Version 1.0 — Effective June 2026
EZEMS CBE LMS ("we", "our", "the platform") is committed to protecting the privacy and personal data of all users — students, parents, teachers, and school administrators — in accordance with the Kenya Data Protection Act, 2019 (Act No. 24 of 2019) and related regulations.
1. Data Controller
EZEMS Technology Ltd is the data controller responsible for personal data processed on this platform. Each subscribing school is a data processor operating under a data processing agreement with EZEMS.
- Contact: info@ezems.co.ke
- Address: Kenya
- Data Protection Officer: admin@ezems.co.ke
2. Data We Collect
We collect the following categories of personal data:
- Students: Full name, admission number, grade/class, academic performance, attendance records, exam scores, CBC assessment results.
- Parents/Guardians: Full name, email address, phone number, relationship to student.
- Teachers: Full name, email, phone, TSC number, subjects taught, attendance records, performance data.
- School Administrators: Name, email, role, login activity logs.
- Technical Data: IP addresses, login timestamps, device type, browser information (for security purposes).
3. Purpose of Processing
Personal data is processed for the following lawful purposes:
- Managing student academic records and CBC assessments
- Generating report cards and academic performance reports
- Facilitating communication between schools, teachers, and parents
- Managing school fee payments and financial records
- Ensuring school security through attendance and access logs
- Complying with Kenya Ministry of Education reporting requirements
4. Legal Basis for Processing
- Contractual necessity — processing required to deliver the LMS service
- Consent — where explicitly obtained from parents/guardians for minors
- Legal obligation — compliance with Kenya education regulations
- Legitimate interests — system security, fraud prevention, service improvement
5. Data Retention
We retain personal data for the following periods:
- Student academic records: 7 years after leaving the school
- Financial records: 7 years (as required by Kenya tax law)
- Login and security logs: 12 months
- Inactive school accounts: 2 years after subscription ends
6. Data Subject Rights
Under the Kenya Data Protection Act, 2019, you have the right to:
- Access your personal data held by us
- Correct inaccurate or incomplete data
- Request deletion of your data (subject to legal retention requirements)
- Object to processing of your data
- Data portability — receive your data in a machine-readable format
- Lodge a complaint with the Office of the Data Protection Commissioner (ODPC)
To exercise these rights, contact: info@ezems.co.ke
7. Data Security
- All data transmitted via SSL/TLS encryption (HTTPS)
- Role-based access control — users only access data relevant to their role
- Two-factor authentication available for all staff accounts
- Regular automated database backups with encryption
- Suspicious login detection and IP-based rate limiting
- Audit logs maintained for all sensitive data access
8. Data Sharing
We do not sell personal data. Data may be shared with:
- The school administration (your employer/service provider)
- Kenya Ministry of Education (where legally required)
- Payment processors (M-PESA/Safaricom) for fee transactions only
- Cloud infrastructure providers under data processing agreements
9. Cookies
We use essential cookies for session management and security. No third-party advertising cookies are used. You can manage cookie preferences on login.
10. Children's Data
Students under 18 are considered minors under Kenyan law. Their data is processed solely for educational purposes with school consent acting as proxy consent. Parents/guardians may request access to their child's data at any time.
11. Changes to This Policy
We may update this policy periodically. Schools will be notified of material changes and required to re-confirm consent. The current version is always available at this URL.
12. Contact & Complaints
Data Protection Officer: info@ezems.co.ke
Office of the Data Protection Commissioner (ODPC): www.odpc.go.ke