Privacy Policy

Oak Leaf Academy (“the School”, “we”, “us”) is a private mixed day school located in Nkama, Kajiado South, Kenya, offering Kenya’s Competency-Based Education curriculum from Playgroup through Upper Primary.

For the purposes of the Data Protection Act, No. 24 of 2019 (the “Act”), the School is the data controller in respect of the personal data described in this policy. This means we determine why and how your personal data is processed, and we are accountable for it.

You can reach us about anything in this policy at info@oakleafacademy.co.ke or on +254 111 679 685.

This policy explains how we handle personal data collected through this website and through our admissions and enquiry processes. It applies to prospective parents and guardians, current parents and guardians, learners, staff applicants and website visitors.

Separate, more detailed notices govern data we hold about enrolled learners and employees. Those are issued directly to the families and staff concerned.

Through this website we may collect:

• Contact details that you submit through our enquiry form: your name, email address and, if you choose to provide it, your phone number.
• Enquiry content: the subject of your enquiry and anything you write in your message, which may include your child’s age, grade or learning needs.
• Technical data: your IP address, browser type, device type and pages visited, collected automatically by our hosting provider for security and to keep the site running.

We ask that you do not send us sensitive personal data (such as health or medical information) through the website contact form. If such information is needed as part of admissions, we will collect it through a secure, dedicated process with an appropriate notice.

We take particular care with children’s data. Section 33 of the Act requires that personal data relating to a child is processed only where consent has been given by the child’s parent or guardian, and where the processing is in the best interests of the child.

• Our website enquiry form is intended for use by parents and guardians, not by children.
• We do not knowingly collect personal data directly from children through this website.
• Where you tell us about your child in an enquiry, we use that information solely to answer your enquiry and to guide you through admissions.
• We will not publish a learner's photograph, name or work on this website, our social media or in printed marketing material without the separate, written and specific consent of a parent or guardian. Any such consent may be withdrawn at any time by contacting the office.

Section 30 of the Act requires a lawful basis for every processing activity. Ours are set out below.

• To respond to your enquiry and provide admissions information, on the basis of your consent, given when you tick the consent box on our contact form.
• To administer an application or place, on the basis of steps taken at your request prior to entering into a contract of enrolment with the School.
• To keep the website secure and available, on the basis of our legitimate interests in preventing abuse and maintaining service.
• To meet regulatory and statutory obligations, including reporting duties to the Ministry of Education and other regulators, on the basis of compliance with a legal obligation.

We do not use your details for automated decision-making or profiling, and we will not use your contact details to send you marketing communications you have not asked for.

We do not sell, rent or trade personal data. We share it only where necessary, and only with:

• Members of our administration and admissions staff who need it to respond to you.
• Service providers acting as data processors on our behalf, currently our website hosting provider and Resend, the email delivery service that carries your enquiry to our inbox. These providers are bound by contract to process data only on our instructions and to keep it secure.
• Regulators, auditors or law-enforcement agencies, where we are legally required to disclose information.

Some of our service providers store or process data on servers located outside Kenya. Sections 48 and 49 of the Act permit such transfers where appropriate safeguards are in place, or where the transfer is necessary for the performance of a contract or is based on your consent.

Where personal data is transferred outside Kenya, we satisfy ourselves that the receiving provider offers a comparable standard of protection through contractual commitments and recognised security certifications.

We keep personal data only for as long as it is needed for the purpose it was collected, and thereafter for any period required by law.

• Website enquiries that do not lead to an application: up to 12 months from your last contact with us.
• Admissions records for applicants who do not enrol: up to 24 months, so we can respond if you apply again.
• Records relating to enrolled learners: retained in line with statutory record-keeping requirements for educational institutions in Kenya.
• Website security and server logs: typically 30 to 90 days.

When data is no longer needed, it is securely deleted or anonymised.

Section 41 of the Act requires appropriate technical and organisational measures. Ours include:

• Encryption of data in transit using HTTPS across the whole website.
• Access to enquiry data restricted to authorised administration staff only.
• Reputable hosting and email providers with recognised security practices.
• Staff guidance on confidentiality, safeguarding and the handling of learner information.
• Regular review of who has access to what, and removal of access when a role changes.

No system is completely secure. If a breach occurs that poses a real risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner without undue delay and within 72 hours where feasible, and will communicate with affected individuals as required by the Act.

Section 26 of the Act gives you, as a data subject, the following rights:

• To be informed of the use to which your personal data is put.
• To access the personal data we hold about you.
• To object to the processing of all or part of your personal data.
• To correction of false or misleading data.
• To deletion of false or misleading data about you.
• To withdraw consent at any time, where our processing relies on consent. Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn.
• To data portability, where technically feasible.

To exercise any of these rights, email info@oakleafacademy.co.ke. We will respond without undue delay. We may ask you to verify your identity before we act, to make sure we do not disclose data to the wrong person. There is no fee for making a request.

This website is designed to run with a minimal footprint. We do not use advertising cookies or third-party tracking cookies, and we do not build advertising profiles of our visitors.

Our hosting provider may set strictly necessary cookies required for the site to function and to protect against abuse. These do not require consent under the Act.

Should we introduce analytics or other non-essential cookies in future, we will update this policy and ask for your consent through a clear banner before any such cookie is set.

Our website may link to external sites, for example the Kenya Institute of Curriculum Development or the Ministry of Education. We are not responsible for the privacy practices or content of those sites, and we encourage you to read their own privacy notices.

If you are unhappy with how we have handled your personal data, please raise it with us first, because we would like the chance to put it right. Contact the school office at info@oakleafacademy.co.ke.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), the regulator responsible for enforcing the Data Protection Act, 2019 in Kenya. The ODPC can be reached through its offices in Nairobi and via its official website and complaints portal.

We review this policy periodically and will update it when our practices or the law change. The date at the top of this page shows when it was last revised. Where changes are significant, we will draw them to your attention through the website or by direct communication. Please also see our Terms of Use.