Last updated August 25, 2026 · Operated by BIMA Graphics, Thika, Kenya
ShulePulse (“we”, “us”, “our”) is a school management platform providing software services to schools (“Schools”, “Customers”) in Kenya. This policy explains how we collect, use, store, and protect personal data in connection with the ShulePulse platform, in accordance with the Kenya Data Protection Act, 2019 (“DPA”).
For data belonging to students, guardians, and staff, the School using ShulePulse is the Data Controller. ShulePulse acts as the Data Processor, processing that data solely on the School’s instructions as set out in our Data Processing Agreement with each School.
| Category | Examples | Legal Basis |
|---|---|---|
| Student records | Full name, UPI number, date of birth, class/stream, guardian details, admission records, photo | Contract (school enrollment) / Legitimate interest |
| Academic data | Grades, exam results, report cards, exam papers | Contract / Legitimate interest |
| Financial data | Fee structures, payment history, M-Pesa transaction references | Contract |
| Guardian/parent data | Name, phone number, relationship to student | Contract / Legitimate interest |
| Staff data | Name, role, contact details, login credentials, teacher photos | Contract (employment relationship with school) / Legitimate interest |
| Usage data | Login timestamps, role switches, device/browser metadata | Legitimate interest (security, audit trail) |
We rely on the following third-party services to operate the platform. Each is bound by its own data protection terms.
| Sub-Processor | Purpose | Location / Notes |
|---|---|---|
| Supabase | Database, authentication, file storage | Hosted infrastructure outside Kenya |
| M-Pesa (Safaricom / Daraja API) | Fee payment processing | Kenya |
| Africa’s Talking | SMS notifications | Kenya |
Some personal data may be stored or processed outside Kenya through our infrastructure providers. Where this occurs, we rely on the sub-processor’s own compliance safeguards (such as standard contractual clauses or equivalent certifications) as the basis for transfer, consistent with the DPA’s cross-border transfer requirements.
Personal data is retained for as long as a School’s account remains active, and for a reasonable period thereafter as agreed in the Data Processing Agreement, or as required by applicable law. Upon a School’s request to terminate services, data is deleted or returned in accordance with the DPA terms agreed with that School.
Under the DPA, individuals have the right to: access their personal data; request correction of inaccurate data; request deletion where legally permissible; object to certain processing; and lodge a complaint with the Office of the Data Protection Commissioner (ODPC).
Because Schools are the Data Controllers, requests regarding a student’s, guardian’s, or staff member’s data should generally be directed to the relevant School in the first instance. We support Schools in fulfilling these requests through the platform’s data export and deletion tools.
In the event of a data breach affecting personal data, we will notify affected Schools without undue delay, and will support Schools in meeting their own notification obligations to the ODPC and affected data subjects as required under the DPA.
ShulePulse processes personal data belonging to minors (students) as a core function of school administration. This data is provided and controlled by the School (acting under its educational mandate), not collected directly from children by ShulePulse. Schools are responsible for ensuring they have an appropriate basis for providing student data to the platform.
For questions about this policy or to exercise a data protection right, contact:
We may update this policy from time to time. Material changes will be communicated to Schools in advance where practicable.
ShulePulse