Privacy policy
How Enaton Technologies collects, uses, stores and protects your data. A school system holds records about children and about families’ money, so this page is written to be read rather than scrolled past.
Last updated: 8 March 2026
Who we are and what this covers
Enaton Technologies, referred to here as Enaton, we, us or our, operates the school management platform available at enatontech.com and the parent portal at my.enatontech.com.
This privacy policy explains how we collect, use, store and protect your personal information in accordance with the Kenya Data Protection Act, 2019 (No. 24 of 2019) and the regulations issued by the Office of the Data Protection Commissioner (ODPC), including the ODPC Guidance Note for the Education Sector.
By using our platform you consent to the practices described in this policy. If you do not agree with them, please discontinue use of our services.
Information we collect
We collect the following categories of information in order to provide and improve our services.
Names, email addresses, phone numbers, roles and credentials of school administrators, teachers and staff who register on the platform.
Learner records including names, admission numbers, grades and attendance, parent and guardian contact details, fee records, academic results, and other data entered into the platform by the school.
Transaction records processed through Enaton Pay, including M-Pesa and bank payment references. We do not store raw card numbers or M-Pesa PINs.
Browser type, device information, IP addresses, pages visited and platform interactions, collected automatically so we can improve performance and the experience of using the system.
How we use your information
We use the information we collect for the following purposes.
Operating the school management platform, the parent portal and payment processing.
Sending SMS, email and in app notifications about school activities, fees and platform updates.
Generating academic reports, financial summaries and attendance records for schools.
Processing and reconciling fee payments through Enaton Pay.
Diagnosing issues and providing support to your team.
Analysing usage patterns so we can improve features and performance.
Detecting and preventing unauthorised access, fraud and abuse.
Meeting our obligations under Kenyan law, including the Data Protection Act 2019.
Legal basis for processing
Under the Kenya Data Protection Act 2019, we process your data on the following legal grounds.
Where you have given explicit consent for us to process your data, for example by creating an account or submitting a contact form.
Where processing is necessary to deliver the services you or your school have subscribed to.
Where processing is necessary for our legitimate business interests, such as platform security and fraud prevention, without overriding your rights.
Where processing is required in order to comply with Kenyan law.
Children’s data
A significant part of the data processed through Enaton relates to children. Learner data carries the highest level of protection in our system, in compliance with Section 33 of the Kenya Data Protection Act 2019, and we take those obligations seriously.
- Learner data is entered and managed by the school, as data controller, with the consent of parents or guardians
- We process children’s data solely to advance and protect the rights and best interests of the child
- Parents and guardians can see their child’s data through the parent portal at any time
- We do not use learner data for marketing, advertising or profiling
- Learner data is never sold, never shared with third parties for commercial use, and never used for purposes unrelated to the school’s educational mission
- We follow the ODPC Guidance Note for the Education Sector, December 2023, in all our data processing
Data sharing
We do not sell your data. We share information only in the following circumstances.
Schools reach their own data through the platform, as data controllers.
Parents reach their child’s data through the parent portal, as authorised by the school.
We use trusted third party providers for hosting, for payment processing through M-Pesa and the banks, and for email delivery. All of them are bound by data processing agreements.
Where required by Kenyan law, by court order, or by a regulatory authority including the ODPC.
Every third party service provider is required to maintain equivalent data protection standards, and is prohibited from using your data for its own purposes.
Data security
These are the measures we use to protect your data.
Your records are encrypted where they are stored, using current industry standard encryption.
Everything travelling between your browser and our servers is encrypted over a secure connection.
Access is granted by role and can be narrowed to individual screens, so a person only reaches what their job requires.
Your records are backed up daily, with recovery to a point in time, so a mistake or a failure does not cost you your history.
We carry out regular vulnerability assessments and penetration testing.
Each school’s records are kept apart from every other school on the platform. No school can reach another school’s data.
In the event of a data breach we will notify the Office of the Data Protection Commissioner within 72 hours, as required by the Data Protection Act 2019, and we will inform affected users without undue delay.
Data ownership
Your school owns its data. Enaton acts as a data processor on behalf of the school, and the school is the data controller.
- Schools keep full ownership of everything entered into the platform
- Enaton processes that data solely in order to provide the services the school subscribed to
- Schools can export their data at any time in standard formats
- On termination, a school has 30 days to export its data before deletion
Data retention
We keep your data only for as long as we need it to provide our services and to meet our legal obligations.
Data is retained for as long as the school’s subscription runs.
Data is retained for 30 days so it can be exported, then securely deleted.
Payment records may be retained for up to 7 years, as required by Kenyan tax and accounting regulations.
Removed from all backup systems within 90 days of account deletion.
International transfers
Our primary infrastructure is hosted in secure data centres. Where data may be transferred outside Kenya, for example through a cloud provider, we make sure equivalent data protection standards are maintained as required by the Data Protection Act 2019. Every such transfer is governed by an appropriate data processing agreement with the provider concerned.
Your rights
Under the Kenya Data Protection Act 2019 you have the following rights.
Ask for a copy of the personal data we hold about you.
Ask us to correct data that is inaccurate or incomplete.
Ask us to delete your personal data, subject to our legal obligations.
Ask us to limit how we process your data.
Object to processing based on legitimate interest, or to direct marketing.
Receive your data in a structured, machine readable format.
To exercise any of these rights, write to us at enatoninvestments@gmail.com or contact@enatontech.com. We will respond within 7 days, as required by the Data Protection Act 2019. Parents and guardians may exercise these rights on behalf of their children.
Cookies
We use cookies and similar technologies on our platform for two things.
- Essential cookies, which are required for signing in, for keeping your session and for security
- Analytics cookies, which help us understand how the platform is used so we can improve it
You can manage cookie preferences through your browser settings. Disabling essential cookies may stop parts of the platform working.
Changes to this policy
We may update this privacy policy from time to time, to reflect a change in our practices or in the law. We will tell you about significant changes by email or by a prominent notice on the platform. Continued use of our services after that notice means you accept the updated policy.
Contact us
If you have a question about this policy, or you want to exercise your data protection rights, reach us here.
- Office of the Data Protection Commissioner
- Republic of Kenya
- www.odpc.go.ke
If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with the Office of the Data Protection Commissioner.