Privacy Policy

01Our Commitment

PayDesk is operated by G3 Labs in Nairobi, Kenya. Our institutional clients entrust us with sensitive data about children, their families, and school finances. Privacy is not a feature of this platform; it is a condition of it.

This policy explains what we collect, why, how long we keep it, who else touches it, and what you can require us to do. It is written to meet the Kenya Data Protection Act, 2019 and the regulations made under it. G3 Labs Limited, which operates PayDesk, is registered with the Office of the Data Protection Commissioner (ODPC) of Kenya as a Data Processor, registration number 628-7798-B0C8, valid from 9 June 2026 to 9 June 2028.

02Who Controls Your Data

This distinction matters, because it determines who you go to with a request:

03Data We Collect

To provide our school management services, we process these categories of information:

• Institutional Info

  School name, licence details, and administrative contact information.

• Academic Records

  Enrolment, class placement, attendance, assessment and grading data.

• Financial Data

  Invoices, fee structures, M-Pesa transaction references and payment history.

• Location Data

  Vehicle position during an active school transport run, and boarding events.

• Contact Data

  Parent and guardian names, phone numbers and email addresses.

• Security Data

  Sign-in events, IP address, and an audit trail of actions taken in the system.

04Children's Data

05How We Use Data

We process data to deliver the service the school has contracted us for, to meet our legal obligations, and to keep the platform secure. Specifically:

• Issue invoices, reconcile M-Pesa payments and maintain fee balances.
• Record attendance, assessments and results, and produce report cards.
• Show a linked guardian where their child’s vehicle is during an active transport run.
• Send notifications by SMS, email and in-app message to authorised recipients.
• Produce financial and academic reports for school management.
• Detect abuse, investigate incidents and maintain the audit trail.

We do not sell personal data, we do not share it with advertisers, and we do not use school or student data to train third-party models.

06Who Else Processes Your Data

We use a small number of sub-processors. Each is bound by contract to process data only on our instructions and to protect it to the standard set out in this policy. A current list of named providers is available to subscribing schools on request.

07Transfers Outside Kenya

Payment and SMS processing happen in Kenya. Some of the infrastructure we rely on, shown in the table above, stores or processes data outside Kenya. Where that happens we rely on the safeguards permitted by sections 48 and 49 of the Data Protection Act, 2019: contractual protections with the provider, encryption in transit and at rest, and a transfer limited to what the service actually requires. We will tell affected schools before adding a sub-processor that materially changes where their data is held.

08How Long We Keep Data

We keep personal data only as long as it is needed for the purpose it was collected for, or as long as Kenyan law requires:

• Student academic and enrolment records

  For as long as the school subscribes, plus 90 days after termination.

• Financial and billing records

  Seven years, to meet Kenyan tax and audit obligations.

• Transport location history

  Rolling 90 days, then deleted.

• Communication logs (SMS, email, in-app)

  Two years, for delivery-dispute resolution.

• Security and audit logs

  Two years.

09Your Rights

Under the Data Protection Act, 2019 you have the right to:

• Be informed of how your personal data is being used.
• Access the personal data we hold about you.
• Request correction of data that is inaccurate or incomplete.
• Request deletion of your personal data where we have no lawful reason to keep it.
• Object to processing, and to withdraw consent where consent is the basis we rely on.
• Receive a copy of your data in a portable, machine-readable format.

10Security and Breach Notification

Data is encrypted in transit and at rest. Access is governed by role-based permissions, so staff see only what their role requires, and every consequential action is written to an audit trail. Details of our security posture are on our security page.

11Data Sovereignty

We believe in institution-owned data. We never sell student or institutional data to third parties, and we do not use your data for advertising. Your school retains full control over its records and can export them at any time, including on termination.

Changes to This Policy

We update this policy as the platform changes. The date at the top reflects the current version. Where a change materially affects how we handle personal data, we notify subscribing schools before it takes effect.