Privacy Policy

1. Who We Are

Shule Link Technologies ("Shule Link", "we", "our", or "us") provides cloud-based school management software and related digital services to schools, businesses, churches, and organisations across Kenya and Africa.

Our registered address is: Nairobi Garage, Ndege Road, Karen, Nairobi, Kenya.

For data protection matters, contact our Data Protection Officer at privacy@shulelink.co.ke.

2. Data We Collect

We collect information in the following categories depending on how you interact with our platform:

a) School & Organisation Data

• School name, address, and contact details
• Administrator and staff names, roles, email addresses, and phone numbers
• Subscription and billing information

b) Student & Parent Data (processed on behalf of schools)

• Student names, admission numbers, dates of birth, class, and stream
• Parent and guardian names, phone numbers, and email addresses
• Fee invoices, payment records, and balance information
• Academic records including marks, grades, and report cards
• Attendance records
• Transport and boarding information where applicable

c) Technical & Usage Data

• IP addresses, browser type, and device information
• Pages visited, features used, and session duration
• Login timestamps and activity logs

d) Communication Data

• SMS and WhatsApp messages sent through our platform
• Emails sent via our system
• Contact form submissions

3. How We Use Your Data

We use the data we collect to:

• Provide, operate, and maintain the Shule Link platform
• Process fee payments and generate receipts
• Send automated SMS, WhatsApp, and email notifications to parents and staff
• Generate academic reports and fee statements
• Provide technical support and respond to enquiries
• Improve our services through aggregated, anonymised analytics
• Comply with legal and regulatory obligations
• Detect, prevent, and address fraud or security issues

We do not sell your data to third parties. We do not use student data for advertising purposes.

4. Legal Basis for Processing

Under the Data Protection Act, 2019, we process personal data on the following grounds:

• Contract: Processing necessary to deliver the services your school has subscribed to
• Legitimate interests: Improving our platform, fraud prevention, and system security
• Legal obligation: Compliance with applicable Kenyan laws and regulations
• Consent: Where you have given us explicit permission, for example when signing up for marketing communications

5. Sharing Your Data

We share data only in the following limited circumstances:

• Payment processors: Safaricom M-Pesa and integrated banks (Equity, Co-op, Family Bank, KCB, Bank of Africa) to process fee payments
• SMS providers: Bulk SMS gateway providers to deliver messages on your behalf
• WhatsApp Business API: For WhatsApp notifications where the school has subscribed to this feature
• Hosting providers: Our cloud infrastructure providers who host the platform under strict data processing agreements
• Legal authorities: Where required by Kenyan law or a valid court order

All third-party processors are contractually bound to handle data securely and only for the purposes we specify.

6. Data Retention

We retain personal data for as long as necessary to provide our services and comply with legal obligations:

• Active school data is retained for the duration of the subscription
• After subscription termination, data is retained for 12 months to allow reactivation or export, then securely deleted
• Financial transaction records are retained for 7 years in compliance with Kenyan tax and accounting regulations
• System logs are retained for 90 days

7. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encrypted data transmission (HTTPS/TLS)
• Role-based access controls limiting data access to authorised users
• Regular automated database backups
• Activity and audit logging for sensitive operations
• Secure, password-protected user accounts with optional two-factor authentication

While we take all reasonable precautions, no system is completely secure. We will notify affected parties promptly in the event of a data breach, as required by the Data Protection Act, 2019.

8. Your Rights

Under the Data Protection Act, 2019, you have the following rights regarding your personal data:

• Right of access: Request a copy of the data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your data, subject to legal retention obligations
• Right to data portability: Request your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to restrict processing: Request that we limit how we use your data

To exercise any of these rights, contact us at privacy@shulelink.co.ke. We will respond within 21 days as required by law.

If you are unsatisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

9. Cookies

Our website uses the following types of cookies:

• Essential cookies: Required for the platform to function, including session management and login state
• Preference cookies: Store your settings such as dark/light mode preference (stored in localStorage)

We do not currently use advertising or third-party tracking cookies. You can control cookies through your browser settings, though disabling essential cookies may affect platform functionality.

10. Children's Privacy

Shule Link processes data relating to students, including children under the age of 18, on behalf of schools (as a data processor). The school acts as the data controller for student data and is responsible for obtaining appropriate consent from parents or guardians where required.

We do not knowingly collect personal data directly from children without the involvement of their school or parents.

11. International Transfers

Your data is primarily stored and processed within Kenya. Where data is transferred to service providers outside Kenya (for example, cloud infrastructure), we ensure adequate safeguards are in place in accordance with the Data Protection Act, 2019 and any regulations issued by the ODPC.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we do, we will update the "Last Updated" date at the top of this page and notify active subscribers by email or in-system notification.

Continued use of Shule Link after changes are posted constitutes acceptance of the revised policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your data, please contact us: