Placeholder document. This is a generic starting template, not a substitute for actual legal review under Kenya's Data Protection Act, 2019 (and any other applicable law). Have this reviewed and finalized before relying on it with real student, parent, and staff data.
Last updated: August 2026
The Platform processes personal data entered by schools, including but not limited to: student names, dates of birth, guardian contact details, attendance and academic records, fee payment records, staff records, and — where ElimuPay is used — instalment payment history.
Data is collected and processed solely to provide the school management and fee-financing services each school (as data controller for its own students, parents, and staff) has engaged us to provide. MoJamoza Technologies acts as a data processor on behalf of each school for that school's own data.
Every school's data is isolated from every other school's — enforced at both the database and application layer. One school can never access another school's records.
Fee payments are processed via Safaricom's M-Pesa Daraja API. Where ElimuPay financing is used, relevant fee-balance and repayment data is shared with the licensed financing partner facilitating that specific plan — never with any other party.
Under Kenya's Data Protection Act, 2019, data subjects (or their guardians, for minors) have the right to access, correct, and request deletion of their personal data, subject to any record-keeping obligations a school is legally required to maintain. Requests should be directed to the relevant school in the first instance, or to us directly.
Data is retained for as long as a school's account is active, plus any additional period required by applicable record-keeping law, after which it is deleted or anonymized on request.
Questions about this policy or a data request: info@mojamoza.com