Privacy Policy

Last updated: January 2025

Introduction

This Privacy Policy explains how Kondago Solutions Limited ("Kondago Solutions", "Gredli", "we", "us" or "our") collects, uses, stores and protects information when a school, teacher, learner or parent uses the Gredli mobile application, web application (app.gredli.com), or website (gredli.com), collectively referred to as "Gredli" or the "Service".

This policy is written to comply with the Kenya Data Protection Act, 2019, and applies to all users of Gredli, whether based in Kenya or elsewhere.

Data controller

The data controller responsible for the information described in this policy is:

What we collect

We collect different categories of information depending on who is using Gredli.

From schools and teachers

• Name, phone number and email address of the person registering a school
• School name, level (primary, junior or senior) and class structure
• Subjects, assessments and marks entered by teachers
• Login and account activity within the app

From learners

• Full name
• Gender
• Assessment marks and grades

Gredli does not collect learner date of birth, home address, national ID or photographs. Only the information listed above is collected for learners.

From parents and guardians

• Phone number, used for SMS communication and push notification related updates

Parents do not currently need to create an account to use Gredli, and their phone numbers are added by the school, with the number provided directly by the parent or guardian.

Technical information

• Device type and operating system
• App usage and crash information, used to improve reliability
• General location information such as country, used for regional settings

Learner and children's data

Gredli is used to record assessment data for learners in primary, junior and senior schools, including children from around 9 years of age. We treat this data with particular care.

• Only the minimum information needed for assessment purposes is collected: name, gender and marks.
• Learner data is entered and managed by the school, through registered teachers and administrators, not directly by learners themselves.
• Schools are responsible for ensuring that enrolling a learner on Gredli is appropriate and, where relevant, that parents or guardians are informed. See "School responsibilities" below.
• Learner data is used only to generate assessment records, report forms and merit lists for that learner, and is not used for advertising or sold to third parties.

Parent contact information

A parent or guardian's phone number is collected so that Gredli can send assessment results, payment reminders, or school announcements by SMS, on behalf of the school. This number is issued directly by the parent to the school, and the school is responsible for confirming that the parent has agreed to receive these messages.

We do not currently require parents to create a Gredli account. This may change in the future, at which point this policy will be updated and parents will be informed directly.

Payments and M-Pesa

Paid subscriptions are processed through M-Pesa, using the Safaricom Daraja API. When a school upgrades to a paid plan, an M-Pesa payment prompt is sent to the phone number provided by the school.

• Gredli does not see, collect or store your M-Pesa PIN.
• Gredli does not store your M-Pesa account balance or full account details.
• We retain a record of the transaction reference, amount and date for accounting and support purposes.
• Payment processing is handled directly between your phone, Safaricom, and the Daraja API.

How we use data

We use the information we collect to:

• Provide the core functionality of Gredli, including assessment creation, marks entry, report forms and merit lists
• Send SMS notifications to parents on behalf of the school, where a phone number has been provided
• Send push notifications to teachers about payments and assessment changes
• Process payments for paid subscriptions
• Provide customer support
• Maintain the security and reliability of the Service
• Improve Gredli based on how it is used

We do not use learner or parent data for advertising, and we do not sell personal data to third parties.

Legal basis for processing

Under the Kenya Data Protection Act, 2019, we process personal data on the following bases:

• Contractual necessity: processing school, teacher and learner data is necessary to provide the Gredli service that a school has signed up for.
• Consent: a teacher accepts these Terms and this Privacy Policy on behalf of the school when registering, and confirms that parents have provided their phone numbers voluntarily for the purposes described here.
• Legitimate interest: technical and usage data is processed to maintain and improve the reliability of the Service.

Sharing of data

We share data only in the following circumstances:

• Service providers: Supabase (database and backend infrastructure), Firebase (push notifications), and the Safaricom Daraja API (payments and SMS), each of which processes data strictly to provide their respective service to us.
• Within a school: assessment data is visible to authorised teachers and administrators within that school.
• Legal requirements: where required by Kenyan law or a valid legal request.

We do not sell, rent or trade personal data to third parties for marketing purposes.

Data retention and deletion

• School, teacher, learner and parent data is retained for as long as the school's account remains active.
• If a school stops using Gredli or closes its account, data is archived for 12 months, after which it is permanently deleted.
• A school administrator may request deletion of their school's data before the 12 month period by contacting us directly.
• Payment transaction records may be retained longer where required for accounting or legal purposes.

Data security

We take reasonable technical and organisational measures to protect the data on Gredli, including access controls limiting data visibility to authorised users within a school, encrypted data transmission, and secure cloud infrastructure through Supabase. No system can be guaranteed completely secure, and we encourage schools to use strong passwords and keep login credentials confidential.

Your rights

Under the Kenya Data Protection Act, 2019, you have the right to:

• Request access to personal data we hold about you or, for a school administrator, about your school
• Request correction of inaccurate data
• Request deletion of data, subject to any legal or contractual retention requirements
• Object to certain uses of your data
• Withdraw consent where processing is based on consent, such as SMS communication to parents

To exercise any of these rights, contact us using the details in the "Contact us" section below. Requests relating to learner data should generally be directed to the learner's school first, as the school manages that learner's record.

School responsibilities

Schools using Gredli, through their registered teachers and administrators, are responsible for:

• Ensuring that enrolling a learner's data on Gredli is appropriate and in the learner's best interest
• Obtaining a parent or guardian's phone number directly and voluntarily from the parent or guardian before adding it to Gredli
• Informing parents that SMS communication will be sent regarding assessment results, payments and school announcements
• Keeping login credentials for admin and teacher accounts secure
• Ensuring that only authorised staff have access to the school's Gredli account

Changes to this policy

We may update this Privacy Policy from time to time as Gredli evolves, for example if parent accounts are introduced in the future. Material changes will be communicated to registered schools, and the "Last updated" date at the top of this page will reflect the most recent revision.

Contact us

If you have questions, concerns, or requests relating to this Privacy Policy or your data, contact us: