Privacy notice

In short: this website sets no tracking cookies and runs no third-party analytics. Within the product, your school is the data controller and we are its processor — we hold learner and staff data on your instructions and do not use it for our own purposes.

1. Who we are

Msomi provides the Msomi school management system and operates msomionline.com. Our address is Westlands Business Park, Nairobi, Kenya. You can reach us at hello@msomionline.com.

This notice is written with reference to the Kenya Data Protection Act 2019.

2. Two different relationships

It matters which of these applies to you, because our obligations differ:

• This website. When you visit msomionline.com or send us a demo request, we are the data controller for the limited information described in section 3.
• The product. When a school uses Msomi to hold learner, guardian and staff records, the school is the controller and we are the processor. We process that data only on the school's instructions, under a data processing agreement. If you are a parent or a member of staff asking about your own records, your school is the right first point of contact — though we will always help them respond.

3. What this website collects

When you submit the demo form: your name, school, email address, and optionally your phone number, role, approximate number of learners, plan of interest and your message.

We use it solely to respond to your enquiry and to have the conversation you asked for. The lawful basis is your consent, and the legitimate interest of both parties in responding to a business enquiry. We do not sell it, share it with third parties for their own purposes, or add you to a marketing list you did not ask for.

Automatically: our infrastructure provider records standard request data such as IP address, approximate country and user agent, for the purposes of delivering the site, blocking abuse and rate-limiting the demo form. The demo form stores a one-way hash of your IP address for at most one hour to enforce that rate limit; the address itself is not stored.

4. Cookies and tracking

This website sets no tracking or advertising cookies and runs no third-party analytics. Your theme preference (light or dark) is kept in your browser's local storage on your own device and is never transmitted to us.

The demo form is protected by Cloudflare Turnstile, which distinguishes people from automated scripts. It is a privacy-preserving alternative to conventional captchas and does not track you across websites.

5. What the product collects

On a school's instructions, Msomi processes the categories of data a school needs to operate: learner records and enrolment, guardian contact details, staff records including TSC numbers and employment terms, attendance, assessment results, fee and payment records, transport allocation, and — where the school uses those modules — health and disciplinary records.

The school decides what is collected, for how long it is kept, and who within the school may see it. We provide the controls; the school sets the policy.

6. How long we keep it

• Demo enquiries: up to 24 months from our last contact, then deleted.
• Rate-limiting hashes: one hour.
• School data in the product: for as long as the school's agreement is in force, and for the wind-down period agreed with the school afterwards.

7. Sharing

We do not sell personal data. We share it only with service providers acting on our instructions:

• Cloudflare — website hosting, bot protection and rate limiting
• Our email delivery provider — to deliver demo requests to our inbox and transactional email to school users
• Our cloud hosting provider — to run the product in an African region
• Our SMS gateway — to deliver school notifications to guardians

We may also disclose data where we are legally required to.

8. Your rights

Under the Data Protection Act 2019 you have the right to:

• Be informed of how your data is used
• Access the personal data we hold about you
• Have inaccurate data corrected
• Have data deleted, where there is no overriding legal or contractual reason to keep it
• Object to processing, and to withdraw consent
• Receive your data in a portable format

To exercise any of these in relation to this website, email hello@msomionline.com. We respond within 30 days. For data held by a school inside Msomi, contact the school; we will assist them.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner.

9. Security

Data is encrypted in transit and at rest, access is scoped to what a role requires, and each school's data is isolated from every other school's at the data layer. Our security page describes the controls in more detail.

10. Changes

If we change this notice we will update the date at the top of the page, and for material changes affecting school users we will notify the school directly.

---

This notice describes our actual practice in plain language. It is not legal advice, and schools should have their own adviser confirm their obligations as data controller.