Version 2026-11.3
This notice explains how personal data is handled in the MITCROS system, under the Kenya Data Protection Act, 2019.
Each school is the data controller for its learners, parents and staff. MITCROS is the data processor acting on the school's instructions. Questions about a learner's record go first to the school.
Learners: name, admission and assessment numbers, class, gender, photo (if added), marks, attendance, fee records. Parents/guardians: name and phone number. Staff: name, phone, sign-in records (device, IP address and, for staff using the MITCROS Android app, the phone's location while the app is open; used only to protect school accounts and kept for 180 days). Payments: M-Pesa reference, amount, payer phone.
To run school administration: fees and receipts, exams and report cards, attendance, messages to parents, and the parent app. Data is not sold and is not used for advertising.
Learner data is processed for the learner's education, on the school's lawful basis. Report cards and results are shared only with the learner's parent/guardian through their phone number or PIN.
Only service providers needed to run the Service: the hosting provider, the SMS gateway (phone number and message), Safaricom M-Pesa (payments), and Google Drive if the platform uses it for encrypted backups.
The MITCROS Android app asks staff for location permission and explains why before asking. The location is taken only while the app is open, is shown only to the school administrator and the platform administrator on the sign-in security page, and is deleted after 180 days. Parents' locations are never collected. When a school uses staff clock-in, the phone's position is checked once when the staff member taps the button, to confirm they are inside the school compound; the time and distance are kept with the staff attendance record.
The Android app stores a notification token for the signed-in staff member so the system can send alerts (payments, marks, attendance, security). It contains no personal data and is deleted when the phone stops using the app.
Passwords are stored hashed, sign-ins can require an SMS code, every change to marks and fees is logged, and backups are taken regularly.
Records are kept while the school uses the Service and as long as the school needs them for its legal duties; then they are deleted as set out in the Terms.
The platform administrator may connect a Google Drive account so that encrypted backups of the database are stored there. The system asks Google only for permission to create and manage the backup files it uploads itself (Google Drive "drive.file" access); it does not read, change or share any other files, e-mails, contacts or Google account data. Google sign-in details are stored only on the MITCROS server to keep the backups running and can be removed at any time from the Backup page or the Google account's security settings. MITCROS's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements; this data is never sold, used for advertising, or transferred to anyone else.
You may ask to see, correct or delete your data, or object to its use, through the school. You may also complain to the Office of the Data Protection Commissioner (ODPC), www.odpc.go.ke. Contact: support@mitcros.online or 0725600151.