← Back to Home
Confidentiality Policy
Last updated August 25, 2026 · Operated by BIMA Graphics, Thika, Kenya
1. Purpose
This Confidentiality Policy sets out how ShulePulse (“we”, “us”, “our”) protects the confidentiality of all information entrusted to us by schools (“Schools”, “Customers”), their students, guardians, staff, and any other data subjects whose data is processed through the ShulePulse platform. This policy applies to all information classified as confidential, whether personal data, institutional data, or proprietary business information.
2. Definition of Confidential Information
For the purposes of this policy, “Confidential Information” includes but is not limited to:
- Student Data: Names, UPI numbers, dates of birth, academic records, attendance records, disciplinary records, health information, guardian details, and any other personally identifiable information relating to students.
- Staff Data: Employment records, payroll information, performance reviews, contact details, and login credentials.
- Financial Data: Fee structures, payment records, M-Pesa transaction references, bank details, budgets, and financial statements.
- Institutional Data: School policies, internal communications, strategic plans, enrolment figures, and operational data.
- Platform Data: System architecture, security configurations, access controls, audit logs, and any proprietary code or algorithms.
- Business Information: Pricing, contracts, subscriber lists, and any information shared between ShulePulse and Schools under a non-disclosure or data processing agreement.
3. Obligations of ShulePulse
As a Data Processor under the Kenya Data Protection Act, 2019, ShulePulse commits to:
- Processing Restrictions: Process Confidential Information only on the documented instructions of the School (Data Controller), and only for the purposes of providing the ShulePulse service.
- No Unauthorised Disclosure: Not disclose, share, sell, rent, or otherwise make available Confidential Information to any third party except as required by law, or as expressly authorised by the School in writing.
- Employee Confidentiality: Ensure that all employees, contractors, and sub-processors who have access to Confidential Information are bound by appropriate confidentiality obligations, no less protective than those in this policy.
- Access Control: Implement strict role-based access controls ensuring that only authorised personnel can access Confidential Information, and only to the extent necessary for their role.
- Technical Safeguards: Maintain appropriate technical and organisational security measures, including row-level data isolation, encrypted storage, secure authentication, and regular security audits.
4. Data Isolation
ShulePulse operates a multi-tenant architecture with strict data isolation:
- Each School’s data is logically separated at the database level using row-level security (RLS) policies.
- No School can access, view, or query another School’s data through the platform.
- Administrative access to the underlying infrastructure is restricted to essential ShulePulse personnel and is subject to audit logging.
- File storage is scoped per School, with access policies preventing cross-tenant file access.
5. Sub-Processor Confidentiality
Where ShulePulse engages sub-processors (e.g. Supabase, Safaricom/M-Pesa, Africa’s Talking), each sub-processor is bound by contractual obligations to maintain the confidentiality of Confidential Information and to process it only in accordance with ShulePulse’s instructions. A current list of sub-processors is available in the ShulePulse Privacy Policy.
6. School Obligations
Schools using ShulePulse are responsible for:
- Ensuring that they have a lawful basis for providing personal data to the platform, including obtaining any required consent from data subjects (e.g. parents/guardians for student data).
- Managing user access within their own ShulePulse account, including granting and revoking access for staff and other authorised users.
- Not sharing login credentials or granting access to unauthorised individuals.
- Notifying ShulePulse promptly of any suspected or actual breach of confidentiality involving data processed through the platform.
7. Data Breach Response
In the event of a breach of confidentiality involving personal data:
- ShulePulse will notify the affected School(s) without undue delay, and in any case within 48 hours of becoming aware of the breach.
- ShulePulse will provide the School with sufficient information to enable the School to meet its notification obligations to the Office of the Data Protection Commissioner (ODPC) and affected data subjects under the DPA.
- ShulePulse will cooperate with the School in investigating and remediating the breach, including implementing corrective measures to prevent recurrence.
8. Duration of Confidentiality Obligations
The obligations of confidentiality set out in this policy apply for the duration of the contractual relationship between ShulePulse and the School, and continue for a period of 3 years after termination of that relationship, or for as long as the relevant Confidential Information remains in ShulePulse’s possession, whichever is longer.
Where ShulePulse is required by law to retain certain records (e.g. financial records), confidentiality obligations continue to apply to those records for the period of retention.
9. Return and Deletion of Confidential Information
- Upon termination of the service or on the School’s written request, ShulePulse will return or securely delete all Confidential Information within 30 days, in a commonly usable format (e.g. CSV, PDF).
- ShulePulse will provide written confirmation of deletion upon request.
- ShulePulse will not retain copies of Confidential Information beyond the agreed retention period, except where required by applicable law.
10. Remedies
Breach of confidentiality obligations may cause irreparable harm. In addition to any other remedies available at law, the non-breaching party may seek injunctive relief to prevent or stop an actual or threatened breach of this policy.
11. Changes to This Policy
ShulePulse may update this Confidentiality Policy from time to time. Material changes will be communicated to Schools in advance where practicable. The latest version of this policy will always be available at master.shulepulse-landing.pages.dev/confidentiality.html.
12. Contact
For questions about this Confidentiality Policy, contact:
ShulePulse