Skip to main content

Mpesa Foundation Academy Privacy Notice

Introduction

In the course of providing services to you, Mpesa Foundation Academy, P.O. Box 7954 – 01000, Kenya (hereinafter “MFA”, “the Academy”, or “we”), processes personal data relating to you and your children. As the data controller, MFA is committed to protecting your privacy and complying with applicable data protection regulations.

This Privacy Notice (“Notice”) outlines how we collect, use, store, and share personal data, and the steps we take to safeguard it. This Notice applies to all personal data collected by or on behalf of MFA, whether through physical (e.g. forms, written communication) or digital means (e.g. information systems, email, portals).

We may issue separate notices when collecting additional personal data for specific purposes. MFA reserves the right to amend this Notice and will communicate changes accordingly. We recommend you review this Notice regularly.

 

  1. How We Collect Your Personal Data

We collect personal data in the following ways:

  • Directly from you or your child through application forms, health and consent forms, communication via our parent and student portals, meetings with staff, etc.
  • From third parties such as previous schools, medical professionals, or via public sources like social media.
  • Through MFA’s own systems or data processors, including classroom assessments, CCTV, and other forms of evaluation.

 

  1. Why We Use Your Personal Data

We collect and process personal data, including special category data, to provide a safe and supportive learning environment and to deliver high-quality education services. Specific purposes include:

  • Admission, enrolment, and academic progression
  • Child safeguarding and legal compliance
  • Supporting students’ academic, pastoral, and psychological wellbeing
  • Customising and improving learning experiences
  • Supporting transitions to other educational institutions
  • HR support and staff development
  • Operational planning, budgeting, and strategic development
  • Meeting statutory reporting and legal obligations
  • Maintaining community relations and conducting fundraising activities
  • Communicating updates and school-related information
  • Ensuring security and safety, including CCTV surveillance
  • Handling historical records and alumni services

 

  1. Legal Bases for Processing

Our data processing is primarily based on the contract entered into with you as part of the educational service. In addition, we may process data based on:

  • Legal obligations
  • Vital interests of the data subjects
  • Legitimate interests of the Academy (e.g. maintaining a safe environment or alumni engagement)
  • Consent, where required

 

  1. Categories of Personal Data We Process

We may process the following categories of personal data:

  • Identity and contact data (e.g. name, ID number, address)
  • Special categories (e.g. medical information, ethnicity)
  • Academic and behavioural data (e.g. assessments, SEN needs, counselling records)
  • Attendance data
  • IT usage logs and audit trails
  • Communication records (e.g. emails, letters)
  • Photographs and video recordings (see Sections 8 & 9)

Special Categories of Data

Sensitive data is processed only with explicit consent or where legally permitted to protect an individual’s vital interests or those of others.

 

  1. Data Storage

We retain personal data only as long as necessary to fulfil the purposes outlined in this Notice or as required by law. Data is stored on secure local servers and authorised third-party platforms (e.g. PowerSchool), some of which may be located outside Kenya.

 

  1. Sharing and Transfers

We share data:

  • Internally within MFA for administrative and educational functions
  • Externally with:
    • Future schools, universities or educational authorities
    • Health professionals, social services, or government bodies where required
    • Providers of IT and education support systems
    • Law enforcement where legally required

Transfers are conducted with appropriate safeguards in place.

 

  1. Cookies

Our website may use cookies to enhance your experience. You can control cookie usage via your browser settings, but doing so may affect functionality.

 

  1. CCTV Surveillance

MFA uses CCTV for safety and security. Footage is retained for 7 days unless required for investigations or legal purposes.

 

  1. Photography and Videography

Photographs and videos may be taken for:

  • Educational records (e.g. yearbooks, class activities)
  • Health and safety purposes (e.g. allergy alerts)
  • Marketing and promotional use (with prior consent)

MFA retains copyright of all such media and may take legal action against unauthorised use.

 

  1. Your Rights

You have the right to:

  • Access and correct your data
  • Request deletion or restriction of data
  • Object to processing
  • Withdraw consent (where processing is based on consent)
  • Request data portability
  • Lodge a complaint with the appropriate regulatory body

To exercise these rights, please contact the MFA Communications Office at communications@mpesafoundationacademy.ac.ke.

© Mpesa Foundation Academy 2025. All Rights Reserved.
Last Updated: April 2025