Data Privacy Policy

Last Updated: January 5, 2026

1. Introduction

Welcome to the Data Privacy Policy for Celebra Education Limited, operating under the trade name Celebra ("Celebra", "we", "us", "our").

We maintain the utmost respect for your privacy and remain unequivocally committed to safeguarding the information that is collected or disclosed to us, hereinafter referred to as "personal data" as elucidated below. In our endeavour to empower you to make judicious decisions pertaining to your privacy and personal data, we have rendered this Privacy Policy as perspicuous and transparent as practicable, thereby ensuring your comprehensive understanding of the rights afforded to you under applicable law.

This Privacy Policy delineates the manner in which Celebra processes personal data concerning individuals with whom we establish contact (hereinafter referred to as "you" or "your") throughout the course of our professional engagements.

This Policy encompasses:

  • All users of Celebra's applications, software, databases, websites, social media platforms, and all ancillary resources.
  • Third parties associated with the users of Celebra's applications, software, databases, websites, social media platforms, and all supplementary resources.
  • Celebra's affiliated parties, including but not limited to trustees, implementing partners, vendors, contractors, regional branches, and any other third party who handles and utilises Celebra's information; and
  • Members of the general public.

It is of paramount importance that you peruse this Privacy Policy meticulously and comprehend how we intend to utilise your personal data. This Privacy Policy shall inform you regarding the methodologies we employ to collect, use, disclose, transfer, and store your personal data when you interact with us. Furthermore, it shall apprise you of your privacy rights and the legal protections afforded to you in accordance with the provisions of the Data Protection Act of Kenya, 2019 ("the Act").

2. Statutory Framework: The Data Protection Act of Kenya, 2019

This Privacy Policy is promulgated in strict accordance with the provisions of the Data Protection Act of Kenya, 2019 (No. 24 of 2019). The following statutory provisions constitute the legal foundation upon which our data processing activities are predicated:

Section 5: Principles of Data Protection

Every data controller or data processor shall ensure that personal data is:

  • (a) Processed in accordance with the right to privacy of the data subject;
  • (b) Processed lawfully, fairly and in a transparent manner in relation to any data subject;
  • (c) Collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes;
  • (d) Adequate, relevant, limited to what is necessary in relation to the purposes for which it is processed;
  • (e) Collected only where a valid explanation is provided whenever information relating to family or private affairs is required;
  • (f) Accurate and, where necessary, kept up to date, with every reasonable step being taken to ensure that any inaccurate personal data is erased or rectified without delay;
  • (g) Kept in a form which identifies the data subjects for no longer than is necessary for the purposes which it was collected; and
  • (h) Not transferred outside Kenya, unless there is proof of adequate data protection safeguards or consent from the data subject.

Section 26: Rights of a Data Subject

A data subject has a right:

  • (a) To be informed of the use to which their personal data is to be put;
  • (b) To access their personal data in custody of data controller or data processor;
  • (c) To object to the processing of all or part of their personal data;
  • (d) To correction of false or misleading data; and
  • (e) To deletion of false or misleading data about them.

Section 27: Exercise of Rights of Data Subjects

A right conferred on a data subject may be exercised:

  • (a) Where the data subject is a minor, by a person who has parental authority or by a guardian;
  • (b) Where the data subject has a mental or other disability, by a person duly authorised to act as their guardian or administrator; or
  • (c) In any other case, by a person duly authorised by the data subject.

Section 28: Collection of Personal Data

(1) A data controller or data processor shall collect personal data directly from the data subject.

(2) Despite sub-section (1), personal data may be collected indirectly where:

  • (a) The data is contained in a public record;
  • (b) The data subject has deliberately made the data public;
  • (c) The data subject has consented to the collection from another source;
  • (d) The data subject has an incapacity, the guardian appointed has consented to the collection from another source;
  • (e) The collection from another source would not prejudice the interests of the data subject;
  • (f) Collection of data from another source is necessary:
    • (i) For the prevention, detection, investigation, prosecution and punishment of crime;
    • (ii) For the enforcement of a law which imposes a pecuniary penalty; or
    • (iii) For the protection of the interests of the data subject or another person.

(3) A data controller or data processor shall collect, store or use personal data for a purpose which is lawful, specific and explicitly defined.

Section 29: Duty to Notify

A data controller or data processor shall, before collecting personal data, in so far as practicable, inform the data subject of:

  • (a) The rights of data subject specified under section 26;
  • (b) The fact that personal data is being collected;
  • (c) The purpose for which the personal data is being collected;
  • (d) The third parties whose personal data has been or will be transferred to, including details of safeguards adopted;
  • (e) The contacts of the data controller or data processor and on whether any other entity may receive the collected personal data;
  • (f) A description of the technical and organizational security measures taken to ensure the integrity and confidentiality of the data;
  • (g) The data being collected pursuant to any law and whether such collection is voluntary or mandatory; and
  • (h) The consequences if any, where the data subject fails to provide all or any part of the requested data.

Section 30: Lawful Processing of Personal Data

(1) A data controller or data processor shall not process personal data, unless:

  • (a) The data subject consents to the processing for one or more specified purposes; or
  • (b) The processing is necessary:
    • (i) For the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject before entering into a contract;
    • (ii) For compliance with any legal obligation to which the controller is subject;
    • (iii) In order to protect the vital interests of the data subject or another natural person;
    • (iv) For the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
    • (v) The performance of any task carried out by a public authority;
    • (vi) For the exercise, by any person in the public interest, of any other functions of a public nature;
    • (vii) For the legitimate interests pursued by the data controller or data processor by a third party to whom the data is disclosed, except if the processing is unwarranted in any particular case having regard to the harm and prejudice to the rights and freedoms or legitimate interests of the data subject; or
    • (viii) For the purpose of historical, statistical, journalistic, literature and art or scientific research.

(2) Further processing of personal data shall be in accordance with the purpose of collection.

Note: The foregoing statutory provisions are extracted verbatim from the Data Protection Act of Kenya, 2019 (No. 24 of 2019) and constitute the legal framework within which Celebra operates. Our commitment to compliance with these provisions is absolute and unwavering.

3. Who is Responsible for Your Personal Data and How to Contact Them?

Celebra serves as the data processor in relation to the processing activities delineated hereinbelow. This designation signifies that we process your personal data on behalf of the data controller.

Should you harbour any concerns regarding the utilisation of your personal data or possess enquiries pertaining to this Privacy Policy, including any requests to exercise your legal rights under applicable law, or wish to lodge complaints, please direct your correspondence to our Data Protection Officer utilising the contact particulars enumerated below:

  • Email Address: dpo@celebra.school
  • Postal Address: P.O BOX 51235-0100, Nairobi, Kenya
  • Physical Address: Nairobi, Kenya
  • Telephone Number: +254 XXX XXX XXX

4. What Types of Personal Data Do We Process?

When employed within the context of this Privacy Policy, the term "personal data" denotes any information that may be utilised to identify an individual natural person. Please be cognisant that there exist "special categories" of personal data that are of a more sensitive nature and necessitate an elevated level of protection. The personal data we collect shall vary in accordance with the circumstances surrounding our relationship with you.

We may collect, use, store, and transfer the following categories of personal data pertaining to you or persons connected to you where absolutely necessary:

  • Personal Details: Including your name, national identity card number or passport number, date of birth, gender, Kenya Revenue Authority (KRA) PIN, nationality, title, children's names, name of the educational institution, names of educators within the respective institutions;
  • Contact Information: Encompassing email address, telephone number, and postal address;
  • Academic Records: Such as examination results, attendance records, performance analytics, and educational progress data;
  • Interaction Information: Pertaining to your interactions with Celebra, including when you utilise our applications, software, databases, websites, social media platforms, and other resources; when you communicate with us through emails or calls which we might record and monitor; or when you participate in our educational programs.

Should we require information concerning other individuals connected to you, we may request you to furnish such information. If you are providing information about another person, we expect you to ensure that they are apprised of your actions and consent to the disclosure by you of their information to us.

What transpires if you fail to provide the requested personal data?

If you do not furnish us with the requested personal data, we may be rendered incapable of providing you with the services you require. In certain instances, we may be compelled to terminate a service you currently have with us; however, we shall notify you if this is the case at the relevant time.

5. How Do We Collect Your Personal Data?

We may collect or receive your personal data through a multiplicity of different avenues:

  • Direct Provision: Where you provide the personal data directly to us, for example by:
    • Corresponding with us via telephone or electronic mail;
    • Utilising or registering to use our applications, software, databases, websites, social media platforms, and other resources;
    • Entering into a contractual agreement with us.
  • Third-Party Sources: From third parties, such as individuals who operate on our behalf and our associated partners; and
  • Publicly Available Sources: Including but not limited to internet search engines, public records and registers, and social media accounts (e.g., Facebook, LinkedIn, and Instagram).

Generally, you bear no obligation to provide us with your personal data; however, should you elect not to furnish us with the information we require, we may be unable to render assistance and collaborate with you. We shall endeavour to minimise the quantum of information we request, limiting it solely to that which is necessary to perform the relevant function or service at the time.

6. Cookies and Similar Technologies

Please be advised that in order to enhance our internet service to you, we shall occasionally employ a "cookie" and/or other analogous technologies which may deposit certain information on your computer's hard drive when you visit our website or any of Celebra's online platforms.

A cookie constitutes a small quantum of data that our web server transmits to your web browser when you visit certain portions of our site.

We utilise cookies to perform a multitude of different functions, including facilitating efficient navigation between pages, identifying you subsequent to logging in by storing a temporary reference number in the cookie, enabling you to access stored information if you register for any of our online platforms, and generally ameliorating your online experience.

7. Why Do We Process Your Personal Data?

We shall process your personal data for the following purposes:

  • To provide educational products and services to our clients and to communicate with you and/or our clients regarding them;
  • To manage, administer, and enhance our business operations, client and service provider engagements and relationships, and for corporate marketing, business development, analysis, and operational purposes;
  • To monitor and analyse the utilisation of our products and services for system administration, operation, testing, and support purposes;
  • To manage our information technology infrastructure and to ensure the security of our systems and premises;
  • To establish, exercise, and/or defend legal claims or rights and to protect, exercise, and enforce our rights, property, or safety, or to assist our clients or others in doing so;
  • To investigate and respond to complaints or incidents relating to us or our business, to maintain service quality, and to train staff to handle complaints and disputes;
  • To cooperate with, respond to requests from, and to report transactions and/or other activities to government, tax, or regulatory bodies, courts, or other third parties;
  • For any additional purposes expressly authorised by you; and
  • To comply with applicable laws and regulations.

8. What Legal Basis Do We Rely On for Processing Your Personal Data?

We shall rely upon the following lawful bases for processing your personal data:

  • Legitimate Interests: We shall process your personal data to pursue our legitimate business interests and other interests, or those of a third party, except where the processing is unwarranted in any particular case having regard to the harm and prejudice to your rights, freedoms, or legitimate interests.
  • Legal and Regulatory Obligations: We shall process your personal data for the purpose of complying with a legal or regulatory obligation, such as when it is necessary to pursue our legitimate interests in cooperating with our regulators and other government authorities, complying with applicable laws, and protecting our businesses.
  • Contractual Performance: We shall process your personal data to perform our obligations with respect to the contract we have with you or to take steps prior to entering into such a contract with you.
  • Consent: We shall rely on your consent as a lawful basis for processing personal data relating to a minor, processing sensitive personal data outside Kenya, and processing your personal data for the purpose of direct marketing to you. Where you have provided your consent to the processing of your personal data for a specific purpose, you retain the right to withdraw your consent for that specific processing at any time. Please note that by withdrawing your consent, the withdrawal shall not render unlawful our prior processing of your personal data or the processing which is predicated upon other legal bases for processing of your personal data.
  • Vital Interests: We shall process your personal data to protect your vital interests or those of another natural person.
  • Public Interest: We shall also process your personal data for the performance of a task carried out in the public interest.

9. To Whom Do We Disclose Your Personal Data?

We may disclose your personal data to:

  • Third parties such as external accountants, external legal teams, regulators, and other professional bodies;
  • Third parties to establish, exercise, or defend our legal rights;
  • Public authorities or governments when required by law, public interest, national security, regulation, legal process, or enforceable governmental request;
  • Our external service providers with whom we contract for various functions, including but not limited to our IT and office systems, administrative services providers, universities, and research organisations (who may contact you to gather information relating to our products and services). We shall only disclose personal data to our external service providers when it is essential for them to provide their service and we have a contract in place that requires them to maintain the security of your information and not to use it other than in accordance with our specific instructions; and
  • Authorised third parties.

Please note that if you request us, in writing, to share your personal data with third parties, we shall comply with your request to share the relevant information. However, we do not exercise control over how those third parties will utilise your information. Before you make your request, we recommend that you (or the person acting on your behalf) consider the data protection practices of that third party by perusing their privacy policies or contacting them directly.

10. Where Do We Transfer Your Personal Data?

We may transfer your personal data to regulatory, prosecuting, tax, and governmental authorities, courts and other tribunals, service providers, and other business counterparties located in countries outside Kenya, including countries which maintain different data protection standards to those applicable in Kenya. When we transfer personal data to entities in these countries, we shall take reasonable steps to ensure that they protect your personal data in accordance with appropriate safeguards and other requirements of the Act.

In order to mitigate risks associated with the transfer of data to third parties, Celebra shall only transfer data to a third party if:

  • The data is divested of personal and identifiable information where appropriate;
  • We possess a lawful basis for such transfer;
  • The third party maintains an elevated level of data security that protects personal data against the risk of accidental or unlawful/illegitimate destruction, loss, alteration, unauthorised disclosure of, or access to it.

11. Data Security

We shall undertake and implement appropriate technical and organisational security procedures and measures to protect the security and confidentiality of personal data and to prevent the unauthorised or unlawful processing of personal data and accidental loss or destruction of, or damage to, personal data.

We shall implement the following measures:

  • Personal data shall be filed and stored in a manner that is accessible only to authorised personnel and transferred only utilising protected means of communication;
  • Our staff members who are permitted access to the personal data shall execute a non-disclosure agreement prohibiting them from utilising the content for business other than the company's core mandate; and
  • Private email accounts shall not be employed to transfer personal data.

12. How Long Do We Retain Your Personal Data?

We shall only retain your personal data for such duration as may be reasonably necessary to fulfil the purpose for which it was collected, including to comply with any legal, regulatory, tax, accounting, or reporting information requirements. We may retain your personal data for a longer period if the retention is:

  • Required or authorised by law;
  • Reasonably necessary for a lawful purpose;
  • Authorised or consented to by you;
  • For personal data that has been anonymised; or
  • For historical, statistical, journalistic, literature and art, or research purposes.

13. What Are Your Rights in Relation to Your Personal Data?

Pursuant to Section 26 of the Data Protection Act of Kenya, 2019 (as reproduced in Section 2 above), you are vested with the following fundamental rights:

  • Right to be Informed: Of the use to which your personal data is to be put, as we have endeavoured to outline in this Privacy Policy.
  • Right of Access: To your personal data in our custody and to receive a copy of the personal data we hold about you.
  • Right to Object: To the processing of all or part of your personal data.
  • Right to Correction: Of any false or misleading personal data that we hold about you.
  • Right to Deletion: Of any false or misleading personal data about you.

In accordance with Section 27 of the Act, these rights may be exercised by a parent or guardian where the data subject is a minor, by an authorised guardian or administrator where the data subject has a mental or other disability, or by a duly authorised representative in any other case.

To exercise any of these rights, please direct your written correspondence to our Data Protection Officer via the contact details provided in Section 3 above.

14. Other Terms and Conditions

There may exist specific terms and conditions that govern the collection, use, and disclosure of your personal data. Please note that such terms and conditions must be perused in conjunction with this Privacy Policy.

15. Promotional Communications

We may utilise your Personal Data to contact you with newsletters, marketing or promotional communications pertaining to our products, and other information that may be of interest to you. You retain the right to opt out of such communications at any time by following the unsubscribe instructions provided in our emails or by contacting us directly.

16. Amendments to This Privacy Policy

We may update our Privacy Policy from time to time. We shall notify you of any changes by posting the new Privacy Policy on this page. We shall update the "Last Updated" date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Policy are effective when they are posted on this page.

Questions or Concerns?

Should you have any questions, concerns, or complaints regarding this Privacy Policy or our data processing practices, please do not hesitate to contact us:

Email: privacy@celebra.school

Data Protection Officer: dpo@celebra.school

Website: https://celebra.school