Version 2026-11
This agreement is between the School (controller) and MITCROS (processor) under section 42 of the Kenya Data Protection Act, 2019.
MITCROS processes school personal data only to provide the Service and on the School's documented instructions, which include the School's use of the system's features.
Persons at MITCROS who can reach school data are bound to confidentiality and access it only when needed for support, maintenance or the law.
MITCROS keeps suitable technical and organisational measures: encrypted connections (HTTPS), hashed passwords, access by role, an audit log of changes, regular backups and restricted server access.
Hosting, SMS gateway, M-Pesa (Safaricom) and backup storage. MITCROS will tell the School before adding a new sub-processor; the School may object.
MITCROS will tell the School without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting its data, with what is known and the steps taken, so the School can notify the ODPC within 72 hours where required.
MITCROS helps the School answer requests to access, correct or delete data, mostly through the system's own tools (edit, export, delete learner).
Where data is stored or backed up outside Kenya, MITCROS uses providers with appropriate safeguards as required by the Act.
At the end, MITCROS returns the data as an export and deletes it within 90 days, except where the law requires keeping it.
On reasonable notice, MITCROS provides the information the School needs to show compliance with this agreement.