Privacy Policy

1. Data Controller

Elimora (“we,” “our,” “us”) is the data controller responsible for your personal data collected through the platform at elimora.ke. Our designated Data Protection Officer can be reached at dpo@elimora.ke.

2. Information We Collect

2.1 Information You Provide Directly

Teachers: Full name, National ID number, TSC registration number, phone number, email address, date of birth, gender, CV, academic certificates, CBC training certificate, reference contacts, work history, subject combinations, counties of availability, bio, and profile photo.

Schools: School name, type and level, registration number, contact person name, phone number, email address, location county and town.

All users: Account email and password (stored as a cryptographic hash — never in plain text).

2.2 Information Collected Automatically

When you use the Platform, we may collect IP address, browser type, device type, operating system, referring URL, pages visited, and session duration. This data is used for security monitoring and platform improvement and is not used for advertising.

2.3 Payment Information

Payment transactions are handled entirely by Paystack Incorporated. We do not store payment card numbers. We retain payment references, amounts, and dates for billing records and refund processing.

3. Legal Basis for Processing

We process your data on the following legal grounds under the Kenya Data Protection Act, 2019:

• Consent — you provide data voluntarily when registering and completing your profile.
• Contractual necessity — processing is required to deliver the marketplace service you have signed up for.
• Legal obligation — we may retain certain data to comply with Kenyan law, tax regulations, or court orders.
• Legitimate interests — fraud prevention, TSC verification, and platform security.

4. How We Use Your Information

• To create and manage your account.
• To verify your TSC registration number with our admin team.
• To make teacher profiles discoverable to subscribing schools.
• To process and manage school subscription payments.
• To send transactional emails (account confirmation, subscription receipts, verification updates).
• To detect, investigate, and prevent fraudulent activity, fake profiles, and policy violations.
• To improve platform features and user experience.

5. Who We Share Your Data With

We do not sell your personal data. We share it only in the following limited circumstances:

• Other platform users: Teacher names, subject combinations, counties, experience, and TSC verification status are visible to authenticated school users. Phone numbers, email addresses, and documents are only accessible to schools that have an active subscription and have explicitly unlocked a teacher’s contact details.
• Paystack Inc.: Payment processing. Subject to Paystack’s own Privacy Policy.
• Supabase: Database, authentication, and file storage. Data is stored in compliance with their data processing agreements.
• Vercel Inc.: Platform hosting and edge delivery.
• Resend Inc.: Transactional email delivery.
• Law enforcement or courts: Where required by Kenyan law, a valid court order, or to protect the rights and safety of our users.

6. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law (for example, financial records which may be retained for up to 7 years under Kenyan tax law) or where data is necessary to resolve an outstanding dispute.

7. Data Security

We implement appropriate technical and organisational security measures, including:

• Encryption in transit using TLS (HTTPS) for all data exchanges.
• Row-Level Security (RLS) in our database, ensuring users can only access their own data.
• Passwords stored as cryptographic hashes — never in plain text.
• File storage in private buckets with access controlled via signed URLs.
• Restricted admin access with role-based access controls.

No method of internet transmission is 100% secure. In the event of a data breach that affects your rights or freedoms, we will notify affected users and the Office of the Data Protection Commissioner as required by law.

8. Your Rights Under the Kenya Data Protection Act, 2019

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your data, subject to legal retention requirements.
• Restriction — request that we limit how we process your data in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — at any time where processing is based on consent, without affecting lawfulness of prior processing.

To exercise any of these rights, email dpo@elimora.ke. We will respond within 30 days as required by law. If you are unsatisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

9. Cookies

We use essential cookies for authentication and session management. We do not use advertising or tracking cookies. See our Cookie Policy for full details.

10. Children’s Privacy

The Platform is intended for users aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us immediately at support@elimora.ke.

11. Changes to This Policy

We will notify users of material changes to this Privacy Policy via email at least 14 days before they take effect. The current version will always be available at elimora.ke/privacy.

12. Contact

Data Protection Officer: dpo@elimora.ke
General support: support@elimora.ke
Elimora, Nairobi, Kenya