Privacy Notice

The short answer

What data does the portal collect?

The portal collects the account details you provide, the guardian links you request, and the fee, payment and document records the school already keeps. It uses them to verify guardian access and operate the fee account. It does not sell personal data, profile children or use advertising cookies.

Data controller and contact

Riverside Academy is the data controller for the learner and fee records managed through this portal. The school decides why and how that data is processed. The accounts office and the school's Data Protection Officer handle access requests, corrections and privacy questions.

Data Protection Officer: Riverside Academy Data Protection Officer
DPO email: dpo@riverside.academy.example
DPO phone: +254 700 000 111
Address: P.O. Box 1234, Nairobi, Kenya

Children's data

A learner's fee record concerns a child. The portal therefore applies stricter safeguards:

Guardian consent first. Registration asks the adult to confirm that they are the learner's parent or guardian and that they accept this notice. The consent, policy version and a hash of the statement shown are recorded.
Verified relationship. An email address alone does not unlock a child's record. The school reviews each guardian link against its own records before any fee data is shown.
Data minimisation. The portal holds the admission number, learner name and class needed to identify the fee account. It does not collect a learner's photograph, location, health data or biometric data.
No profiling or marketing. Children's data is not used for advertising, behavioural profiling or automated decisions that affect the child. Reminder emails go to the verified guardian, not to the learner.
Restricted access. Only a guardian with a verified link and authorised staff whose role requires it can see the record. Every staff action is audited.
Withdrawal. A guardian may withdraw consent and ask for the guardian link to be closed. The school will explain any fee record it must still keep by law.

Lawful basis

The school processes guardian account data with consent, and fee and payment records to perform its contract with the family and to meet its legal and accounting obligations. Security logs are processed for the school's legitimate interest in protecting the service. Where consent is the basis, it can be withdrawn at any time without affecting processing already carried out.

Information we collect

Parent or guardian account details: name, email address, phone number and password (stored as a hash).
Guardian link details: the learner's admission number, the requested relationship and the school's approval decision.
Fee account records: charges, payments, credits, adjustments, reversals, opening balances and allocation details.
Service records: statements and receipts you request, email delivery logs, sign-in sessions and security audit events.
Technical records needed to operate and protect the service, such as request timestamps and an IP address used for rate limiting and security logs.

Why we use it

To verify that a parent or guardian is authorised to see a learner's fee account.
To calculate and show ledger-backed balances, payment history and due dates.
To generate statements and receipts and to send fee reminder emails to verified guardians.
To reconcile payments, investigate discrepancies and keep financial records accurate.
To protect the portal against fraud, abuse and unauthorised access.

Who can see it

Fee information is visible to signed-in users with a verified guardian link to the learner, and to authorised school staff whose role requires it. Staff actions are audited. The portal does not show fee data to pending or rejected guardian links, and it responds as if an unlinked learner does not exist so that admission numbers cannot be probed. We do not sell guardian or learner data.

How long we keep it

Fee, payment and reconciliation records are kept while the learner's account is active and for up to 7 years afterwards to meet the school's records, audit and legal obligations. Email delivery logs are kept for up to 24 months. Sessions, verification tokens and reset tokens expire and are removed. Security audit records are kept only as long as needed to investigate incidents and protect the service. When a record is no longer required it is deleted or anonymised.

Your rights

Under the Data Protection Act, 2019 you may ask to:

Access the personal data the school holds about you and your linked learner.
Correct information that is inaccurate, incomplete or out of date.
Delete information that is no longer needed, subject to records the school must keep by law.
Object to processing, including direct marketing. The portal sends only service messages.
Port the data you provided in a structured, commonly used format.
Withdraw consent for processing based on consent, and ask for a guardian link to be closed.

Signed-in guardians can download a machine-readable copy of their data and raise a privacy request from Profile & security in the parent portal. The school aims to respond within 30 days. If you are not satisfied, you may complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.

Security and breach notification

Passwords are hashed, sessions are database-backed and revocable, and staff access is role-based and audited. If a personal data breach is likely to result in a risk to your rights, the school will notify the Office of the Data Protection Commissioner and affected individuals without undue delay, in line with the Act.

Cross-border transfers

The portal is operated for this school. Where a hosting or email provider processes data outside Kenya, the school requires appropriate safeguards, such as contractual data protection terms and a comparable standard of protection, before any transfer.

Cookies and analytics

The portal uses a session cookie to keep you signed in. It does not use advertising cookies or third-party tracking scripts. The public pages do not set advertising or analytics cookies.

Changes to this notice

The current policy version is shown at the top of this page. If the notice changes in a way that affects consent, the school will ask guardians to review and accept the new version before continuing to use the portal.

This notice describes how the portal handles information. The school's full data protection policy and your statutory rights under the Kenya Data Protection Act, 2019 also apply.