Privacy policy

Skulink Kenya is a school management system provided by Skulink Kenya (“we”, “us”). Schools use it to keep learner records, marks, fees, attendance and communication with parents.

Under the Kenya Data Protection Act, 2019, each school is the data controller for the information it keeps about its learners, parents and staff: the school decides what is recorded and why. We are the data processor: we hold and process that information on the school’s behalf and on its instructions, and for no purpose of our own.

We are the data controller only for the information we need to run our business with a school — the contact details of the people who sign the school up and pay for it, and the records of our support conversations.

What a school records depends on what it uses. It can include:

• Learners: name, admission number, date of birth, gender, class, photograph where the school adds one, national register numbers (NEMIS/KEMIS UPI, birth certificate and KNEC assessment numbers), marks, competency assessments, report cards, attendance, homework, clubs and results, boarding and transport arrangements, library loans, gate passes, and leaving certificates.
• Sensitive learner information where the school records it: health details and allergies, sick-bay visits, disabilities, and discipline records.
• Parents and guardians: name, relationship to the learner, phone number, email address, messages with the school, fees billed and paid, and meeting bookings.
• Staff: name, contact details, role and duties, classes taught, timetables, lesson plans and schemes of work, leave, and — where the school runs payroll through us — salary, statutory deductions, KRA PIN and bank details.
• Visitors: name, ID number, phone number and the reason for their visit, where the school keeps its visitors’ book with us.
• Account and usage information: sign-in email or phone number, when an account signs in, which device receives notifications, and a record of changes made to marks and settings.

We do not sell this information, use it for advertising, or build profiles of learners or families.

Most learners are children. The Data Protection Act requires that a child’s information is processed only with the consent of a parent or guardian and in the child’s best interests. Because the school is the controller, the school is responsible for having that consent, usually as part of admission, and for recording only what it needs to educate and care for the child.

We help the school keep children’s information narrowly shared: a parent sees only their own children; a teacher sees only the classes they teach; health and discipline records are open only to the staff whose duties need them. These limits are enforced on our servers, not only on screen.

We process school information only to provide the service the school has asked for:

• keeping and calculating records — marks, grades, rankings, report cards, fee balances;
• letting each person see and do what their role allows;
• sending the notices the school sends — messages, homework, fee bills, gate passes, meeting days — by app notification and SMS;
• signing people in securely, including by one-time codes sent by SMS;
• supporting the school when it asks for help, and keeping the service secure and working.

For the information we control ourselves, we rely on our contract with the school and our legitimate interest in running and securing the service.

We use a small number of service providers to run Skulink Kenya. Each handles information only to provide its part of the service, under its own security and confidentiality commitments:

• Cloudflare — where the records and sign-in accounts are stored and backed up, the gateway that checks every request and decides what each person may see and change, and sending Skulink Kenya's emails.
• Vercel — hosting the website and app.
• OTS Kenya — delivering SMS messages and sign-in codes to Kenyan phone numbers.
• Google — only if you choose to sign in with your Google account, to confirm who you are.
• Your browser's push service (for example Google's or Apple's) — delivering app notifications you have turned on, encrypted so it cannot read them.

We do not share school information with anybody else unless the law requires it, for example a lawful order of a Kenyan court, and where the law allows we will tell the school first.

Our service providers operate data centres outside Kenya, so information is stored and processed outside the country. Where the Data Protection Act requires it, we transfer information abroad only to providers that give appropriate safeguards for its security and protection, as section 48 of the Act requires.

• Each school’s information is kept separate from every other school’s.
• Every request is checked on our servers against the person’s role and duties before anything is shown or changed.
• Information travels encrypted, and passwords are never stored in readable form.
• Signed-in sessions end after 4 hours.
• Changes to marks and grading are recorded, with who made them and when.

A school’s information is kept for as long as the school uses Skulink Kenya, because it is the school’s record of the learners it has taught. A school can remove records it no longer needs.

When a school leaves, its account is archived: nobody can sign in, and everything it holds is deleted permanently 90 days later unless the school returns first. A school can ask for its records to be exported before then.

We keep our own business records — such as invoices and payments — for as long as Kenyan tax law requires.

Under the Data Protection Act you have the right to be told how your information is used, to see it, to have it corrected or deleted, to object to its use, and to have it moved elsewhere.

Because the school decides what it records about you or your child, ask the school first: it can see, correct and export its records directly. If you ask us, we will pass your request to the school and help it respond.

For anything about the information we control ourselves, use the Help button on any page of Skulink Kenya, which reaches our support team directly. You may also complain to the Office of the Data Protection Commissioner, at odpc.go.ke.

If we learn of a breach affecting a school’s information, we will tell the school without delay so that it can meet its own duties, and we will notify the Data Protection Commissioner within 72 hours where the Act requires it.

We use only what is needed for the service to work: a cookie that keeps you signed in, and storage on your device that remembers settings such as the light or dark theme and which parts of the menu you have folded. We use no advertising or tracking cookies.

When we change this policy we will update the date at the top, and tell schools of any important change before it takes effect. The terms of service set out the rest of our agreement with schools.