Privacy Policy

CBE Analytics is an education management and assessment platform operated by PATRICK MAINA TECHNOLOGY SOLUTIONS ("CBE Analytics", "we", "us", or "our").

We provide schools with tools for learner management, competency-based assessment, academic reporting, attendance, communication, fee management and related school administration functions.

Because CBE Analytics processes information relating to learners, parents and guardians, facilitators, school administrators and other individuals, we take privacy and data protection seriously. This Privacy Policy explains how personal data is handled when using our platform and related services.

For learner, parent/guardian and school staff information entered into CBE Analytics by or on behalf of a school, the school will generally determine the purposes for which that information is collected and used.

In those circumstances, the school generally acts as the data controller and CBE Analytics acts as a data processor, processing information on behalf of and according to the instructions of the school.

CBE Analytics may independently act as a data controller for information required to operate, secure, maintain and administer our own services, including account information, billing records, security logs, service communications and information relating to our website.

Schools remain responsible for determining the appropriate lawful basis for collecting and using personal data within their institution and for providing appropriate notices to their learners, parents/guardians and staff.

Depending on the features used by a school, CBE Analytics may process the following categories of information:

• Learner names and identification details
• Assessment numbers and admission numbers
• Date of birth and gender
• Learner assessment and academic performance information
• Learner photographs where provided by the school
• Attendance and participation information
• Parent or guardian names
• Parent or guardian telephone numbers and email addresses
• Parent or guardian relationships to learners
• Facilitator and staff names
• Facilitator telephone numbers and email addresses
• TSC numbers or other staff identification information where provided
• School fee and payment information
• Account credentials and authentication information
• Login, device, session and security information
• Activity and audit records
• Information submitted when contacting CBE Analytics

Schools should only enter information that is necessary and appropriate for the relevant educational or administrative purpose.

CBE Analytics is designed for use by educational institutions and therefore may process personal data relating to children.

We apply additional safeguards to children's information and expect schools to ensure that they have the appropriate legal authority and lawful basis to collect and process information relating to learners.

Where a school processes information relating to a child, including information that may be considered sensitive personal data, the school is responsible for ensuring that the applicable requirements concerning parental or guardian authority, consent, legal obligations and other lawful bases are satisfied.

CBE Analytics does not knowingly use learner information for advertising, profiling for commercial purposes, or unrelated marketing.

Information processed through CBE Analytics may be used to:

• Provide and operate the CBE Analytics platform
• Manage learner and staff records
• Process assessments and generate academic reports
• Manage attendance and school administration
• Support school communication and notifications
• Process and record school fee information where enabled
• Authenticate users and protect accounts
• Maintain audit and activity records
• Detect, prevent and investigate security incidents
• Provide technical support requested by authorised school administrators
• Maintain backups and recover services when necessary
• Improve reliability, performance and security of the platform
• Meet applicable legal and regulatory obligations

Access to school data is controlled according to the roles and permissions configured for each institution.

CBE Analytics uses school-level data isolation so that users associated with one institution should not have access to another institution's data.

CBE Analytics personnel may access school information only where reasonably necessary to provide technical support, investigate a service issue, maintain security, comply with a lawful requirement, or perform another authorised operational function.

Where possible, such access should be requested or authorised by the school's designated administrator.

CBE Analytics provides technology to schools and does not replace the school's relationship with parents or guardians.

Parents and guardians should normally direct requests concerning learner records, corrections, access, deletion or other learner-related personal data matters to the relevant school.

Where the school requires technical assistance from CBE Analytics, the school's authorised administrator may contact us for support.

CBE Analytics does not ordinarily communicate directly with parents or guardians concerning school-held learner records unless required by law or specifically authorised by the relevant school.

We may use carefully selected technology and service providers to operate CBE Analytics. These providers may process limited information on our behalf where necessary to provide their services.

Depending on the services enabled, these providers may include infrastructure, database, hosting, image storage, communications and SMS delivery providers.

For SMS communications, CBE Analytics may provide an SMS service provider with the information necessary to deliver a message, including recipient information and message content. Where technically applicable, recipient telephone numbers may be transmitted in masked form.

We do not sell school, learner, parent or staff personal data.

Some technology providers used by CBE Analytics may process or store information outside Kenya.

Where personal data is transferred or processed outside Kenya, we seek to use appropriate contractual, technical and organisational safeguards and to comply with applicable Kenyan data protection requirements.

We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.

• Role-based access controls
• School-level data isolation
• Database-level security controls
• Authentication and password/PIN protection
• Encrypted connections using HTTPS
• Audit and activity logging
• Session management and expiration
• Administrative access controls
• Database backups
• Encryption and other appropriate security measures

No internet-based service can guarantee absolute security. Schools and users are responsible for protecting their login credentials and reporting suspected unauthorised access promptly.

School data is retained for as long as necessary to provide the subscribed services and in accordance with the school's instructions and applicable legal requirements.

Where a school's subscription expires and the school does not renew or reactivate its subscription, CBE Analytics may retain the school's account and associated data for up to two months following the expiry of the active subscription period.

If the school remains inactive after that period, the school account and associated data will be scheduled for permanent deletion, subject to information that must be retained to comply with a legal obligation, resolve disputes, enforce agreements, maintain security records or otherwise comply with applicable law.

Once a school's data has been permanently deleted, a subsequent subscription will normally require the school to begin again as a new institution rather than restoring the deleted account.

Applicable data protection law provides individuals with rights concerning their personal data, including rights to be informed, access personal data, object to certain processing, request correction of inaccurate information and request deletion where applicable.

For school-controlled information, requests should normally be submitted to the relevant school because the school determines the purposes and means of processing that information.

Where the school requires assistance from CBE Analytics in responding to a valid request, the school's authorised administrator may contact us.

Schools are responsible for ensuring that information entered into CBE Analytics is accurate, relevant, appropriate and reasonably up to date.

Authorised school users can correct information through the platform where the relevant functionality is available.

CBE Analytics may use cookies, session identifiers, local storage and similar technologies necessary to authenticate users, maintain sessions, remember preferences, protect accounts and operate the platform.

We may also process technical information such as IP addresses, browser information, device information, login times and security events for authentication, security, troubleshooting and audit purposes.

We maintain procedures intended to identify, investigate and respond to suspected personal data breaches or security incidents.

Where a security incident affects school-controlled personal data, CBE Analytics will take appropriate steps in accordance with applicable law and its contractual obligations to the affected school.

We may update this Privacy Policy periodically to reflect changes to our services, technology, legal requirements or data handling practices.

Material changes will be communicated through appropriate channels where required.

For learner, parent or school-held personal data, please contact the relevant school first. Authorised school administrators may contact CBE Analytics where technical or platform assistance is required.