MARION SCHOOLS

PRIVACY POLICY

1. INTRODUCTION

Welcome to Marion Schools’ Privacy Policy also known as “Privacy Notice.” We appreciate you taking the time to read this Policy. Marion Schools (comprising of the Marion Preparatory & Senior School-Nairobi county and the Marion FarmHouse-Kiambu county) is referred to in this Privacy Policy as “the School”, “We”, “Our” or “Us”. We are committed to ensuring that your personal data is collected and used lawfully and transparently. This is our Privacy Policy which may be accessed from our webpage at https://marionschools.sc.ke/ or may be obtained as a hard copy when you submit personal data at our campuses located at Kahawa West and Kiambu.

We process your personal data according to the provisions of the Data Protection Act, 2019 (‘the Act’), The Data Protection General Regulations 2021, The Data Protection (Registration of Data Controllers and Data Processors) 2021, The Data Protection (Complaints Handling and Enforcement Procedures) Regulations 2021 as may be amended from time to time, and any other regulations made thereunder (collectively, “the Data Protection Legislation”). We understand that your privacy is important to you and we care about how your personal data is used. We respect and value the privacy of all our learners, parents, visitors, and users and we will only collect and use personal data in ways that are described here, and in a way that is consistent with our obligations and your rights under the Data Protection legislation (as defined hereinbelow).

2. INFORMATION ABOUT US

Marion Schools (comprising of the Marion Preparatory & Senior School-Nairobi county and the Marion FarmHouse-Kiambu county) are unique and multidisciplinary schools with campuses in Kahawa West and Kiambu. Guided by our motto, ’Inspired by God for Excellence,’ we offer a rich, wholesome, and balanced curriculum in the four domains of life: Spiritual, Emotional, Physical, and Intellectual. We have fully embraced the new competency-based curriculum (CBC), and presently, our bold staff is continuously working towards being a CBC hub that ensures our learners are competent and value-led to excel in the 21st century. We are an inclusive community for Special Needs Education (SNE) learners and differently-abled staff. We are planning and looking forward to pioneering the CBC Junior Secondary School.

The School is a “DATA CONTROLLER” in relation to the processing activities described below. This means that we determine the purpose and means of Processing your personal data (or personal data you provide). The School is registered as a “DATA CONTROLLER” with the Office of the Data Protection Commissioner. To contact us, you can visit any of our campuses, Kahawa West Campus or Kiambu Campus, connect with us through any of our social media platforms, or call us on 0722575887, 0735575887, 0777706034, 0722655698 and 0777706017.

3. WHAT IS THE PURPOSE OF THIS PRIVACY POLICY?

To perform our functions, we need to collect certain types of personal information from various people including learners, parents/guardians, visiting speakers, alumni, website users or any other relevant individuals (referred to as “you” or “your” in this Privacy Policy).

Therefore, this Privacy Policy:

sets out the types of personal data that we collect about you;
explains how and why we collect and use your personal data;
explains how long we keep your personal data;
explains when, why, and with whom we will share your personal data;
sets out the legal basis we have for processing your personal data;
explains the eﬀect of refusing to provide the personal data collected;
explains the diﬀerent rights and choices you have when it comes to your personal data; and
explains how we may contact you and how you can contact us about your personal data or any other related subject.

4. WHO DOES THIS PRIVACY POLICY APPLY TO?

This Privacy Policy applies to the personal data of:

Parents/Guardians
Learners/Pupils
Visitors/ Visiting Speakers
Alumni
Website

To be clear, our employees’ or third-party vendors’ personal details are handled in line with the terms of the employment agreement or contractual relationships, or our separate policies that we provide, as relevant, independent of this Privacy Notice. Further, it is important to point out that we may amend this Privacy Notice from time to time. Please visit our website to stay updated.

5. TYPES OF PERSONAL DATA WE COLLECT ABOUT YOU

Personal data refers to any information about you that enables you to be identified as an individual such as your name, contact details, and identification numbers but it also covers less obvious information such as electronic location data, and other online identifiers.

We collect Personal Data directly from you as well as from other available sources to the extent permitted by law. We endeavour to only collect Personal Data that is necessary for the purpose(s) for which it is collected and to retain such data for no longer than necessary for such purpose(s). Subject to applicable law and practice, the categories of Personal Data that we process are: –

Data Subject	Personal Data Collected
Learners/Pupils (Current & Alumni)	· Names, nationality, date of birth, sex, religion, nationality, registration/enrolment records, attendance records, academic records, extra-curricular records, boarding records, learning support records, health records, ﬁnancial records relating to school fees or other payments, disciplinary records, safeguarding records, dietary records, photographs and videos taken during school events, school trip records, bursary records, scholarship records, library records and any communication with the School;· Internet and IT use records, CCTV recordings when on the School premises, cookies and online identiﬁers collected when using any internet-enabled tools to access our systems such as the website, bus trip information through GPS devices ﬁtted in school buses and information received from schools that a learner/pupil transfers from to join our School
Parents/ Guardians	· Names, email addresses, telephone numbers, occupation, signatures, bank details, fee payments history, photos and videos taken during school activities or events, location address, complaints or any communication with the School. · Cookies and online identiﬁers collected when using any internet enabled tools to access our systems such as the website, CCTV recordings and car registration numbers when on the School premises.
School Visitors/ Visiting Speakers	· Names, Phone Numbers, IDs, Car registration numbers, time of visit and purpose of visit and CCTV recordings when on the School premises
Website Users	· Any information filled in the website contact form such as Names, email address, or any other contact information, cookies and other online identiﬁers.

This list is not exhaustive but indicative of the information recorded. The sensitive personal data that we collect include; health status, biometrics, nationality, conscience, beliefs, gender, marital status, and family details such personal information of the parents/guardians. However, we will only collect sensitive data about you if we have your explicit consent, or if authorized under the Data Protection Legislation.

HOW AND FOR WHAT PURPOSE DO WE COLLECT YOUR PERSONAL DATA?

Learners/Pupils: – we collect personal data directly from you while you are learning at our We may also collect data indirectly such as when parents or guardians ﬁll out our school registration and/or enrolment forms, when our CCTV systems capture images of you while on the School premises, and when using any of our IT systems or platforms.
Parents/Guardians: we collect personal data directly from you in the course of your child’s learning at our school. We may also collect data indirectly such as when our CCTV systems capture images of you while on our premises, and when using any of our IT systems or

Alumni pupils: we collect personal data directly from you while you are learning in our school and the personal information will be stored in our databases for a limited period that is necessary for carrying out our legal obligations.

School visitors – we collect personal data directly from you when you visit our school. We may also collect personal data indirectly such as when our CCTV systems capture images of you while on our premises.
Website Users – we collect data directly from you when you visit our website, and input contact information on the website. We may also collect data indirectly such as cookies and other online identiﬁers.

Where we collect indirectly from you, we will endeavour to inform you within fourteen (14) days of such collection.

We use your personal information in the following ways: –

Data Subject	Purpose of Collection
Learners/Pupils	· To inform you about our school and the services that we offer· To enroll and onboard you to our school · To provide education services, and to monitor and report on the learner/pupil’s performance. · To provide extra-curricular activities · To monitor and report on your attendance record · To keep you safe as per our child protection policies · To develop fee statements, invoices, and any other necessary financial information. · To meet your dietary requirements, and healthcare needs · To monitor the use of the Schools’ IT and communications systems in accordance with the Schools’ acceptable use policies. · To market or promote our school- however, where we do this, we must ﬁrst seek your parents’ consent)
Parents/Guardians	· To communicate with you regarding your child’s learning or well-being in school;· To understand your child’s medical history and provide appropriate health care; ▪ To share fee statements, invoices, or related reports; ▪ To invite you to participate in our School Community initiatives and events ▪ To receive and handle your complaints; and ▪ To market or promote our school- however, where we do this, we must ﬁrst seek your consent)
Alumni	▪ To invite you to participate in our School Community initiatives and events; and▪ To market or promote our school (where we do this, we must ﬁrst seek your consent or your parent’s consent, if you are under the age of 18 years or your consent)
School Visitors/ Speakers	▪ To grant you access to our school premises; and▪ To keep our pupils, staﬀ, and School safe.
Website Users	▪ To optimize our website and enhance user experience; and▪ To collect your expressions of interest to join our school, or any other information that you want to communicate to the School online.

7. OUR LAWFUL BASIS FOR PROCESSING YOUR PERSON DATA

Marion Schools processes your personal data on the following lawful basis;

Consent; where you consent to processing for one or more speciﬁed According to the law, we can only process children’s data where we have consent from the guardian or parent. We also rely on consent where we need to use your data for marketing purposes or transfer it outside Kenya. Additionally, when we rely on consent, we do so to the extent that it is permissible in law, and when processing is based on consent, you have the right to withdraw the consent at any time;
Performance of a contract; where the processing is necessary for the performance of a contract to which you are a party or to take certain steps at your request before entering a contract;
Compliance with a legal obligation; where processing is necessary for compliance with any legal obligation to which Marion Schools is subject;
Vital Interest; where the processing is necessary to protect your vital interests or another person/individual;
Public Interest; where the processing is necessary to enable us to perform a task carried on in public interest or the exercise of oﬃcial authority vested in the School;
Legal Obligation; where processing is necessary to carry out the School’s legal obligation;
Legitimate Interest; where processing is necessary in meeting the legitimate interests pursued by the School or by a third party to whom the data is disclosed, except if the processing is unwarranted having regard to the harm and prejudice to your rights and freedoms or legitimate interests; and
For purposes of historical, statistical, journalistic, literature, and art or scientiﬁc

8. SHARING & INTERNATIONAL DATA TRANSFER

All data sharing will be undertaken in line with the Data Protection Legislation and any other relevant law. Where appropriate, we may share your personal data in various ways and for various reasons with:

Appropriate personnel within Marion Schools.
Child Protection Oﬃcers, Police, or other legal authorities when we believe in good faith that the law or other regulations require us to share this personal
Third-party service providers who perform functions on our behalf including IT systems providers, medical or insurance service providers, and security

Where we share your data, we ensure that there are appropriate data processing or data sharing agreements (or similar protections) in place.

We do not transfer your data outside Kenya. However, should the need arise, we will only transfer your personal data outside Kenya where such transfer is compliant with the provisions of the Data Protection Legislation.

9. HOW DO WE SAFEGUARD YOUR PERSONAL DATA?

The School has taken appropriate technical, administrative, and procedural security measures to protect the personal data from misuse, unauthorized access or disclosure, loss, alteration, or destruction. These measures include:

Technological safeguards;

Risks	Safeguard Measures
Email & Internet Fraud	· Latest Kaspersky Anti-Viruses and Firewall· Back up disaster recovery · Use of email authentication protocols such as multifactor authentication system
Malware Attacks such as Trojans, Spyware, Adware, Scareware, Ransomware, Botnets, Key Logger, Worms, Rootkits, etc	· Kept our software updated· Enabled firewall protection · Installed anti-virus and anti-malware software.
Theft of Financial or card payment data	· Access to data via secure log-in
Password Theft	· Encryption of password· Use of Biometric login · Use of stronger passwords. · Multiple factor authentication

Organizational safeguards such as; lock and key safe for special category data, access control, training and awareness programs on security and privacy, to ensure employees understand the importance and means by which they must protect personal data, as well as through data protection and security policies and Notice standards that govern how the School treats personal

10. HOW LONG DO WE KEEP YOUR PERSONAL DATA FOR?

We will only keep your personal data for as long is necessary to achieve the purposes for which it was required unless the retention is required or authorized by law, reasonably necessary for a lawful purpose, you have consented to longer retention periods or if the personal data is required for statistical, journalistic, literature and art or research purposes. We maintain an up-to-date retention schedule. Where the information is past the retention period, we use secure methods to dispose/delete the personal data.

11. WHAT HAPPENS IF YOU DO NOT PROVIDE US WITH THE PERSONAL DATA WE REQUEST OR ASK THAT WE STOP PROCESSING YOUR PERSONAL DATA?

Our ability to perform our obligations derived from your business relationship with us and our ability to comply with our legal and contractual obligations sometimes depends on Us accessing and being able to use certain personal data. Therefore, and depending on the circumstances, if you do not provide Us with the personal data we request or if you ask that we stop processing your personal data, we may not be able to perform our contractual obligations, we may be in breach of one or more legal obligations applicable to Us. In some cases, if we are not allowed to process your personal data, this may result in Us being required to terminate our work relationship with you.

12. WHAT RIGHTS DO YOU HAVE OVER YOUR DATA?

The Data Protection Act accords you with several rights over your personal data.

Right to data portability: you have the right to receive personal data concerning you in a structured, commonly used, and machine-readable format and to transmit the data to another data controller without hindrance. You also have the right, where technically possible, to have personal data transmitted directly from us to another data controller or data processor;
The right to be informed about our collection and use of your personal data – this Privacy Policy should tell you everything you need to know, but you can always contact us to find out more or to ask any questions.
The right to access the personal data we hold about you.
The right to have your personal data corrected if any of your personal data held by us is false, erroneous, or misleading.
The right to ask us to delete or otherwise dispose of any of your personal data that we hold.
The right to restrict (i.e. prevent) the processing of your personal data;
The right to object to us to our use of your personal data for a particular purpose or purposes;
The right to withdraw consent- meaning if we are relying on your consent as the lawful basis for using your personal data, you are free to withdraw that consent at any time;
The right to data portability- meaning you have a right to request your personal data, which you have provided to us in a structured and commonly used format for your use across different services;
Rights relating to automated decision-making and profiling – we do not use your personal data for automated decision-making or profiling.

You can raise a complaint about our processing with the Regulator i.e., the Office of the Data Protection Commissioner (ODPC) in Kenya. You may also contact us via our provided contacts for any concern that you may have about the processing of your personal data.

13. HOW TO EXERCISE YOUR RIGHTS

If you wish to exercise any of the rights outlined above, please write an email to the Data Protection Oﬃcer (DPO) at marionschools@marionschools.sc.ke

We will endeavor to answer all questions via email within the timelines stipulated in
If the provision of the data involves the data of third parties, these third parties can be asked in advance whether they have objections to the
We may ask for identiﬁcation because we need to know for certain whether we are issuing the data to the right
In some cases, we will not be able to comply with your request. If this happens, you will be duly notiﬁed.

14. HOW DO WE USE THE COOKIES?

We use them to track your activity to help ensure you get the smoothest possible experience when visiting our website. We can use the information from cookies to ensure we present you with options tailored to your preferences on your next visit. We can also use cookies to analyse traﬃc and for advertising purposes.

If you want to check or change what types of cookies you accept, this can usually be altered within your browser settings. When you ﬁrst visit our website(s) you will be asked to choose what kind of cookies you want to receive. We ask for your prior consent for some cookies through our Cookies Preference Center while strictly necessary cookies will be set within our legitimate interests. You may also set your cookie preferences on your browser’s privacy settings. However, rejecting all cookies through your browser’s privacy settings means that you may not be able to take full advantage of all our website’s features. Each browser is diﬀerent, so check the “Help” menu of your browser to learn how to change your cookie preferences.

You can update your given consent at any time by visiting our Cookie Preference Center which can be found by clicking on the “Cookie Preferences” link either on the top or bottom of our website. Instead of using our Cookie Preference Center you may choose to opt-out to cookies which are not strictly necessary to perform basic features of our site by changing your browser settings. If you use our Cookie Preference Center to update your choice of cookies, please note that this does not result in deletion of already placed cookies on your device. So, if you want to delete such cookies you may delete them in your browser’s privacy settings.

15. HOW DO YOU CONTACT US?

If you suspect any misuse or loss of or unauthorized access to your personal data, please let us know immediately by sending us an email at marionschools@marionschools.sc.ke, calling us at +254722523672, or sending us a letter to Postal address, 72736 – 00200, Nairobi, Kenya,

The Marion Schools

Blessed.Balanced.Bold.Beautiful