Privacy Policy

1. Introduction

CBE Analyser protects the privacy, confidentiality and security of personal data belonging to learners, parents and guardians, teachers, school administrators and institutions that use our services.

This Privacy Policy explains how CBE Analyser ("CBE Analyser", "we", "us" or "our") collects, uses, stores, shares, protects, retains and otherwise processes personal data when you access or use our website, our Android application, our Progressive Web App, our school management platform and related services.

CBE Analyser is an education technology and school management platform. Its services include examination and assessment analysis, learner performance reports and report forms, fee management, bulk SMS and school communications, timetable generation, schemes of work, lesson plans, records of work covered, teacher and staff administration, learner administration and related curriculum services.

We process personal data in accordance with the Data Protection Act, 2019 (No. 24 of 2019), the Regulations made under it, and other applicable laws of Kenya.

We process personal data lawfully, fairly and transparently. We collect it for explicit, specified and legitimate purposes, limit it to what is necessary for those purposes, keep it accurate where we are able to, retain it only for as long as it is needed, and protect it against unauthorised access, loss, alteration, disclosure and destruction.

This policy should be read together with our Terms of Service and, where a school has signed one, its agreement with us.

2. Who we are

3. Our role in processing personal data

Depending on the circumstances, CBE Analyser acts as a data processor, a data controller, or both.

3.1 Data controlled by your school

When a school enters, uploads or otherwise provides personal data about its learners, parents, guardians, teachers or employees into CBE Analyser for school administration, the school decides why that data is processed. In those circumstances the school is the data controller and CBE Analyser is the data processor, acting on the school's lawful instructions.

Data in this category includes learner names, admission numbers, class lists, examination marks, assessment and competency records, parent and guardian contact details, fee records, teacher information and school communications.

We do not use data in this category for our own purposes. We do not sell it, and we do not use it for advertising.

3.2 Data we control

CBE Analyser is the data controller when it processes personal data for its own business and operational purposes, including account registration, user authentication, customer support, subscription management, billing and payment administration, platform security, fraud prevention, service improvement, legal compliance and service notifications.

3.3 Data processing agreements

Where a school requires a written data processing agreement, we will enter into one on request. Schools that need one should contact us using the details in section 25.

4. Personal data we collect

What we process depends on which modules your school uses. A school that uses only assessment analysis will have far less data on the platform than one that also runs fees and SMS.

4.1 School and institution information

• School name, school codes and identifiers
• School contact details, county, sub-county and location
• School category and grade grouping
• Classes, streams, grades, subjects and learning areas
• Academic years and terms
• School administrator accounts

4.2 Teacher and staff information

• Name, telephone number and email address
• TSC number or other staff identification, where the school records it
• Subjects taught, classes and streams assigned, and role
• System permissions and login activity
• Information needed to produce professional documents, such as the name and TSC number printed on a scheme of work

4.3 Learner information

• Learner name and admission or school identification number
• Grade, class and stream
• Gender, where the school records it for reporting purposes
• Subjects, subject selections, pathways and combinations
• Assessment scores, examination marks and competency records
• Performance records, academic reports and report forms
• Attendance information, where the school records it

We process only the learner information the school enters. We do not collect learner data from any other source.

4.4 Parent and guardian information

• Name and relationship to the learner
• Telephone number and email address
• Communication preferences

4.5 Fee and payment information

Where the fee management module is used, we process learner fee balances, amounts invoiced and paid, outstanding balances, payment dates, receipt numbers, transaction references, payment status and payment history.

4.6 SMS and communication information

Where the bulk SMS module is used, we process recipient telephone numbers, sender identity, message content, timestamps, delivery reports and delivery status. Message content is retained so that schools can show what was sent and when.

4.7 Professional document information

When teachers generate schemes of work, lesson plans or records of work covered, we process the school name, teacher name and identification, subject, grade, class, term and academic year, together with curriculum information such as strands, sub-strands, learning outcomes, learning experiences, resources and the teacher's own reflections.

4.8 Technical and device information

• Internet Protocol address
• Browser type, device type, operating system and application version
• Login activity, session information, and date and time of access
• Security events, error logs, diagnostic information and system activity logs

4.9 Customer support information

If you contact us for help, we process your name and contact details, your support request or complaint, any correspondence and screenshots you send us, and technical diagnostic information relevant to the problem.

5. Information we do not want

CBE Analyser does not seek sensitive personal data, and the platform is not designed to hold it. Unless a specific service lawfully requires it, do not upload or enter:

• Medical records, health information, genetic data or biometric data
• Information about sexual life, political opinions or religious beliefs, except where a learner's religious education option must be recorded to assign the correct subject
• Sensitive family circumstances unrelated to school administration
• Banking passwords, mobile money PINs or authentication PINs
• National identification numbers or other sensitive identifiers that the service does not need

If sensitive personal data is uploaded to the platform without a lawful basis, the school remains responsible for it. Tell us and we will help remove it.

6. How we collect personal data

• Directly from you when you register for or use CBE Analyser
• From your school and its authorised administrators and teachers
• From information uploaded or entered into the platform, including CSV uploads of marks and learner lists
• Through payment integrations when a payment is made
• Through SMS delivery reports returned by the telecommunications provider
• Through support correspondence
• Automatically through the normal operation of the website and application, as described in section 4.8

Most personal data on the platform reaches us indirectly, from a school rather than from the individual concerned. Section 10 sets out what we expect of schools in that situation.

7. Why we process personal data

We process personal data to:

• Provide the CBE Analyser platform and the modules your school has enabled
• Create and maintain accounts, authenticate users and enforce role-based permissions
• Record learners, classes, grades, streams and subjects
• Process examination and assessment results, analyse performance and generate report forms, merit lists and class and subject analysis
• Record fee structures, payments and balances, generate receipts and produce financial reports
• Deliver authorised school communications, including bulk SMS
• Generate timetables, schemes of work, lesson plans and records of work covered
• Provide customer support and respond to your requests
• Administer subscriptions, process payments and keep accounting records
• Protect accounts, detect and prevent fraud and unauthorised access, and maintain the security of the platform
• Diagnose technical problems, improve reliability and develop new features
• Comply with legal obligations and respond to lawful requests from competent authorities
• Establish, exercise or defend legal claims and enforce our agreements
• Produce aggregated or anonymised statistics that do not identify any individual

We will not process personal data for a purpose incompatible with the one it was collected for unless we have a lawful basis to do so.

8. Lawful basis for processing

We rely on one or more of the lawful bases recognised by the Data Protection Act, 2019:

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before the withdrawal, and it may mean we can no longer provide part of the service.

9. Children's and learners' personal data

Most learners whose data is processed through CBE Analyser are children. Children's personal data requires particular protection, and section 33 of the Data Protection Act, 2019 sets specific conditions for processing it.

We process children's personal data only on the instructions of the school that provides it, and only for educational and school administration purposes.

When a school enters information about a learner who is a child into CBE Analyser, the school confirms that:

• it has lawful authority to process that information
• the information is needed for a legitimate educational or administrative purpose
• parents or guardians have been informed as required
• any parental or guardian consent required by law has been obtained
• the processing is in the best interests of the child

Parents and guardians who want to know what data a school holds about their child in CBE Analyser should contact the school first, because the school is the data controller for that information. If the school does not respond, you may contact us using the details in section 25 and we will direct your request to the school and assist where we lawfully can.

10. Responsibilities of schools and authorised users

A school using CBE Analyser is responsible for ensuring it has lawful authority to enter personal data into the platform. Schools and their authorised users should ensure that:

• only authorised people are given accounts, and permissions match each person's role
• account credentials are never shared, and passwords are kept secret
• access is withdrawn promptly when a member of staff leaves or changes role
• information entered into the platform is accurate and kept up to date
• unnecessary personal data is not uploaded
• any parent or guardian consent required by law has been obtained
• information obtained through the platform is not disclosed to unauthorised people or used unlawfully
• appropriate privacy notices are given to learners, parents, guardians and staff

Tell us immediately if you become aware of unauthorised access to your school's account or misuse of the platform.

11. Examination, assessment and learner performance data

We process examination results, assessment scores and competency information supplied by schools in order to analyse performance, calculate statistics, generate report forms and class and subject analysis, track progress, identify trends and support educational decisions by teachers and school leaders.

Results are visible only to people the school has authorised, according to the role assigned to their account. Teachers see the learners and subjects assigned to them; administrators and head teachers see the school.

A school's learner data remains the school's. Processing it on our platform does not give CBE Analyser ownership of it, and we do not use it for any purpose beyond providing the service and the purposes set out in section 7.

12. Fee management and payments

The fee management module processes the information needed to administer school fees: recording fee structures and vote heads, recording payments, calculating balances, updating learner accounts, generating receipts and statements, producing financial reports, reconciling transactions and verifying payments.

Payments are made through mobile money and other payment channels. When you pay, the mobile money operator or payment provider processes the information necessary to complete and verify the transaction, under its own privacy policy. We receive and store the transaction reference, amount, date and status so the payment can be reconciled and receipted.

We do not sell school fee information, and we do not use learner or family financial information for advertising.

13. Bulk SMS and school communications

Schools use CBE Analyser to communicate with parents, guardians, teachers and staff. Telephone numbers and message content are processed to transmit, manage and record those communications, and are passed to the licensed telecommunications provider that delivers the message.

Schools are responsible for ensuring that recipient numbers were lawfully obtained, that messages are sent for legitimate purposes, that message content is appropriate, that sensitive information is not unnecessarily disclosed by SMS, and that marketing messages are sent only where the law permits.

14. Automated processing and artificial intelligence

Some features use automated processing to assist users: assessment analysis and grading against CBC rubrics, timetable generation, generation of schemes of work, lesson plans and records of work, and organisation of data for reporting.

These tools assist teachers and administrators. They do not replace professional judgement, and generated documents and analyses are drafts for a qualified teacher to review, edit and approve before use.

We do not make decisions producing legal or similarly significant effects on an individual by automated means alone. Where automated processing could significantly affect a learner, a teacher or school leader remains responsible for the decision.

We do not use identifiable learner data to train publicly available artificial intelligence models, and we do not supply learner data to third parties for that purpose.

15. Cookies and similar technologies

CBE Analyser uses cookies, browser local storage and similar technologies to operate the website and application. We use them to:

• keep you signed in and maintain your session
• protect accounts and detect suspicious activity
• remember preferences such as the term or class you last worked on
• make the application work offline and install to your device
• monitor performance and detect errors

These are necessary for the service to function. We do not use advertising cookies, and we do not allow third parties to track you across other websites through our platform. Where we introduce optional analytics that require consent, we will ask for it before setting them.

You can manage cookies through your browser settings. Blocking necessary cookies will prevent parts of CBE Analyser from working, including signing in.

16. Sharing and disclosure of personal data

We do not sell personal data. We share it only where it is necessary and lawful, with:

• Your school, and the administrators, teachers and staff it has authorised
• Hosting, database and infrastructure providers who run the servers the platform operates on
• Telecommunications and SMS providers, to deliver messages a school sends
• Payment providers, mobile money operators and banks, to process and verify payments
• Email and notification providers, to send service messages such as password resets
• Professional advisers such as lawyers, accountants and auditors, where necessary and under a duty of confidence
• Government authorities, regulators, courts and law enforcement, where we are required to do so by law or lawful order
• A successor entity, if our business or part of it is transferred, in which case this policy continues to apply until you are told otherwise

Service providers that process personal data on our behalf act only on our instructions and are required to keep it confidential and secure. We do not disclose personal data to third parties for their own marketing.

17. Transfers outside Kenya

CBE Analyser is built for Kenyan schools and operated from Kenya. Some of the technology providers we rely on, including our hosting, database and authentication infrastructure, operate data centres in more than one country. As a result, personal data may be stored or processed outside Kenya.

Where personal data is transferred outside Kenya, we do so only in accordance with the Data Protection Act, 2019, and only where one of the following applies:

• the destination has appropriate safeguards for the protection of personal data
• the transfer is governed by contractual terms that impose data protection obligations equivalent to those under Kenyan law
• the transfer is necessary for the performance of a contract with you or your school
• the transfer is necessary for the establishment, exercise or defence of a legal claim
• you or your school have consented, having been informed of the possible risks
• the transfer is otherwise permitted by the Act

We assess, before relying on a provider, whether it offers proof of appropriate safeguards, and we keep records of those transfers as the Act requires. Where the Act requires the Data Commissioner to be notified of or to authorise a transfer, we will comply before the transfer takes place.

If you would like to know where data about you or your school is currently stored, ask us using the details in section 25 and we will tell you.

18. How long we keep personal data

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as the law requires us to keep it. We then delete it or anonymise it so that it can no longer identify anyone.

A school may ask us to delete its data sooner, and we will do so unless the law requires us to keep it. Where a school closes its account, we will on request return its data in a commonly used electronic format before deletion.

Deletion from live systems is not always instantaneous in backups. Data awaiting deletion from a backup is not used for any purpose.

19. How we protect personal data

We take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These include:

• Encryption in transit. All connections to CBE Analyser use HTTPS. Data is encrypted at rest by our infrastructure providers.
• Authentication. Every user has an individual account. Passwords are stored only as one-way cryptographic hashes and cannot be read or recovered by anyone, including us. If you forget a password it is reset, never revealed.
• Tenant isolation. Database security rules restrict every record to the school it belongs to, so one school cannot read or alter another school's data.
• Role-based access. Teachers, class teachers, administrators, head teachers and secretaries each see only what their role requires. Teachers are limited to the subjects, grades and streams they are assigned.
• Secret management. Credentials for third-party services are held in a managed secrets store and used only by server-side code, never embedded in the application you download.
• Least privilege for our own staff. Access to production data is limited to the people who need it to operate and support the service.
• Logging and monitoring of access and security events, and regular backups.

No system is completely secure. You also have a part to play: choose a strong password, do not share it, sign out on shared devices, and tell us at once if you suspect your account has been compromised.

20. Personal data breaches

A personal data breach is a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

If a breach occurs and there is a real risk of harm to the people whose data is affected, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, as required by section 43 of the Data Protection Act, 2019, and we will communicate the breach to the affected data subjects in writing without undue delay where the Act requires it.

Where we act as a data processor for a school, we will notify that school without undue delay after becoming aware of a breach affecting its data, so the school can meet its own obligations as the data controller.

We keep an internal record of every personal data breach, its effects and the remedial action taken.

Report a suspected breach to boazsuna@gmail.com or +254 716 016 457.

21. Your rights

Under section 26 of the Data Protection Act, 2019 you have the right to:

These rights are not absolute. We may decline a request where the Act allows or requires us to, for example where keeping the data is needed to comply with a legal obligation or to establish or defend a legal claim. If we decline, we will tell you why.

22. How to exercise your rights

Email boazsuna@gmail.com or telephone +254 716 016 457. Please tell us:

• your name and how to contact you
• the school the request relates to, if any
• which right you are exercising and what you would like us to do

We will ask for proof of identity before releasing or changing personal data, to protect you against someone else making a request in your name. Where you are asking on behalf of a child, we will also ask for proof that you are the parent or guardian.

We respond within 7 days of receiving a complete request, and we complete it within 30 days. If a request is complex and we need more time, we will tell you within that period and explain why. There is no charge for a request unless it is manifestly unfounded or excessive, in which case we will tell you the cost before doing the work.

23. Complaints

If you are unhappy with how we have handled your personal data or your request, tell us first. Write to boazsuna@gmail.com with the word "Complaint" in the subject line and we will investigate and respond.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner under section 56 of the Data Protection Act, 2019:

Complaining to us first does not take away your right to go to the Commissioner or to the courts.

24. Changes to this policy

We may update this policy as the platform, our providers or the law change. The effective date and version at the top of this page show when it last changed.

If a change materially affects how we use your personal data, we will give notice before it takes effect, by email to account holders, by a notice inside the application, or both. Continuing to use CBE Analyser after a change takes effect means the updated policy applies to you. Where the law requires fresh consent, we will ask for it rather than assume it.

25. Contact us

For any question about this policy, about how your personal data is handled, or to exercise a right: