Privacy Policy

Schools are the data controllers. Each school that subscribes to Edzana decides what information about its learners, parents and guardians, and staff is recorded, and why. The school is responsible for having a lawful basis for that processing, including any consent it needs from parents or guardians for children’s data.

Miventech Labs is the data processor. We process that information only on the school’s documented instructions, to provide the service to the school. We do not sell it, use it for advertising, or use it for our own purposes.

Miventech Labs is the controller only for a small amount of data of its own: contact details of school representatives we deal with, billing records for subscriptions, and messages sent to us through the contact form on this website.

If you are a learner, parent, guardian or member of staff, the school is your first point of contact for questions about your data.

Much of the data in Edzana is about children. We process it only for the school’s educational and administrative purposes, as the school directs, and never for profiling, marketing or any purpose of our own. Learner accounts, where a school creates them, are set up and controlled by the school.

Depending on which parts of the service a school uses, this can include:

• Learners: names, admission numbers, date of birth, gender, nationality, class and stream, uploaded documents and photographs, attendance, exam marks and reports, assignments and submissions, discipline records, health and medical records, transport, hostel, library and cafeteria records, transfers and alumni records.
• Parents and guardians: names, relationship to the learner, phone numbers, email addresses, notification preferences, and fee invoices and payments.
• Staff: names, contact details, ID numbers and KRA PINs, employment details, qualifications, attendance, leave, appraisals, payroll and bank details, and lesson plans.
• Other people: visitor log entries, and details of suppliers and other contacts the school records.
• Account and technical data: usernames, hashed passwords, two-factor authentication settings, roles and permissions, sign-in history, IP addresses and approximate location, browser type, and an audit history of changes made to records.
• Website enquiries: the name, email address and message you send through our contact form.

• To provide Edzana to the school: records, academics, finance, communication, operations and reporting.
• To send notifications the school or a user has asked for, by in-app message, email, SMS or WhatsApp.
• To process fee payments a parent or the school initiates.
• To keep accounts and data secure, including detecting repeated failed sign-ins and unauthorised access attempts.
• To diagnose errors and keep the service running.
• For our own records: to manage the school’s subscription, bill for it, and reply to enquiries.

Some optional features send limited data to Google’s Gemini service. No school data is sent to Gemini unless we have enabled it on our servers, which we do only under Google’s paid-service terms, where Google does not use the data it receives to improve its products. Financial insights send a school’s aggregated financial figures, not records about individual learners.

AI-writing detection is off by default. It runs only if the school switches it on in its plagiarism settings, which state that doing so sends submission text to Google Gemini. When it is on, up to the first 3,000 characters of an assignment submission are sent for analysis, without the learner’s name. When it is off, no submission text is sent to Gemini.

Plagiarism checking compares a submission with other submissions at the same school. Comparing against other schools’ submissions is also off by default and happens only if the school switches it on. Even then, a match found at another school is shown anonymously, as “Submission at another school”: the other learner’s name, class, assignment and school are not stored with the report or shown to anyone. Plagiarism checking can also send a few short sentences from a submission, without names, to web and academic search services, where the school has web checking switched on.

The results of these features are advisory and are reviewed by the school’s teachers; they are not used to make automated decisions about a learner.

We use the following providers to run the service. Several are used only when the school uses the related feature. Each receives only what it needs for its task.

Maps, route planning and place search for the transport module run on servers we host ourselves, and our error monitoring is self-hosted and set up not to record form contents, cookies or user details.

Edzana is hosted in Germany, in the European Union, and some of the providers above process data in other countries. Where data leaves Kenya we rely on the safeguards the Data Protection Act, 2019 allows, including transfers to countries and providers with appropriate data protection safeguards, and we limit what is sent to what each task needs. A school can ask us for more detail about any transfer.

• Traffic is encrypted in transit with HTTPS, and browsers are told to use HTTPS only.
• Passwords users set are stored as Argon2 hashes. A temporary password issued for a new account is kept only until the user sets their own. Two-factor authentication is available.
• Sign-in tokens are kept in secure, HTTP-only cookies that page scripts cannot read.
• Each school’s data is kept separate, and access within a school is limited by role and permission.
• Changes to records are kept in an audit history, and repeated failed sign-ins are flagged.
• Uploaded files are served through links that expire.
• Databases and uploaded files are backed up every night.

No system is perfectly secure, but we work to protect the data entrusted to us.

The school decides how long its records are kept while it uses the service, and can delete records in the application. When a school’s subscription ends, we make its data available for export on request and then delete it from the live service, unless the law requires us to keep it. Copies in our backups are overwritten as the backups rotate. Our own billing records are kept as long as tax and accounting law requires.

Under the Data Protection Act, 2019 you have the right to be informed about the use of your data, to access it, to have inaccurate data corrected, to have data deleted where there is no longer a reason to keep it, and to object to processing.

Because schools control the data in Edzana, please make your request to your school. If you contact us directly, we will pass your request to the school and help the school respond to it. For data that Miventech Labs controls itself, contact us using the details below.

You can also complain to the Office of the Data Protection Commissioner (ODPC) in Kenya at www.odpc.go.ke.

If we become aware of a breach affecting a school’s data, we will notify the school without undue delay, tell it what we know, and help it meet its own obligations to notify the Data Protection Commissioner and the people affected.

Edzana uses cookies only to keep you signed in and to remember basic display details, and your browser’s local storage to remember preferences such as the theme and the school you last selected. We do not use advertising or third-party analytics cookies.

We may update this policy as the service changes. The date at the top shows when it last changed, and we will tell schools about significant changes.

Related

See also our Terms of Service. Questions about this policy can be sent to info@miventechlabs.com.