Privacy Notice
Last updated: 15 October 2026
This notice explains what personal data the Kyeni Girls High School website (www.kyenigirls.sc.ke) collects, why, and the rights you have under Kenya's Data Protection Act, 2019. Sacred Heart Kyeni Girls High School, P.O. Box 91-60103 Runyenjes, Embu, is responsible for this data.
What we collect and why
Messages you send us. The contact form asks for your name, email address, an optional subject and your message. They are emailed to the school's inbox so that we can reply, and are not stored in the website's database. They stay in the school's inbox like any other correspondence, with no automatic deletion; you can ask us to delete yours (see "Your rights").
Email alerts, if you sign up. If you ask for email alerts on the News & Events page, we store your email address, whether you want school news, upcoming events or both, and when you signed up and confirmed. We first send one email asking you to confirm; if you don't confirm within 7 days, your address is deleted. After that we use it only to email you when we publish the kind of post you chose. Every alert has a link to change your choice or unsubscribe, and unsubscribing deletes your address from our list straight away. The emails are sent from the school's Gmail account.
Analytics, only if you agree. If you click "Accept" in the cookie banner, Google Analytics sets cookies to tell us which pages are visited, roughly from where, and on what kind of device. If you decline, Google Analytics is not loaded at all. You can change your choice at any time with "Cookie settings" at the bottom of every page. We also use Cloudflare Web Analytics, which sets no cookies and only gives us total page views.
Technical data. Like all websites, our server receives your IP address, browser type and the pages you request. We keep these server logs to protect the site and fix problems, and delete them after 14 days. To count assignment downloads and news reads fairly, the server remembers your IP address and browser type for up to one hour; this is not stored.
Students using the Student Portal are not asked for any personal data; downloads are anonymous.
Staff accounts. For teachers and administrators who sign in, we store your name, email address, a securely hashed password and an optional profile photo, and set a sign-in cookie while you are signed in.
Photos of students. The gallery and news pages show photos of school events, which may include students. As Kenya's Data Protection Act requires for children's personal data, we publish photos of students only with the consent of their parent or guardian, and we use them only to show school life on this website.
To have a photo removed, contact the school by phone, SMS, email or in person (details below). Tell us which photo (a link to the page helps) and why you want it removed. We may ask you to show that you are the student in the photo or their parent or guardian. Once that is confirmed, we remove the photo promptly. A parent or guardian can also withdraw consent for future photos at any time.
Cookies and similar storage
| Name | Purpose | When |
|---|---|---|
_ga, _ga_* |
Google Analytics visitor statistics (up to 2 years) | Only after you accept |
analytics-consent |
Remembers your cookie choice (stored in your browser) | After you choose |
admin_session_token |
Keeps staff signed in to the admin panel (8 hours) | Staff only |
Who else handles the data
We do not sell personal data. These service providers process it on our behalf, and some of them may store it outside Kenya:
- DigitalOcean hosts the website's server, in a data centre outside Kenya.
- Cloudflare delivers and protects the website, and provides the cookie-free analytics.
- Google provides the school's email (Gmail), the icon font and, if you accept, Google Analytics.
- cdnjs (run by Cloudflare) delivers some scripts the pages use.
The WhatsApp button opens a chat in WhatsApp; Meta's privacy policy applies to that conversation.
Your rights
Under the Data Protection Act, 2019 you may ask to see the personal data we hold about you, have it corrected or deleted, or object to how we use it. Contact the school administration: email [email protected], phone or SMS 0725-957230, or write to the address above. If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
Changes to this notice
If we change how the website uses personal data, we will update this page and the date at the top.