1. Introduction & Scope
Insight ("we," "our," or "us") is committed to protecting the privacy of all users of our school management platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website (insightapp.co.ke) and our school management software services (collectively, the "Platform").
This policy applies to:
- School Administrators - Who manage the platform for their institutions
- Students - Whose academic records are managed through the platform
- Website Visitors - Who browse our marketing website
By using our Platform, you agree to the collection and use of information in accordance with this policy. We comply with the Kenya Data Protection Act, 2019 and other applicable data protection regulations.
3. How We Use Your Information
We use the collected information for the following purposes:
- Platform Operation: To provide, maintain, and improve our school management services.
- Account Management: To create and manage user accounts, authenticate users, and provide customer support.
- Academic Management: To process student records, generate reports, track attendance, and manage academic workflows.
- Analytics & Improvement: To analyze usage patterns, identify bugs, and improve platform performance and features.
- Security: To detect and prevent fraudulent activities, unauthorized access, and security breaches.
- Legal Compliance: To comply with applicable laws, regulations, and legal processes.
- Marketing (with consent): To send newsletters, product updates, and promotional materials (you may opt out at any time).
4. Data Sharing & Disclosure
We do not sell your personal information to third parties. We may share data in the following circumstances:
- Within Your School: Data is shared among authorized users (administrators, teachers) within the same school as configured by school administrators.
- With Parents/Guardians: Student information is shared with authorized parents/guardians as determined by the school.
- Service Providers: We engage trusted third-party service providers for cloud hosting, email services, analytics, and payment processing.
- Legal Requirements: We may disclose information if required by law, court order, or government regulation.
- Business Transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of the transaction.
5. Data Security Measures
We implement industry-standard security measures to protect your data:
- Encryption: Sensitive data is hashed in transit for enhanced security.
- Regular Audits: Security audits and vulnerability assessments conducted quarterly.
- Backup & Recovery: Automated daily backups with disaster recovery protocols.
- Data Center Security: Our cloud infrastructure is hosted in certified data centers.
- Employee Training: Users undergo training to improve their familiarity with the system.
6. Data Retention Policy
We retain your information for as long as necessary to fulfill the purposes outlined in this policy:
- Active Accounts: Data is retained while your account is active.
- Inactive Accounts: After 24 months of inactivity, accounts are reviewed for potential deletion.
- Student Records: Retained for the duration required by educational regulations (typically 5-10 years after graduation).
- Backup Data: Retained as a safety precaution against disasters.
- Upon Deletion Request: Data is permanently deleted within 30 days of a verified deletion request.
7. Your Rights & Choices
Under the Kenya Data Protection Act, you have the following rights:
- Right to Access: Request a copy of your personal data we hold.
- Right to Rectification: Correct inaccurate or incomplete data.
- Right to Erasure: Request deletion of your data.
- Right to Restrict Processing: Limit how we use your data.
- Right to Data Portability: Receive your data in a structured format.
- Right to Object: Object to processing based on legitimate interests.
- Right to Withdraw Consent: Withdraw consent at any time.
To exercise these rights, contact us at privacy@insightapp.co.ke. We will respond within 30 days.
8. Children's Privacy
Our platform is designed for use by educational institutions. Student data is managed by schools with appropriate parental consent as required by law. We do not knowingly collect personal information from children under 13 without verified parental consent through their school.
9. International Data Transfers
Your data is primarily stored and processed in Kenya. Where data is transferred internationally, we ensure adequate safeguards through Standard Contractual Clauses (SCCs) as required by data protection laws.