Privacy Policy

Introduction

Datacare Limited ("we," "our," or "us") is committed to protecting your privacy and the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit datacare.co.ke or use our services, including JurisFlow, EduPulse 360, and Datacare Docs.

This policy is governed primarily by the Kenya Data Protection Act 2019 (KDPA 2019) and the regulations of the Office of the Data Protection Commissioner (ODPC). Where relevant, we also reference the General Data Protection Regulation (GDPR) for internationally oriented data practices.

Information We Collect

Personal Information You Provide

We collect information you voluntarily give us, including:

• Contact details: Name, email address, phone number, organisation name
• Enquiries: Messages submitted via our contact forms
• Service requests: Information about the products or services you are interested in
• Account credentials: Where you create a user account on a Datacare product

Automatically Collected Information

• Usage data: Pages viewed, time on site, navigation paths
• Device information: Browser type, operating system, IP address
• Cookies: Session identifiers and preference settings

Student & Client Data (EduPulse 360 / JurisFlow)

When Datacare provides software such as EduPulse 360 to schools, or JurisFlow to law firms, the institution (school, law firm, or organisation) acts as the data controller for data belonging to their learners, clients, or staff. Datacare acts as a data processor on their behalf.

We process such data only on documented instructions from the institution, in compliance with:

• Kenya Data Protection Act 2019
• Data Processing Agreements (DPAs) signed with each client organisation
• NEMIS guidelines (for EduPulse 360 learner data)

Student data is never used for marketing, profiling, or shared with third parties outside of the agreed service delivery.

How We Use Your Information

• Service delivery: To respond to enquiries and provide the services you requested
• Communication: To send updates, proposals, or support messages (with your consent)
• Product improvement: To analyse usage patterns and improve our products
• Security: To detect fraud, unauthorised access, and other threats
• Legal compliance: To meet our obligations under Kenyan law

Legal Basis for Processing

Under KDPA 2019, we process personal data on the basis of:

• Consent: Where you have explicitly agreed to a specific use
• Contract performance: Where processing is needed to fulfil a service agreement with you
• Legitimate interests: Where processing is necessary for our reasonable business purposes and does not override your rights
• Legal obligation: Where Kenyan law requires us to retain or share data

Data Sharing and Disclosure

We may share your information with:

• Technology sub-processors: EmailJS (contact form delivery), Supabase (database hosting), Cloudflare (hosting and CDN), Microsoft (SharePoint / Datacare Docs)
• Professional advisors: Lawyers, auditors, and accountants, where necessary
• Legal authorities: Where required by Kenyan law or a court order

We do not sell your personal information to any third party, ever.

Data Security

We implement the following to protect your information:

• HTTPS encryption on all data in transit
• Access-controlled database hosting via Supabase and Microsoft Azure
• Regular security reviews and vulnerability assessments
• Role-based access controls within all Datacare products
• Defined incident response procedures for data breaches, including ODPC notification where required

Data Retention

We retain personal data only as long as necessary:

• Contact form submissions: 2 years from receipt
• Client account and billing data: 7 years to satisfy Kenyan tax and accounting obligations
• Student and learner data (EduPulse 360): retained for the duration of the school's service agreement, then deleted or returned to the school on request

Your Data Protection Rights

Under KDPA 2019, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten"), subject to legal retention requirements
• Restriction: Request limitation of processing in certain circumstances
• Data portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Withdraw consent at any time without affecting lawfulness of prior processing

To exercise any of these rights, email us at privacy@datacare.co.ke. We will respond within 21 days as required by the KDPA 2019.

Cookies and Tracking

We use cookies and similar technologies to:

• Maintain session state and user preferences
• Analyse website traffic (anonymous, aggregate data)
• Improve page performance and user experience

You can control cookies through your browser settings. Disabling cookies may affect some website functionality.

International Data Transfers

Some of our sub-processors (Supabase, Cloudflare, Microsoft) operate infrastructure outside Kenya. Where data is transferred internationally, we ensure appropriate safeguards are in place consistent with KDPA 2019 transfer rules, including contractual protections with each sub-processor.

Minors and Student Data

Our website is not directed at individuals under 18 and we do not knowingly collect personal data directly from minors via the website.

EduPulse 360 does process learner data (including minors) on behalf of schools, as described in the "Student & Client Data" section above. The school is the data controller for all learner data; Datacare processes it solely to deliver the agreed service.

Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated by updating the "Last updated" date above and, where appropriate, by email notification to clients. Continued use of our services after changes constitutes acceptance of the updated policy.

Contact Us

For questions about this Privacy Policy or to exercise your data protection rights:

Complaints

If you believe your data protection rights have been violated, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC):