Data protection

Merisa Kiddo / Merisa Kiddo Cloud · Web and Android · Updated 12 October 2026

Purpose and responsibility

This notice explains the data protection responsibilities for Merisa Kiddo. It should be read with the privacy policy. The school controls its learner records; platform processing must follow authorised school instructions and applicable Kenyan data protection law.

Collect only what is needed

School administrators and staff should record information necessary for the stated school purpose, keep it accurate, explain its use to families, and avoid unrelated sensitive details. Consent must be specific where required; optional photographs or publicity uses should not be bundled into essential school services.

Protect access and sharing

Assign the minimum permissions required for a person’s work, review access when duties change, and remove obsolete accounts. Check recipients before sharing reports, photographs or messages. Exported files and personal devices require the same care as records inside the app.

Children, health and transport

Verify guardian relationships and authorised pickup contacts. Restrict sensitive health and incident records to staff who need them. Assess risks to children before introducing new monitoring, sharing or processing. Crew must stop location tracking when the authorised trip or tracking duty ends.

Retention and requests

The school should approve and document retention periods for learner, financial, safeguarding, messaging, GPS and backup records. Deletion must respect lawful retention needs and verified guardian authority. Requests for access, correction or deletion should be handled within applicable statutory deadlines, with any refusal or retained records explained.

Suppliers and transfers

Schools and platform operators must assess suppliers, document processing instructions, and apply appropriate safeguards for access and transfers outside Kenya. This notice is not a substitute for a school’s required processor agreement, retention schedule, registration or impact assessment.

Report a concern

Report suspected exposure, a lost device or incorrect access promptly to the school and platform support. Do not forward exposed records to demonstrate the issue; describe it and request a secure reporting method. The responsible controller must assess the incident and make notifications required by law.

For information about your rights or an unresolved complaint, visit the Office of the Data Protection Commissioner.

Contact

Contact your school office about learner records, access permissions or school services. For privacy, account deletion or platform support, email merisakiddocloud@gmail.com. Please do not send passwords, identity documents or a child’s medical records in your first message.