Privacy Policy

Who is responsible for your information

MSB Educational Institute, Mombasa is responsible for the personal information described in this policy. This covers the website at msbmombasa.com and the student, parent and staff portals. If you have any question about your information, please contact the school office:

• MSB Educational Institute, Next to Jocham Hospital, Kisauni Road, Mombasa, Kenya
• msbmombasa5253@gmail.com
• +254 734 457653

Information we hold

Depending on how you use the website and portals, we may hold:

• Account details: your name, email address, phone number, ITS number or username, your role, and whether your account is active. Passwords are never stored in readable form, only as a secure one-way hash.
• Pupil records: admission number, ITS number, name in Arabic, date of birth, gender, photograph, class and house, community details the school records such as mohalla, attendance, marks and assessments, report cards and transcripts, teachers' remarks, revision entries, study timetables, assignments and submitted work.
• Parent and guardian details: name, contact details, occupation, your relationship to your child, and which children your account is linked to.
• Staff details: name, contact details, employee number, job title, department, and the classes and subjects you teach.
• Things you send through the portals: messages and attachments, form answers, suggestions, and confirmations that you have seen an announcement.
• Security records: when you sign in, your IP address and the type of browser or device are recorded with your session. Actions taken by school administrators are recorded in an audit log, including IP address and browser.
• Notification details: if a parent turns on browser notifications, the browser's notification address and browser type are stored so reminders can be delivered.

If you use the contact form, your name, email address, optional phone number, subject and message are emailed to the school office, and a copy is emailed to you. They are not saved in the website's database.

Why we use it

• To provide education to our pupils: teaching, assessment, attendance, reporting and keeping academic records.
• To keep families informed about their child's learning, and to communicate with pupils, parents and staff.
• To run the portals and keep them secure, including preventing misuse and investigating problems.
• To answer enquiries sent through the contact form.

We use personal information to provide education to our pupils, to meet the school's obligations, and for the school's legitimate interest in running and protecting its portals. Where we ask for your consent, such as for browser notifications, you can withdraw it at any time by turning notifications off.

Children's information

Most of our pupils are children. We use their information only for their education and the running of the school. Where a pupil is under 18, their rights under the Data Protection Act can be exercised on their behalf by a parent or guardian.

Who can see it

• Pupils can see their own records.
• Parents and guardians can see information about their own linked children only.
• Teachers can see pupils in the classes and subjects they teach.
• School administrators can see what their role requires to run the school.
• Report cards become visible to pupils and families only once the school has released them.
• Suggestions appear anonymously to other users, but school administrators can see who sent them.

We do not sell personal information, and we do not use it for advertising.

Service providers

We use a small number of companies to run the website. They process information only to provide their service to the school:

• Vercel hosts the website. Its servers for this website are in Dublin, Ireland.
• Supabase provides the database and file storage, in Ireland.
• Resend sends the school's emails, from Ireland. Email open and click tracking is turned off.
• Browser notifications, if you turn them on, are delivered through your browser maker's notification service. They only remind you to open the portal and never include a child's results or messages.
• The map on the contact page is loaded from OpenStreetMap, which receives your IP address when the map loads. The "Get directions" link opens Google Maps only if you choose to follow it.

Because these providers are based outside Kenya, your information is stored and processed in Ireland, in the European Union.

Cookies

We only use cookies that the portals need to work. When you sign in, cookies keep you signed in for up to seven days, or until you close your browser if you choose not to be remembered. We do not use advertising or analytics cookies, and we do not track you across other websites.

How we protect it

• The website and portals are only available over an encrypted connection (HTTPS).
• Access is limited by role, and by class and subject for teachers, and is checked on the server for every request.
• Passwords are stored only as secure hashes, and signed-in sessions expire.
• The database only allows access through the school's own application, and administrator actions are logged.

How long we keep it

We keep account and school information while a pupil or member of staff is at the school. Academic records such as report cards and transcripts form a pupil's permanent school record and are kept after they leave. When someone leaves, their account is archived so it can no longer be used to sign in. Signed-in sessions expire automatically.

Your rights

Under Kenya's Data Protection Act, 2019, you have the right:

• to be informed of how your personal information is used
• to access the personal information we hold about you
• to object to the processing of all or part of your personal information
• to have false or misleading information corrected
• to have false or misleading information deleted

To use any of these rights, contact the school office. For a pupil under 18, a parent or guardian can make the request on the pupil's behalf.

If you are unhappy with how we have handled your information, you can complain to the Office of the Data Protection Commissioner at www.odpc.go.ke, through its complaints portal at cie.odpc.go.ke, or by email to info@odpc.go.ke.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it last changed.

Contact us

For any question about this policy or your information, please contact the school office:

• MSB Educational Institute, Next to Jocham Hospital, Kisauni Road, Mombasa, Kenya
• msbmombasa5253@gmail.com
• +254 734 457653