Privacy Notice

E-Portfolio · Kenya Data Protection Act, 2019 · Last updated: 19 September 2026

This notice explains how personal data is handled in the E-Portfolio system used by your school. It is written for learners, parents and guardians, and school staff.

1. Who is responsible

Your school decides why and how learners' data is used, so the school is the data controller. Vertex Labs runs the system for the school and handles the data only on the school's instructions, as a data processor.

2. What data we hold

• Learners: name, class or grade, stream, assessment number, admission number, gender, subject combination, pathway and track, guardian phone number, login PIN, uploaded project work, marks and feedback.
• Staff: name, email address, role, department, and the subjects, streams or grades assigned to them.
• System records: login attempts, IP addresses and a log of actions such as marking, exports and deletions, kept for security and accountability.

3. Why we use it

The data is used to run assessments and project portfolios: collecting learners' work, marking it, producing marks reports, and keeping the system secure. It is not used for advertising or sold to anyone.

4. Children's data

Most learners are under 18. Their data is used only for the school's educational and assessment purposes and in their best interests (section 33 of the Act). Parents and guardians can act on a child's behalf, as described in section 7.

5. Who can see it

Only authorised staff of your school can see learner records, and what each person sees depends on their role and the subjects or streams assigned to them. Data is disclosed to others only where the law requires it.

6. How we protect it

• Connections to the system are encrypted (HTTPS).
• Learner login PINs are stored in protected form, and repeated failed logins are limited.
• Access to learner data, exports and deletions are recorded in an audit log.

If a breach puts personal data at risk, the school and Vertex Labs will notify the Data Protection Commissioner and the people affected, as the Act requires (section 43).

7. Your rights

Under section 26 of the Act, you have the right to know how your data is used, to see it, to object to its use, to have wrong data corrected, to have data deleted when there is no longer a reason to keep it, and to receive your data in a portable format where this applies. Parents and guardians may exercise these rights for a child.

To make a request, contact: Data Protection Contact: REAL-ADDRESS-HERE.

8. How long we keep it

Learner records are kept while the learner is enrolled and for 12 months after they leave the school. After that, the learner's personal details, uploaded work and marks are erased (sections 39 and 40 of the Act).

9. Complaints

If you believe your data has been mishandled, please contact the school first. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC): www.odpc.go.ke.

10. Changes

We may update this notice. The date at the top shows when it was last changed.