Data protection
Last updated: 8 August 2026
This page explains what school, staff, learner and parent data Eeskia collects, why, how it's protected, who can see it, and how you can exercise your rights. It applies to every school using Eeskia and every account on the platform.
1What data we collect
Eeskia holds different data depending on who the account belongs to:
- Learners: name, admission number, date of birth, guardian contacts, class and stream, attendance records, CBC competency levels and grades, fee balances.
- Staff: name, role, contact details, assigned classes and subjects, login activity.
- Parents and guardians: name, phone number, email, and the identity of the learners they are linked to.
- School administrators: the school's registration details, term structure, fee schedule, and billing contact.
We do not collect data we don't need to run the system — there's no tracking of location, no advertising identifiers, and no data sold to third parties.
2Why we collect it
Every piece of data serves a specific function inside the system:
- Running attendance, grading, timetabling and fee tracking for the school
- Generating CBC report cards and school-wide analytics
- Giving parents visibility into their own children's records
- Keeping an audit trail of who changed what, for accountability
- Contacting a school about their account, billing, or a demo request
3Who can see it
Access is role-based. Nobody sees more than their role requires:
| Role | Can see |
|---|---|
| Parent | Their own children's grades, attendance and fee balance only |
| Class teacher | Students in their own classes |
| Bursar | Fee records school-wide, not grades or attendance |
| Administrator | Full school records, plus the audit log |
| Eeskia support staff | Only what's needed to resolve a support request, and only with the school's permission |
Every access, edit and export is logged. Schools can review this audit trail from their admin dashboard at any time.
4Storage and security
- Data is encrypted in transit (HTTPS/TLS) and at rest
- Automatic daily backups, stored separately from live data
- Access to production systems is restricted to a small engineering team, and logged
- Passwords are hashed and never stored in plain text
No system is unbreakable, and we don't claim otherwise — but these controls are designed so that a lost device, a forgotten password, or a single compromised account doesn't put the whole school's records at risk.
5How long we keep it
We keep learner and staff records for as long as a school's account is active, plus a limited period afterward to allow for transfers, disputes, and legal record-keeping requirements.
- During lockouts: If your school is locked out due to trial expiration or non-payment, your data remains safely stored on our servers. However, you cannot access or export it until the account is brought back into good standing.
- Account closure: A school can request deletion of specific records, or full account closure, at any time — see your rights below. Following a prolonged period of inactivity or non-payment, we may permanently delete data in line with our retention schedules after providing advance notice.
6Sharing with third parties
We do not sell data, and we do not share it for advertising. Data is only shared with:
- Infrastructure providers who host and back up the system, under contractual confidentiality obligations
- Authorities, where required by Kenyan law
- A new system provider, if a school switches and formally requests a data export on the parent school's behalf
7Your rights
Under Kenya's Data Protection Act, 2019, you can ask us to:
- Confirm what personal data we hold about you or your child
- Correct inaccurate or incomplete records
- Delete data that's no longer needed, subject to a school's legal record-keeping duties
- Export a copy of the data in a portable format
- Object to processing you believe is unlawful
Requests about a specific learner's data should generally go through the school first, since the school is the data controller and Eeskia is the processor acting on its instructions. If your school is unresponsive, you can contact us directly and we'll help route the request.
8If something goes wrong
If we become aware of a data breach that risks harm to any school, staff member, learner or parent, we will notify the affected school without undue delay, and support them in meeting their own notification obligations to the Office of the Data Protection Commissioner and to affected individuals, as required by law.
9Children's data
Most learner records on Eeskia belong to minors. Schools act as the data controller for this information and are responsible for the lawful basis on which it's collected — typically their existing enrolment and safeguarding obligations. Eeskia processes this data only on the school's instructions, and applies the same encryption, access controls and audit logging described above.
Questions about your data
Reach out and we'll respond within a few business days, or sooner for anything urgent.