Providing educational services, including enrollment, grading, and attendance tracking.

  • Communicating with parents and students (e.g., newsletters, report cards, event updates).

  • Operating and improving our website (e.g., analytics to enhance user experience).

  • Complying with legal obligations, such as reporting to the Ministry of Education.

5. Legal Basis for Processing

We process personal data based on:

  • Consent: Freely given, specific, and informed consent from data subjects or parents (for minors).

  • Contract: To fulfill enrollment or employment agreements.

  • Legal Obligation: To meet requirements under Kenyan laws (e.g., education regulations).

  • Legitimate Interests: To improve educational services or ensure website functionality.

6. How Data is Collected

We collect personal data through:

  • Online forms (e.g., enrollment, contact, or inquiry forms on our website).

  • Automatic collection (e.g., cookies, IP addresses, browser data).

  • Third-party platforms (e.g., online learning systems, payment gateways).

7. Consent and Withdrawal

We obtain consent through clear opt-in mechanisms (e.g., checkboxes on forms). For students under 13, we require parental consent. You may withdraw consent at any time by contacting our Data Protection Officer at vkofi @cambridge.sc.ke. Withdrawal of consent does not affect the lawfulness of prior processing.

8. Data Subject Rights

Under the Data Protection Act, 2019, you have the following rights:

  • Right to be Informed: Know how your data is collected and used.

  • Right to Access: Request a copy of your personal data.

  • Right to Rectification: Correct inaccurate or incomplete data.

  • Right to Erasure: Request deletion of data when no longer needed.

  • Right to Restrict Processing: Limit how your data is used in certain cases.

  • Right to Object: Object to processing based on legitimate interests.

  • Right to Data Portability: Receive your data in a structured, portable format.

  • Right to Complain: Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

To exercise these rights, contact our Data Protection Officer at vkofi @cambridge.sc.ke.

9. Data Storage and Retention

We store personal data only for as long as necessary to fulfill the purposes outlined or as required by law. For example:

  • Student records are retained for [5 years] after graduation, per Ministry of Education guidelines.

  • Website analytics data is retained for [12 months].

Data no longer needed is securely deleted using industry-standard methods.

10. Data Security Measures

We implement robust measures to protect your data, including:

  • Encryption and secure servers to safeguard data transmission and storage.

  • Access controls to limit data access to authorized staff only.

  • Regular security audits and staff training on data protection.

  • Procedures to detect, report, and respond to data breaches.

While we strive to protect your data, no system is 100% secure. We use commercially acceptable standards to minimize risks.

11. Data Sharing and Third Parties

We may share personal data with:

  • Third-party service providers (e.g., cloud storage, payment processors) bound by data protection contracts.

  • Government agencies, such as the Ministry of Education, as required by law.

We do not share personal data publicly or with unauthorized parties without your consent.

12. International Data Transfers

If personal data is transferred outside Kenya (e.g., to cloud servers), we ensure:

  • The recipient country has adequate data protection laws.

  • Explicit consent is obtained from data subjects.

  • Contracts with standard data protection clauses are in place.

13. Cookies and Tracking Technologies

Our website uses cookies to enhance functionality and analyze usage. These include:

  • Session Cookies: Temporary cookies for website navigation.

  • Analytics Cookies: To track site performance and user behavior.

You can manage cookie preferences via your browser settings or our website’s cookie consent tool. See our Cookie Notice for details.

14. Children’s Privacy

We prioritize protecting the privacy of students, especially those under 13. We do not collect data from minors without parental consent. Our website and services are designed to comply with child protection laws and education sector guidelines.

15. Third-Party Links

Our website may contain links to external sites (e.g., online learning platforms). We are not responsible for their privacy practices. Please review the privacy policies of those sites.

16. Data Breach Notification

In the event of a data breach, we will:

  • Notify affected data subjects and the ODPC within 72 hours, as required by the DPA.

  • Provide details on the breach’s impact and mitigation steps.

17. Updates to This Privacy Policy

We may update this Privacy Policy to reflect changes in law or our practices. Updates will be posted on our website with a revised “Last Updated” date. We may also notify you via email or a website notice.

18. Education Sector Compliance

As an educational institution, we adhere to the ODPC’s Guidance Note for the Education Sector, ensuring:

  • Transparency in processing student data (e.g., grades, attendance).

  • No public sharing of sensitive data, such as academic or health records.

  • Clear policies for online learning, including prohibiting unauthorized recording or sharing of classes.

19. Social Media and Online Learning

We prohibit unauthorized sharing of images, videos, or chats from online learning platforms or social media involving students or staff. All online activities comply with data protection principles (transparency, proportionality, legitimate purpose).

20. Accountability

CAMBRIDGE MEVIC SCHOOLS has appointed a Data Protection Officer to oversee compliance with data protection laws. We conduct regular audits and staff training to ensure adherence.

21. Legal Compliance

We comply with the Data Protection Act, 2019, Article 31 of the Constitution of Kenya, and other relevant laws, including the Consumer Protection Act, 2012 and Kenya Information and Communications Act, 1998.

22. Contact Information

For questions, concerns, or to exercise your data subject rights, contact our Data Protection Officer:

  • Email: study @cambridge.sc.ke

  • Phone: +254 20 800 8818

  • Address: CAMBRIDGE MEVIC SCHOOLS, Nairobi, Kenya