Privacy Policy

This Privacy Policy explains how The Shule Project ("we", "us", "our") collects, uses, and protects personal data, under Kenya's Data Protection Act, 2019 (Cap. 411C) ("the Act") and the ODPC's Guidance Notes.

1. Who we are

The Shule Project is a Company Limited by Guarantee, operating a Kenyan EdTech non-profit platform across three programmes: 1 Teacher 1 Laptop, 1 Student 1 Laptop, and 1 School 1 Lab. Contact: our FAQ page or via the contact details on our site. ODPC Data Controller/Processor registration number: NEEDS INPUT — registration status not yet confirmed.

2. What we collect, from whom

• Teachers — application data, and loan/repayment records for the 1 Teacher 1 Laptop device programme.
• Schools — institutional data via our vetting and application forms (school identity, enrolment counts, ICT infrastructure, named head teacher and ICT-lead contacts). These forms collect aggregate student counts, not individual student names.
• Donors — contact and payment data for crowdfunding contributions.

3. Children's data — read this section carefully

Our 1 Student 1 Laptop and 1 School 1 Lab programmes put devices directly into the hands of students, including children. We take the following position, plainly:

• Where a device is assigned to a specific, identifiable student (rather than shared institutional equipment), that assignment record is personal data about a child, and Act §33 applies in full: processing requires verifiable consent from the child's parent or guardian, given in a way that protects and advances that child's rights and best interests.
• Deployed devices are managed through a commercial device-management service that can locate a device and, on certain plans, remotely trigger a photo or screenshot capture if a device is reported stolen. Whether this capability is active on devices used by children, and under what parental consent, is currently under internal review — we are not going to claim a safeguard is in place until it verifiably is. If you are a parent, guardian, or school with a question about this, contact us directly using the details in Section 8.
• NEEDS INPUT: confirmation of whether a per-student personal-data record exists in our systems (as distinct from the institutional application data described in Section 2), and if so, its exact fields, retention period, and the consent basis it was collected under.

4. Payments

Teacher device repayments and donor contributions are processed via M-Pesa (Safaricom Daraja), PayPal, or ZamuPay. We do not store full payment card numbers. Loan/repayment status may reveal financial standing — we treat this with the same care as other sensitive data categories under the Act.

5. Your rights

Under the Act, you (or, for a child, your parent or guardian on your behalf) have the right to be informed, to access data held, to rectification, to erasure, and to object to processing. Contact us using Section 8 to exercise any of these.

6. Retention

Specific retention periods for teacher, school, student-device, and donor records: NEEDS INPUT — not yet defined.

7. Where data is processed

Our systems run on Supabase. Hosting region: NEEDS INPUT — not confirmed. Payment providers and our device-management service may process data outside Kenya — a formal Act §48/§49 transfer assessment has not yet been completed.

8. Contact and complaints

For any question about this policy, or to exercise a data right on behalf of yourself or a child in your care, use the contact details on our FAQ page. You can also lodge a complaint with the Office of the Data Protection Commissioner: complaint@odpc.go.ke or via www.odpc.go.ke.

See also our Terms of Service.