Privacy Policy

1. Introduction

This section explains how Jisazi ("we", "us", or "our") collects and processes personal data submitted through the School Service Request Form on https://www.jisazi.com/.

The processing described here complies with the Data Protection Act, No. 24 of 2019, the Data Protection (General) Regulations, 2021, and general Kenyan law.

The purpose of this processing is to enable schools to request Jisazi products or services, receive follow-up communication, and complete onboarding and provisioning steps.

2. Personal data collected through the School Service Request Form

When a school submits the form, we collect the following categories of data directly from the user:

We do not request or require sensitive personal data for this form. If a user provides such information voluntarily, we will apply all legal safeguards required under Kenyan law and delete it where appropriate.

3. Purpose of processing

We process the submitted data for the following purposes:

1. To receive, review and respond to a school's request for Jisazi services.
2. To assess eligibility, availability and readiness for service deployment.
3. To contact the school's representative for clarification, quotations or onboarding.
4. To maintain internal records of service interest, leads and follow-ups.
5. To create a customer account where a school chooses to proceed.
6. To comply with legal obligations, including contractual documentation and invoicing.

No automated decision-making or profiling is performed on data collected via this form.

4. Legal basis for processing

Under the Data Protection Act (Kenya), our lawful bases for processing this information are:

• Consent: provided when the school representative submits the form voluntarily.
• Performance of a contract or steps at the request of the data subject: to provide quotations, proposals or activation of Jisazi services.
• Legitimate interests: to manage service requests, improve operational processes and maintain business records.
• Legal obligation: for compliance with tax, regulatory and record-keeping requirements.

5. How we store and protect the data

We implement administrative, technical and physical safeguards to protect the submitted data, including:

• Secure form transmission (HTTPS)
• Controlled staff access
• Role-based permissions in CRM and support systems
• Encrypted storage where applicable
• Regular monitoring for vulnerabilities

Despite the measures above, no internet-based system is fully risk-free, but we take reasonable steps aligned with Kenyan data protection standards.

6. How long we retain the data

We retain form submissions only for as long as necessary, depending on the outcome:

• If the school proceeds to contract: data is retained in the customer record for 10 years.
• If the school does not proceed: form details are retained for 24 months to manage follow-ups and internal reporting.
• If a deletion request is made: we delete or anonymize the data unless a legal obligation requires retention.

7. Data sharing

We do not sell or rent data submitted via the School Service Request Form.

We may share data only with the following categories:

1. Authorised Jisazi staff involved in sales, onboarding, support, or operations.
2. Service providers (e.g., hosting, CRM, email and communication tools) operating under binding data-processing agreements.
3. Regulators or authorities where disclosure is legally required.
4. Third parties only with explicit consent from the school's authorized representative.

If any data is transferred outside Kenya, we ensure appropriate safeguards as required by the Data Protection Act and the ODPC regulations.

8. Rights of the school's representatives

Individuals who submit the form have the following rights under Kenyan law:

• Right to be informed how their data is used
• Right of access to their personal data
• Right to correction
• Right to deletion (where lawful)
• Right to object to certain processing
• Right to withdraw consent
• Right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC)

To exercise any right, contact us using the details below.

9. Contact information

If a data subject believes their rights have been infringed, they may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) via https://www.odpc.go.ke/.

10. Updates to this section

We may update this Form-Specific Privacy Policy to reflect operational, legal or regulatory changes. Any changes will be posted on the Site with an updated effective date.