ConfiLearnData protection: DPO, school agreement and DPIA
Last updated 29 October 2026
Data Protection Officer
Maximillian Ndeti is ConfiLearn's Data Protection Officer. Contact: hello@confilearn.co.ke (subject "DPO"). The DPO handles data subject requests, breach notifications and questions from schools and the Office of the Data Protection Commissioner.
Template: school data processing agreement (summary)
TEMPLATE, to be signed per school. 1. Parties: the school (controller) and ConfiLearn (processor). 2. Subject matter: running the school's ConfiLearn workspace (admissions, classes, attendance, marks, reports, fees and messages). 3. Data: learner, parent and staff identity and contact details, and academic, attendance and fee records. 4. ConfiLearn acts only on the school's documented instructions, keeps staff under confidentiality, uses the sub-processors listed in the Privacy Policy and gives 30 days' notice of changes, applies access controls, encryption in transit and audit logs, helps the school answer data subject requests, notifies the school of a personal data breach without undue delay (target 48 hours), and returns or deletes the school's data within 90 days of the end of the contract. 5. Cross-border transfers rely on contractual safeguards under the Data Protection Act, 2019. 6. The school may audit compliance once a year on reasonable notice.
DPIA draft (v0.1, for review)
DRAFT. Processing: a learning platform and school management system for Kenyan learners, many of them under 18. Lawful basis: contract with the school or family, parental consent for minors where required, and legal obligation for records. Main risks: (a) exposure of children's data, mitigated by role-based access and row-level security in the database, (b) excessive collection, mitigated by collecting only what each workflow needs, (c) messaging misuse, mitigated by SMS and WhatsApp being off by default and opt-out, (d) payment data, mitigated because cards are handled only by Paystack and no card numbers are stored, (e) AI processing, mitigated by teacher review and no training on learner data. Residual risk: medium, pending review. Actions: DPO review, registration check with the ODPC, and a yearly review.
Data requests
To access, correct or delete your data, email hello@confilearn.co.ke. If your data belongs to a school workspace, we pass the request to that school as the controller.
Contact hello@confilearn.co.ke