Smart Brains Kenya — Privacy Policy

About Smart Brains Kenya

Our platform supports Admin, School, Tutor, Student, and Parent users, and our courses include Foundations of Coding, Scratch Programming, HTML, CSS, Android App Development, and Robotics Projects.

Your privacy matters to us. We collect only the personal data needed to deliver coding and robotics education to students through their school, and we do not sell personal data or use it for purposes unrelated to delivering and improving our Services. Please read this Policy carefully before using the Platform. Questions can be sent to info@smartbrainskenya.com.

SBK is registered with the Office of the Data Protection Commissioner, Kenya (Registration No. 978-8087-5DF8).

Our Privacy Principles

• We collect the minimum personal data needed to deliver coding and robotics education to students through their school.
• We do not sell personal data, and we do not display advertising to Students on the Platform.
• Any data we share with schools, parents, or partners about student progress is limited to what is needed for that relationship, and data shared with evaluators or partners beyond the School itself is de-identified or aggregated.
• We hold our service providers and school partners to data protection standards no less stringent than our own.
• We give students, parents, and schools the ability to access, correct, or request deletion of their personal data, subject to the Kenya Data Protection Act 2019.

Scope of This Policy

This Privacy Policy applies to the Smart Brains Kenya platform and associated services, including:

• https://www.smartbrainskenya.com (corporate site)
• https://application.smartbrainskenya.com (the learning platform used by Admins, Schools, Tutors, Students, and Parents)

SBK Connect, our internal messaging and support platform, is used by SBK staff and Tutors for internal coordination; it is covered by this Policy solely with respect to the Tutor/Employee data described in Section 5, not as a public-facing service.

By using our Services, you agree to the data practices described in this Privacy Policy, which is incorporated into our Terms and Conditions.

Quick Reference

• How We Collect and Use Information
• How We Share or Transfer Information
• How We Protect Information
• Your Rights — Access, Correct, Update, or Delete Your Information
• School Users and Student Records
• Children's Privacy Notice
• Links to Other Sites and Services
• Advertising and Sale of Data
• How Long We Keep Information
• Cross-Border Data Transfers
• Changes and Updates to This Policy
• Contacting Us

How We Collect and Use Information

We collect personal data in three ways: (1) information provided directly by Users or Schools, (2) information collected automatically as the Platform is used, and (3) information received from partner schools or the third-party course tools described in Section 5.3. The categories, sources, and purposes are set out below.

5.1 Data We Collect

We do not collect biometric, financial (beyond Tutor payroll details), or health data from students.

5.2 Course Progress and Student Work

As a Student progresses through a course, we collect and store their progress (lessons completed, attempts, time to completion, quiz/assessment answers) and any code, projects, or apps they create — including in our own in-house Android App Development curriculum. This data is shown to the Student and their Tutor to track progress, identify topics needing support, and allow the Student to resume where they left off. In de-identified or aggregate form, it also helps us improve course content.

5.3 Third-Party Tools Used In Our Courses

Our Robotics Projects course and our school competitions use a small number of third-party tools. We selected these deliberately to minimise the personal data collected:

• Tinkercad (Autodesk) — used for robotics simulations. Only the Student's first name is entered. Designs and simulation data are saved and stored under Smart Brains Kenya's own institutional Autodesk account, not an individual account belonging to the Student — meaning Autodesk does not hold a separate personal account or profile for any Student.
• mBlock — used to write and upload robotics code to physical kits. mBlock does not require a login and no Student data is entered into or collected by it.
• Quizizz — used for competition quizzes. Students enter their name and school name directly into Quizizz to take part. SBK does not sell this data. Because Students enter this information directly into Quizizz's own platform, its collection and storage there is also subject to Quizizz's own privacy terms.

We do not use any other third-party tool that collects personal data from Students as part of course delivery.

5.4 Technical Information and Cookies

As the Platform is used, we automatically collect technical information such as IP address, browser type, device information, referring/exit pages, and the dates and times of use. This helps us secure the Platform, troubleshoot issues, and understand usage patterns. We may use cookies or similar technologies for this purpose; cookie-specific disclosures are included here rather than in a separate notice.

5.5 Non-Curriculum Communications

If you contact us for support, subscribe to updates, or take part in an event or promotion, we collect the information needed for that purpose (e.g., name, email, school name) and may send you occasional related communications. All non-essential emails include an unsubscribe option.

How We Share or Transfer Information

We do not sell personal data or grant rights to it to other organisations for their own use. We share personal data only in the circumstances below.

• Service providers: We use third parties for hosting, email delivery, analytics, payment processing, and the course tools described in Section 5.3 (Tinkercad/Autodesk, mBlock, Quizizz). They may only use the data to perform the service we've contracted them for, or, in Quizizz's case, as described in Section 5.3.
• Tutors and Schools: A Student's Tutor and their School (via authorised school representatives) can see that Student's account information, attendance, and course progress, for the purpose of managing their education.
• Parents/Guardians: Parents can see their own Child's progress, attendance, and account information.
• Reporting partners: Where we report participation or impact statistics to partners such as the Mastercard Foundation, we share only de-identified or aggregated data — never data that identifies an individual Student, Parent, or Tutor.
• Legal and safety reasons: We may disclose personal data where required by law, or where we have a good-faith belief it is necessary to protect the rights, property, or safety of SBK, our Users, or others.
• Business transfers: If SBK is acquired, merged, or sells its assets, personal data may transfer as part of that transaction, under the same protections described in this Policy.

How We Protect Information

We maintain administrative, technical, and physical safeguards designed to protect personal data:

• Technical: encryption of data at rest and in transit, firewall and anti-malware protection, access controls and multi-factor authentication for staff, regular security patching, secure backups, and user activity monitoring.
• Organisational: data protection and cybersecurity training for staff, documented data protection policies, confidentiality agreements for employees and contractors, restricted access on a need-to-know basis, and incident response procedures.
• Physical: locked storage for devices holding personal data, restricted access to training equipment, visitor logs, surveillance at our premises, and secure disposal (shredding) of printed materials.

Your Rights and Choices

Under the Kenya Data Protection Act 2019 (“DPA”), you have the right to:

• Be informed about how your personal data is used;
• Access your personal data;
• Correct (rectify) inaccurate data;
• Request erasure of your data (“right to be forgotten”);
• Restrict how your data is processed;
• Receive your data in a portable format;
• Object to processing.

Deleting your Child's account: Parents can request deletion of their Child's account directly from the Platform using the “Request Account Deletion” option. Once submitted, the account is deleted and detached from the Parent's account. No separate request to the School is required.

For all other rights above, contact info@smartbrainskenya.com. We will respond within the timeframes required by the DPA. If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner (www.odpc.go.ke).

School Users and Student Records

SBK's Services are delivered through contracted partner schools. When a School enrols its students with SBK, the School's authorised representatives can access reporting on their students' progress and attendance at the student, class, or school level. Parents may request access, correction, or deletion of their Child's data directly from SBK at any time, as described in Section 8 — this does not need to be routed through the School first.

Children's Privacy Notice

Anyone under 18 is considered a Child for the purposes of this Policy and requires the consent of a parent or legal guardian to use the Platform. Where a School registers a Child's account on behalf of a parent, the School represents that it has obtained the necessary parental consent. We collect only the Child data described in Section 5, and we do not use Child data for targeted advertising, behavioural profiling, or any commercial purpose outside delivering and improving our Services.

Links to Other Sites and Services

Our Services may link to or use third-party tools, including Quizizz for competitions (see Section 5.3). We are not responsible for the privacy practices of third-party sites, and we encourage Users to review their privacy policies before providing any information directly to them.

Advertising and Sale of Data

We do not sell personal data, and we do not display third-party advertising to Students on the Platform.

How Long We Keep Information

We keep personal data only for as long as needed for the purposes described in this Policy. The periods below are SBK's data retention schedule:

Cross-Border Data Transfers

The Platform (application.smartbrainskenya.com) is currently hosted on Amazon Web Services in the US East region, outside Kenya. Where personal data is transferred outside Kenya — including this hosting arrangement, and any other cloud or service provider we use — we put appropriate safeguards in place as required by the Kenya Data Protection Act 2019 and take account of ODPC guidance on cross-border transfers.

SBK is reviewing whether the Data Protection (General) Regulations 2021's data localisation requirement for basic education data applies to our processing and, if so, will maintain at least one serving copy of the relevant data in a data centre located in Kenya. This review is in progress as of the date of this Policy.

Changes and Updates to This Policy

We may update this Privacy Policy from time to time. We will post the revised Policy with an updated revision date on our Services, and where changes are material, we will notify Users by email. Where changes relate to the collection or use of Student data, we will notify Schools before the changes take effect.