Privacy Policy

This policy explains how Dapin ("the institution", "we") handles the personal data of applicants, trainees, guardians, staff and visitors to this website and the learning portal. We process personal data in line with the Data Protection Act, 2019 (Kenya) and the Data Protection (General) Regulations, 2021.

1. Who we are

Dapin is the data controller for the personal data described here. You can reach us at the institution's official email address, on the institution's help desk line, or at the institution's registered office.

2. What we collect

• Identity and contact details: name, date of birth, gender, national ID or birth certificate number, phone number, email and postal address, county.
• Academic records: previous schools and results, the course you apply for or study, attendance, assessments, marks, certificates and transcripts.
• Financial records: fee invoices, payments and M-Pesa or bank references, sponsorship and bursary details.
• Portal activity: sign-in times, lessons opened, submissions, live-class attendance and, for proctored assessments, the evidence the proctoring rules describe.
• Support records: help-desk requests and the screenshots or files you attach to them.
• Website data: pages visited, the device type and how you reached the site, and what you type into our enquiry or application forms.

3. Why we use it and the lawful basis

Under section 30 of the Act we process personal data only where there is a lawful basis:

• Contract: to process your application, admit and register you, deliver training, assess you, and issue results and certificates.
• Legal obligation: to report to regulators and examining bodies such as TVETA, CDACC, KNEC and NITA, and to keep financial records required by law.
• Legitimate interests: to keep the portal secure, prevent fraud and academic dishonesty, answer help-desk requests and improve our services.
• Consent: for marketing messages, optional communications and anything else we ask you to agree to. You may withdraw consent at any time.

4. Children

Where a trainee or applicant is under 18, we process their personal data with the consent of a parent or guardian as required by section 33 of the Act, and only in the child's best interests.

5. Who we share it with

We share only what is necessary with: examining and regulatory bodies (for example TVETA, CDACC, KNEC, NITA); sponsors, HELB or bursary providers you name; payment processors (for example M-Pesa and banks) to receive fees; SMS and email providers that deliver our messages; and the technology provider that hosts this portal on our behalf under a written data processing agreement. We do not sell personal data.

6. Transfers outside Kenya

Where a service provider stores or processes data outside Kenya, we transfer it only with the safeguards required by sections 48 to 50 of the Act and the Regulations.

7. How long we keep it

We keep personal data only as long as needed for the purpose it was collected for. Academic records and certificates are kept permanently because they must be verifiable; financial records are kept for the period tax law requires; unsuccessful applications and website enquiries are deleted or anonymised when they are no longer needed.

8. How we protect it

We use access controls, role-based permissions, encrypted connections, audit logs and staff confidentiality obligations to protect personal data, as section 41 of the Act requires. If a breach is likely to put you at risk, we will notify the Data Commissioner and, where required, you.

9. Your rights

Under section 26 of the Act you have the right to be informed of how your data is used; to access the personal data we hold about you; to object to processing; to have inaccurate or misleading data corrected; and to have data deleted where the law allows. You may also ask for your data in a portable format. Write to the institution's official email address and we will respond within the time the Regulations set.

10. Complaints

If you are not satisfied with how we handle your personal data, contact us first at the institution's official email address. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC), Kenya (www.odpc.go.ke).

11. Changes to this policy

We may update this policy. The current version is always published on this page.