Privacy Notice

Who is responsible for your data

Your child’s school is the data controller — it decides what information is collected and why. Opero is the data processor — it runs the software on the school’s instructions and does not use your data for its own purposes. All data is stored in Kenya.

What we collect

• About learners (children): name, admission number, date of birth, gender, class, academic records, attendance, fees and transport details; and, where provided, health/medical information (treated as sensitive data with extra protection).
• About guardians: name, relationship to the learner, phone, email, address.
• About staff: name, role, contact and employment records.

Why we collect it

To run the school: enrolment, teaching and assessment, welfare and safety (including safe transport), fees, and communication with you. For a child, we rely on your consent as parent or guardian together with the school’s contract and legal obligations. We do not sell your data or use it for advertising.

Your rights

You have the right to: be informed; access your and your child’s data; ask for correction; ask for deletion; object to certain processing; and receive a portable copy. To exercise any right, contact the school. We respond within the timelines the Act requires.

How long we keep it

Only as long as needed to run the school and meet legal obligations. When a learner leaves, records are kept for the required period and then securely erased.

How we protect it

Each school’s data is isolated from every other school’s at the database level. We use encryption in transit (HTTPS), strong password protection, two-step sign-in for staff, strict access controls, auditing of who views sensitive records, and regularly tested backups.

Sharing

We share data only as needed to run the school — for example an SMS gateway to send you a message, or M-Pesa to process a fee you pay — each bound to protect it. We do not transfer your data outside Kenya.

Complaints

Contact the school’s data-protection contact first. You may also complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.