Privacy Policy

Dapin Education (Dapin Edu) — a division of Dapin Technologies Limited

Effective date: 07/09/2026 · Last updated: 09/09/2026

Applies to: dapineducation.co.ke and its subdomains, and the systems and services described below.

---

1. Who we are

Dapin Education ("Dapin Edu", "we", "us", "our") is a business division of Dapin Technologies Limited, a private limited company incorporated in Kenya under company registration number PVT-8LU7QQ3k.

Dapin Technologies Limited is registered with the Office of the Data Protection Commissioner (ODPC) of Kenya as a Data Controller, under registration number 642-0115-2D26, valid from 9 September 2026 to 9 September 2028. You may verify this registration with the ODPC.

Our registration as a Data Processor is a separate registration and is currently being processed. We will update this Policy and publish the number once it is issued. Our obligations as a processor under the Data Protection Act, 2019 and under our contracts with institutions apply in full in the meantime, and are described in section 3.

This Policy is issued in compliance with the Constitution of Kenya, 2010 (Article 31), the Data Protection Act, 2019, and the Data Protection (General) Regulations, 2021.

2. What Dapin Education does

Understanding our services helps explain what data we hold and why. Through our website and our teams we provide:

• TVET consultation — advisory services on compliance, planning, curriculum strategy and institutional operations.
• TVET establishment — support for new colleges and vocational training centres, including accreditation and registration support, infrastructure planning and programme development.
• Trainer development — training and capacity building for trainers in competency-based methodologies and digital tools.
• TVET digital infrastructure — LMS (Moodle) setup, e-learning content development, Moodle plugins (Pesapal payments, themes, proctoring, AI Marker) and integrated systems.
• Software products — our College Management System (CMS), the ePortfolio of Evidence (ePOE) system, and related school and institution management systems, supplied to institutions under subscription.
• Website features — a free consultation booking calendar, a TVET setup cost calculator and quote download, downloadable TVET setup documents, a blog and FAQs, a TVET jobs board (browsing and posting), a newsletter subscription, an "Ask Dapin AI" assistant, and WhatsApp contact.

3. Two different roles: controller and processor

This distinction matters, and we ask you to read it carefully.

We are the data controller for personal data collected through our website, our marketing, our sales and consultancy engagements, our jobs board, and our own business administration. For that data, this Policy governs, and we are registered with the ODPC as a Data Controller under number 642-0115-2D26.

We are a data processor when an institution (a college, training centre or school) uses our CMS, ePOE, LMS or other hosted systems to manage its own learners, trainers and staff. In that case the institution is the data controller: it decides what data is collected and why, and it is responsible for its own privacy notice to its learners and staff. We process that data only on the institution's documented instructions, under a written data processing agreement.

If you are a student, trainer or member of staff at an institution that uses a Dapin system, please direct your privacy requests to your institution in the first instance. We will assist your institution in responding, but we cannot act on your data without its instruction unless the law requires us to.

4. Personal data we collect

4.1 Data you give us directly

4.2 Data collected automatically

• IP address, browser type and version, device type, operating system.
• Pages visited, referring pages, time on site, and interaction events.
• Cookies and similar technologies (see section 10).
• Security and traffic logs generated by our hosting and network providers, including Cloudflare.

4.3 Data from third parties

• Meta (Facebook and Instagram) lead advertisements — where you submit an enquiry form on a Dapin advert, Meta passes us the contact details and answers you provided.
• Publicly available institutional information — for example, TVETA registers and institutional websites, used to identify and qualify prospective clients.
• Referrals — from partners, existing clients and industry contacts.

4.4 Sensitive personal data

We do not ask for sensitive personal data through our public website.

In our processor role, systems we host on behalf of institutions may contain sensitive personal data as defined by section 2 of the Data Protection Act, 2019 — including learner photographs and biometric identifiers, health or disability information, and family details such as marital status, next of kin and guardian records. Where this occurs, the institution is the controller and determines the lawful basis; we apply the enhanced safeguards set out in section 8 and process such data strictly on the institution's instructions.

4.5 Children's data

Our website is directed at institutions, entrepreneurs and adult professionals, and is not intended for children. We do not knowingly collect data from children through it.

However, systems we host for institutions may contain data relating to learners under the age of 18 — including basic education learners (PP1 to Grade 12) where a school uses our school management system. In those cases the institution is responsible for obtaining verifiable parental or guardian consent as required by section 33 of the Data Protection Act, 2019, and for acting in the best interests of the child. We support the institution with access controls, minimisation and retention tools to help it meet that obligation.

If you believe we hold a child's data collected directly through our website without proper consent, contact us at [email protected] and we will delete it.

5. Why we use your data, and our lawful basis

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may ask us for the reasoning behind any such assessment.

6. Automated processing and AI features

Some of our services use artificial intelligence:

• "Ask Dapin AI" answers website visitors' questions about our services.
• AI Marker (a Moodle plugin) assists trainers by generating draft grades and feedback on learner submissions.
• AI-assisted timetabling and document generation within our CMS.

Content you submit to these features is processed by us and by third-party AI model providers acting under contract to us. Do not enter confidential information, identification numbers, payment details or health information into "Ask Dapin AI".

These features are decision-support tools. We do not make decisions producing legal effects on you based solely on automated processing. Where AI output affects a learner — for example a draft grade — a human trainer or assessor reviews and remains accountable for the final decision. You have the right under section 35 of the Data Protection Act, 2019 to object to solely automated decision-making and to request human review.

7. Who we share your data with

We do not sell your personal data. We share it only as set out below.

Service providers acting on our instructions

• Cloud and server hosting providers (including Contabo and our own managed servers)
• Cloudflare, for DNS, content delivery and security
• Email hosting and delivery providers
• Onfon Media, for bulk SMS delivery
• Google (Workspace, Meet and analytics services), where used
• AI model and API providers, for the features in section 6
• Odoo, as our CRM and business management platform
• Payment providers, including Pesapal and M-Pesa (Safaricom PLC)

Other recipients

• Employers on our jobs board, where you apply for a role — your application is passed to the advertising institution, which becomes an independent controller of it.
• Regulators and public bodies — including TVETA, TVET CDACC, KNEC, the KRA and the ODPC — where required by law or where you have instructed us to make a submission on your institution's behalf.
• Professional advisers — advocates, auditors and accountants, under duties of confidentiality.
• Acquirers — in the event of a merger, acquisition or transfer of business assets, subject to the same protections.
• Law enforcement and courts, where compelled by valid legal process.

Every processor we engage is bound by a written contract requiring confidentiality, security and processing only on our instructions, as required by section 42 of the Data Protection Act, 2019.

8. Security

We apply technical and organisational measures appropriate to the risk, including:

• Encryption in transit using TLS across our websites and systems.
• Role-based access controls, with staff access limited to what their duties require.
• Separate database instances per institution for our CMS — each institution's data is held in its own database rather than pooled with others.
• Firewalling, DDoS protection and traffic filtering at the network edge.
• Regular backups, with restoration testing.
• Access logging and audit trails within our systems.
• Confidentiality obligations in all staff and contractor agreements.
• Vetting of subprocessors before engagement.

No system is perfectly secure. If a breach occurs that presents a real risk to your rights and freedoms, we will notify the ODPC within 72 hours of becoming aware of it, and will notify you without undue delay, as required by section 43 of the Data Protection Act, 2019. Where we act as a processor, we will notify the institution concerned without undue delay so it can meet its own obligations.

9. Transfers outside Kenya

Some of our providers store or process data outside Kenya — including cloud hosting in Europe, and email, analytics and AI services operated internationally.

Where we transfer personal data outside Kenya we comply with sections 48 and 49 of the Data Protection Act, 2019, relying on one or more of:

• appropriate safeguards in our contracts with the recipient, including standard data protection clauses and binding confidentiality and security obligations;
• the necessity of the transfer for the performance of a contract with you or in your interest;
• your explicit consent, having been informed of the risks.

For data classified as strategic or otherwise restricted from export under Kenyan law, we retain a copy on a server located in Kenya where required.

You may request details of the safeguards applied to any specific transfer by writing to us.

10. Cookies

We use cookies and similar technologies to:

• keep the site working and remember your session (strictly necessary);
• remember your preferences, such as saved calculator selections (functional);
• understand how the site is used so we can improve it (analytics);
• measure the performance of our advertising, including Meta advertising (marketing).

Strictly necessary cookies are set without consent because the site cannot function without them. Analytics and marketing cookies are set only where you consent through our cookie banner. You may change or withdraw your choice at any time through the banner or your browser settings. Blocking cookies may affect how parts of the site work.

11. How long we keep your data

Where we no longer need data for the purpose collected, we delete it or irreversibly anonymise it.

12. Your rights

Under section 26 of the Data Protection Act, 2019 you have the right to:

• Be informed of the use of your personal data.
• Access the personal data we hold about you.
• Object to the processing of your data, in whole or in part.
• Correction of false or misleading data.
• Deletion of false or misleading data about you.
• Data portability — to receive your data in a structured, commonly used format, and to have it transmitted to another controller where technically feasible.
• Withdraw consent at any time where consent is our basis.
• Not be subject to a decision based solely on automated processing that significantly affects you.

How to exercise a right: email [email protected] with the words "Data Protection Request" in the subject line, telling us which right you wish to exercise. We may ask for proof of identity to protect your data. We will respond within 7 days of receiving your request, in line with the Data Protection (General) Regulations, 2021, and will tell you if we need longer for a complex request.

There is no fee for a request unless it is manifestly unfounded, excessive or repetitive, in which case we may charge a reasonable administrative fee or decline it, explaining why.

If you are dissatisfied, you may lodge a complaint with the Office of the Data Protection Commissioner, quoting our registration number 642-0115-2D26:

13. Marketing communications

We send marketing emails, SMS and WhatsApp messages only where you have consented or where you are an existing client and the message concerns services similar to those we already provide to you.

Every marketing email carries an unsubscribe link. SMS messages carry an opt-out instruction. You may also reply STOP to WhatsApp marketing, or email [email protected]. We will action opt-outs within 7 days.

Opting out of marketing does not stop service, billing and support messages relating to a contract you hold with us.

14. Third-party links

Our website links to third-party sites, including social media pages, partner sites and payment providers. We are not responsible for their content or privacy practices. Read their privacy notices before providing data to them.

15. Changes to this Policy

We may update this Policy as our services, systems or the law change. The current version is always published at dapineducation.co.ke/privacy-policy with its effective date. Where a change materially affects your rights, we will notify you by email or a prominent notice on the site before it takes effect.

16. Contact us

---

© Dapin Technologies Limited. All rights reserved.