Privacy Policy

Before you publish this: this is a working draft grounded in what this application actually collects and does — not generic boilerplate — but it is not a substitute for review by a lawyer familiar with Kenya's Data Protection Act 2019. Fields in [BRACKETS] need real values before this goes live, and you'll need to register as a data controller/processor with the Office of the Data Protection Commissioner (ODPC) before collecting personal data from real bookings.

Last updated: [DATE]

1. Who this policy covers

This policy applies to anyone who visits this website, browses courses, makes a booking, submits an inquiry, or subscribes to updates from [BUSINESS LEGAL NAME], registered in Kenya as [BUSINESS REGISTRATION NUMBER], with its registered address at [BUSINESS ADDRESS] ("NextSkill," "we," "us").

2. What we collect

We collect the following, and only when you provide it directly:

  • Booking details — full name, email address, and phone number, collected when you reserve a course seat.
  • Payment information — we do not store your M-Pesa PIN or any card details. We receive and store a payment reference number (M-Pesa receipt number) and the amount paid, provided to us by Safaricom after a successful transaction.
  • Account access — your email address is used to send you a one-time login link. We do not store passwords.
  • Reviews — if you submit a course review, we store the rating, review text, and any job title/organization you choose to include.
  • Inquiries — if you submit a corporate training quote request or an advisory services inquiry, we store your organization name, contact details, and the details of your request.
  • Newsletter — your email address, only if you subscribe.
  • Technical data — a session cookie to keep you logged in and to remember your selected country/currency. We do not use third-party advertising or tracking cookies.

3. How we use it

  • To process and confirm your course booking, and to contact you about it (schedule changes, joining instructions).
  • To issue and verify training certificates.
  • To respond to quote requests and advisory inquiries.
  • To send course update emails, but only to addresses that have subscribed — we do not add booking emails to the newsletter automatically.
  • To meet our own legal and tax obligations (e.g. retaining transaction records as required by Kenyan tax law).

We do not sell your data. We do not share it with third parties for their own marketing purposes.

4. Who we share data with

Processing a booking necessarily involves a small number of service providers:

  • Safaricom (M-Pesa/Daraja API) — processes your payment; we receive a payment reference back, not your PIN or full M-Pesa account details.
  • [YOUR EMAIL PROVIDER, e.g. SendGrid/Mailgun/Gmail] — sends booking confirmations, login links, and (if subscribed) newsletter emails on our behalf.
  • [YOUR HOSTING PROVIDER, e.g. Render] — hosts the application and database.

5. How long we keep it

[SPECIFY RETENTION PERIOD — e.g. "Booking and payment records are retained for [N] years to comply with Kenyan tax record-keeping requirements. Newsletter subscriptions are retained until you unsubscribe. Login tokens expire after 15 minutes and are not retained."] This needs a real answer based on your accountant's guidance on statutory retention periods, not a placeholder.

6. Your rights

Under Kenya's Data Protection Act 2019, you have the right to:

  • Ask what personal data we hold about you
  • Ask us to correct inaccurate data
  • Ask us to delete your data, subject to our legal obligation to retain certain transaction records
  • Withdraw consent for marketing emails at any time (unsubscribe link in every newsletter email)
  • Lodge a complaint with the Office of the Data Protection Commissioner (ODPC)

To exercise any of these rights, contact us at [YOUR CONTACT EMAIL].

7. Security

We apply reasonable technical and organizational measures to protect your data — encrypted connections (HTTPS), hashed/tokenized authentication rather than stored passwords, and restricted admin access. No system is completely immune to risk, and we'll notify affected users and the ODPC as required by law in the event of a data breach affecting your personal data.

8. Children

Our courses and services are intended for working professionals. We do not knowingly collect data from anyone under 18.

9. Changes to this policy

We may update this policy as the service changes. Material changes will be noted with an updated "Last updated" date above.

10. Contact

Questions about this policy or your data: [YOUR CONTACT EMAIL] .