Last updated: January 2026

Xenesis (“we”, “our”, or “us”) is committed to protecting the privacy, security, and rights of schools, students, parents, teachers, and administrators across East Africa.

This Privacy Policy explains how Xenesis collects, uses, stores, and protects personal data in compliance with applicable data protection laws and regulations of the country in which the respective school operates.

 

1.  Our Commitment to Data Protection

Xenesis follows the core principles of regional data protection regulations, including:

• Lawful and fair processing of data
• Purpose limitation (data used only for education-related services)
• Data minimisation (only necessary data is collected)
• Accuracy and confidentiality
• Secure storage and controlled access

Student data is treated as highly sensitive information.

 

2.  Information We Collect

Xenesis collects only the information required to operate school management services.

This may include:

• Student data: name, admission number, class, attendance, academic records
• Parent/Guardian data: name, phone number, email (as provided by the school)
• Teacher & Staff data: name, role, assigned classes
• School data: school name, curriculum structure, timetable, academic year
• System usage data: login activity for security and auditing We do not collect unnecessary personal or sensitive data. 

3.  Lawful Basis for Processing Data

Xenesis processes data:

• Under the authority and consent of the school institution
• For legitimate educational and administrative purposes
• In line with national education and data protection regulations Schools remain the data controllers, and Xenesis acts as a data

4.  How We Use Information

Collected data is used strictly to:

• Manage academics, attendance, fees, and communication
• Enable secure access for administrators, teachers, parents, and students
• Share official school announcements and updates
• Support Physical Education, sports, and learning activities
• Improve system reliability and user experience Xenesis does not sell, trade, or misuse personal

5.  Data Security & Storage

We implement strong security measures to protect school data:

• Secure, dedicated cloud infrastructure
• Role-based access control (Admin, Teacher, Parent, Student)
• Encrypted data transmission
• Restricted internal access to authorised personnel only
• System access and activity logs are maintained for security monitoring, auditing, and compliance purposes
• User authentication mechanisms are implemented to prevent unauthorised access, including password and session controls

We regularly review and improve security controls to prevent unauthorised access, loss, or misuse. 

 

6.  Data Breach Management & Incident Response

In the event of a personal data breach or security incident, Xenesis will promptly assess the impact and notify the affected school without undue delay. Appropriate corrective and preventive measures will be taken to minimise risk and prevent recurrence, in coordination with the school and relevant authorities where required by law. 

 

7.  Data Location & Cross-Border Processing

Where applicable:

• Data is stored in secure cloud environments compliant with regional regulations
• Any cross-border data processing follows lawful safeguards and agreements
• Xenesis ensures data protection standards are maintained regardless of hosting location

8.  Data Sharing & Third Parties

Xenesis does not share personal data with third parties except:

• When required by law or regulatory authorities
• When authorised by the school for educational purposes
• With trusted technical service providers under strict data protection agreements

All partners are required to comply with confidentiality and security standards. 

 

9.  Children’s Data Protection

Xenesis is designed specifically for schools.

• Student data is accessed only through school-authorised accounts
• Parents and guardians view student data via secure logins
• No student data is made publicly accessible

We take extra care to protect children’s personal information. 

 

10.  Mobile App Permissions

Xenesis mobile apps may request access to:

• Internet connectivity (to sync school data)
• Notifications (for school alerts and announcements)
• Limited device storage (for secure app functionality) These permissions are used strictly for operational 

 

11.  Data Retention

School data is retained only for:

• The duration of the school’s active use of Xenesis
• The period required by education or regulatory authorities
• As instructed by the school through formal agreement

Data handling after service termination is managed in coordination with the school. Upon termination of services or upon written instruction from the school, Xenesis will securely delete or return the school’s data in accordance with contractual terms and applicable legal requirements. Secure deletion practices are followed to ensure data cannot be reconstructed or misused.

 

12.  Your Rights

Depending on applicable local laws, schools and users may have the right to:

• Access their data
• Request correction of inaccurate information
• Raise concerns regarding data usage
• Request deletion of data (where legally permitted)
• Request restriction of processing
• Raise objections to inappropriate use

Requests should be directed through the school administration. 

 

13.  Updates to This Policy

This Privacy Policy may be updated to reflect regulatory or operational changes. Updated versions will be published on our website and mobile applications. 

 

14.  Contact Information

For privacy or data protection inquiries:

Xenesis by MeshBA Kenya Ltd

Email: contact@xenesisedu.com