Privacy Policy

1. Data We Collect

Account Data: Name, email address, phone number, country, and password (hashed).

Tutor KYC Data: Government-issued identification documents collected for identity verification only.

Payment Data: Transaction references, M-Pesa phone numbers, and Stripe session identifiers. We do not store full card numbers.

Usage Data: Pages visited, lessons completed, quiz results, and learning progress.

Device Data: IP address, browser type, device type, and operating system collected automatically via server logs.

2. How We Use Your Data

• To create and manage your account.
• To process course purchases and tutor payouts.
• To verify tutor identities and comply with anti-fraud obligations.
• To personalise your learning experience.
• To send transactional emails (receipts, certificates, password resets).
• To improve the Platform through aggregated analytics.
• To comply with legal obligations under Kenyan law.

3. Legal Basis for Processing

• Contract performance — to deliver the service you signed up for.
• Legitimate interests — fraud prevention, security, and platform improvement.
• Legal obligation — tax records, KYC compliance, and regulatory reporting.
• Consent — for marketing emails (you may opt out at any time).

4. Data Sharing

We do not sell your personal data. We share data only with:

• Safaricom (M-Pesa) — to process mobile money payments.
• Stripe Inc. — to process card payments (Stripe's privacy policy applies).
• Hosting providers — for server infrastructure under data processing agreements.
• Law enforcement — where required by a valid Kenyan court order or legal process.

5. Data Retention

• Account data is retained for as long as your account is active.
• After account deletion, data is retained for 7 years for tax and legal compliance.
• KYC documents are retained for 5 years after the tutor's last active subscription.
• Server logs are deleted after 90 days.

6. Your Rights

Under the Kenya Data Protection Act and applicable law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data (subject to legal retention obligations).
• Object to or restrict certain processing.
• Data portability (receive your data in a machine-readable format).
• Lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

To exercise these rights, email privacy@ntglobalacademy.com. We will respond within 30 days.

7. Security

We implement industry-standard security measures including encrypted storage, HTTPS-only access, hashed passwords, and restricted staff access. However, no system is completely secure. Report any suspected security breach to security@ntglobalacademy.com immediately.

8. Children's Privacy

The Platform is not directed to children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, please contact us immediately for removal.