Privacy Policy

1.Introduction

Harton Grange Academy ("Harton Grange Academy", "the School", "we", "us" or "our") is committed to protecting the privacy and personal data of our students, parents and guardians, prospective families, staff, job applicants, alumni, visitors and users of this website.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights available to you. We process personal data in accordance with the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021 of the Republic of Kenya, and the directives of the Office of the Data Protection Commissioner (ODPC).

By using this website or providing your personal data to us, you acknowledge that you have read and understood this Privacy Policy.

2.Who we are (Data Controller)

For the purposes of the Data Protection Act, 2019, the data controller is:

3.Scope of this policy

This policy applies to all personal data we process about identifiable individuals, including:

• Current, former and prospective students;
• Parents, guardians and emergency contacts;
• Staff, contractors, volunteers and job applicants;
• Alumni, donors and members of our wider community; and
• Visitors to this website and to our campus.

It covers data collected through this website, in person, by telephone, by email, through application and enrolment forms, and through our school management systems.

4.Personal data we collect

Depending on your relationship with the School, we may collect and process the following categories of personal data:

Students, parents and guardians

• Identification details — full name, date of birth, gender, nationality, photographs and birth certificate or identity document details;
• Contact details — postal and physical address, telephone numbers and email addresses;
• Admissions and academic records — prior schooling, assessment results, attendance, progress reports and disciplinary records;
• Health and welfare information — medical conditions, allergies, immunisation, special educational needs and safeguarding information;
• Financial information — fee payment records and billing details.

Staff and job applicants

• Curriculum vitae, qualifications, references, employment history and background checks;
• Identification, contact, next-of-kin, payroll, tax and statutory deduction information.

Website visitors

• Information you submit through enquiry, admissions or contact forms;
• Technical data such as IP address, browser type, device information, pages visited and cookie identifiers.

Health information, information relating to children and similar data are treated as sensitive personal data under the Data Protection Act, 2019 and are subject to additional safeguards.

5.How we collect your data

• Directly from you when you enquire, apply, enrol, communicate with us or use this website;
• From parents or guardians acting on behalf of a student;
• From previous schools, referees and, where lawful, background-check providers;
• Automatically through cookies and similar technologies when you use this website.

6.Purposes & lawful basis for processing

We only process personal data where the Data Protection Act, 2019 permits us to do so. We rely on one or more of the following lawful bases:

• Consent — where you have given clear consent for a specific purpose (for example, marketing communications or publishing student photographs);
• Performance of a contract — to provide educational services and administer enrolment, fees and employment;
• Compliance with a legal obligation — to meet requirements under Kenyan education, employment, tax and safeguarding laws;
• Protection of vital interests — to safeguard the life, health and safety of a student or other individual;
• Performance of a task carried out in the public interest; and
• Legitimate interests — to operate, secure and improve the School and this website, where these interests are not overridden by your rights.

We use personal data to: process admissions and enrolment; deliver and assess education; communicate with parents and guardians; safeguard student welfare; administer fees and payroll; recruit and manage staff; maintain campus security; comply with the law; and operate and improve this website.

7.Children's personal data

As a school, much of the data we process relates to children. In line with the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021, we process a child's personal data in a manner that protects and advances the best interests of the child, and we obtain the consent of a parent or guardian where consent is the lawful basis for processing. We apply appropriate mechanisms to verify age and parental authority where required.

8.Cookies & website analytics

This website uses cookies and similar technologies. Strictly necessary cookies are required for the website to function and to keep it secure. With your consent, we may also use preference and analytics cookies to remember your choices and understand how the site is used so we can improve it.

When you first visit the site, our consent banner allows you to accept or decline non-essential cookies. Your choice is stored in your browser and can be changed at any time.

Manage cookie preferences

You can also control or delete cookies through your browser settings. Disabling certain cookies may affect how parts of this website work.

9.Disclosure & sharing of personal data

We do not sell personal data. We may share personal data only where necessary and lawful, with:

• Regulatory and government bodies, including the Ministry of Education and examination bodies, where required by law;
• Service providers acting on our behalf (for example, school management software, payment processing and IT support) under data processing agreements;
• Healthcare, safeguarding or emergency authorities where necessary to protect a person's vital interests;
• Professional advisers, auditors and insurers; and
• Other parties where you have given consent or where disclosure is otherwise permitted by law.

10.Transfers of data outside Kenya

Some of our service providers may process data on servers located outside Kenya. Where personal data is transferred outside Kenya, we will do so in accordance with the Data Protection Act, 2019 — including ensuring there are appropriate safeguards, that the receiving country provides adequate data protection, or that an applicable exception (such as your consent or performance of a contract) applies.

11.How long we keep your data

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, safeguarding or reporting requirements. Student academic records and certain statutory records may be retained for extended periods in line with Kenyan law and good educational practice. When data is no longer required, it is securely deleted or anonymised.

12.How we protect your data

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. These include access controls, secure storage, staff confidentiality obligations and ongoing review of our security practices. In the event of a personal data breach that poses a real risk of harm, we will notify the Office of the Data Protection Commissioner and affected individuals as required by the Data Protection Act, 2019.

13.Your rights under the Data Protection Act, 2019

Subject to the conditions and exemptions in the Act, you have the right to:

14.Exercising your rights & making a complaint

To exercise any of your rights, please contact our Data Protection Officer using the details in the "Contact us" section below. We will respond within the timeframes required by the Data Protection Act, 2019. We may need to verify your identity before acting on a request.

15.Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. The "Effective date" and "Last reviewed" date at the top of this page indicate when it was last updated. We encourage you to review this page periodically.

16.Contact us

If you have any questions, concerns or requests regarding this Privacy Policy or your personal data, please contact: