Privacy Policy
Last updated: 04 November 2026 | Effective: 04 November 2026
This Privacy Policy explains how Kioto ("Kioto iLMS", "we", "us", "our") collects, uses, stores, shares, and protects your Personal Data when you use our intelligent learning management system (the "Service"). It is designed to comply with the Kenya Data Protection Act, 2019 ("DPA 2019") and reflects principles of the EU General Data Protection Regulation (GDPR) and other applicable standards.
By using the Service you acknowledge that you have read and understood this Policy. If you do not agree, please do not use the Service.
1. Data Controller
The data controller is Kioto, operating the Service on behalf of your Institution. For the data your Institution collects through the Service, your Institution acts as an independent or joint controller. Queries about Institutional processing should be directed to your Institution's administrator. Queries about Platform-level processing should be directed to our Data Protection Officer (see Section 16).
2. Personal Data We Collect
We collect the following categories of Personal Data:
2.1 Account & Profile Data
- Full name, email address, phone number (optional), role (student/lecturer/administrator), and Institution affiliation.
- Authentication credentials (password stored as a one-way hash; we never store plaintext passwords).
- Profile metadata (avatar, preferences, notification settings).
2.2 Academic & Activity Data
- Unit enrolments, assignments, submissions (files, text, code), grades, feedback, discussion posts, and forum participation.
- Class activity signals: page views, login timestamps, last-seen indicators, and submission events (used to support learning and lecturer oversight).
- AI evaluation results (draft scores/feedback) and lecturer-approved final grades.
2.3 Communications Data
- Messages sent through in-app discussions and notifications.
- Telegram chat identifiers and message content where you link a Telegram account.
- Email correspondence with support.
2.4 Technical & Usage Data
- IP address, browser type, device identifiers, operating system, and request logs.
- Session identifiers and cookies (see Section 9).
- Error and performance telemetry (aggregated, non-identifying where possible).
2.5 Data You Provide Voluntarily
Any additional information you choose to submit (e.g., in discussion posts or profile fields).
3. Lawful Basis for Processing (DPA 2019 / GDPR)
We process Personal Data on one or more of the following lawful bases:
- Contract — to provide the Service to you and your Institution.
- Legitimate interests — to operate, secure, and improve the Service, and to support academic integrity and learning analytics.
- Consent — where you opt in (e.g., Telegram linking, optional profile fields, marketing communications). You may withdraw consent at any time.
- Legal obligation — to comply with applicable laws, court orders, or regulatory requirements.
- Vital interests — where necessary to protect life or safety.
Where processing is based on consent, withdrawal does not affect processing already carried out.
4. Purposes of Processing
- Creating and managing user Accounts and roles.
- Delivering course content, assignments, submissions, grading, and feedback.
- Facilitating class discussions and notifications.
- Providing AI-assisted evaluation as a draft for lecturer review.
- Monitoring class engagement and academic progress for lecturers and administrators.
- Securing the Service, preventing fraud and abuse, and maintaining audit logs.
- Complying with legal and regulatory obligations.
- Improving and developing the Service (using aggregated, de-identified data where possible).
5. AI Processing and Automated Decisions
5.1 Assignment content may be transmitted to our AI provider (see Section 6) to generate draft scores and feedback.
5.2 AI output is a draft suggestion only. It is never a final grade and is always subject to human review and approval by a lecturer or authorised marker. No decision producing legal or significant effects is made solely by automated means.
5.3 You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (DPA 2019 s.35; GDPR Art. 22). Because all AI output requires human approval, this right is preserved. If you believe an automated process affected you without human review, contact us.
5.4 We conduct (and will keep under review) a Data Protection Impact Assessment for high-risk processing such as AI evaluation, in line with DPA 2019 s.31.
6. Sharing and Third-Party Processors
We share Personal Data only where necessary and under appropriate safeguards:
- Your Institution — administrators and lecturers access data needed to manage classes, grading, and compliance.
- AI provider (Groq) — submission content and relevant context are sent to generate draft evaluation. Groq acts as a processor under its own terms; data is processed in accordance with its privacy policy. Where an Institution supplies its own API key, that Institution's arrangement with the provider applies.
- Email delivery providers — to send transactional emails (verification, password reset, notifications).
- Telegram — where you link an account, your Telegram chat ID and messages are exchanged with Telegram's service.
- Hosting and infrastructure providers — servers and storage under confidentiality and security obligations.
- Legal authorities — where required by law, court order, or to protect rights and safety.
We do not sell Personal Data. We do not share Personal Data for third-party marketing.
7. Cross-Border Transfers
Some processors (including the AI provider) may process data outside Kenya. Where this occurs, we ensure appropriate safeguards are in place (contractual clauses, adequacy, or your consent) in line with DPA 2019 s.48 and GDPR Chapter V. By using AI features you acknowledge this transfer. You may opt out of AI features by not submitting to them or by your Institution disabling them.
8. Data Retention
- Account and academic records are retained for the duration of your enrolment/employment plus a reasonable period thereafter as required by your Institution or law (typically up to 7 years for academic records).
- Class activity logs (page views, logins) are retained for a limited period (default 30 days for raw logs) and then aggregated or deleted.
- AI evaluation logs and audit trails are retained for academic integrity and audit purposes.
- On Account deletion we remove or anonymise Personal Data, except where retention is required by law or legitimate audit needs.
9. Cookies and Tracking
We use cookies and similar technologies for:
- Essential cookies — session management, authentication, and security (required for the Service to function).
- Preference cookies — remembering settings such as theme or language.
- Analytics cookies — aggregated usage statistics to improve the Service (where enabled).
You can control cookies through your browser settings; disabling essential cookies may impair functionality. We do not use third-party advertising cookies.
10. Security
We implement appropriate technical and organisational measures to protect Personal Data, including:
- Encryption in transit (HTTPS/TLS) and at rest for sensitive fields.
- Password hashing using industry-standard algorithms.
- Role-based access control and least-privilege principles.
- Audit logging of sensitive actions.
- Regular review of access and security controls.
No system is completely secure. You are responsible for keeping your credentials confidential. Report suspected breaches to us immediately.
11. Children and Minors
The Service is intended for users 18 and over, or younger users with verifiable parental or guardian consent. We do not knowingly collect Personal Data from children under 13 without parental consent. If you believe a child has provided data without consent, contact us and we will delete it.
12. Your Rights (DPA 2019 Section 26)
Subject to applicable law, you have the right to:
- Access — request a copy of the Personal Data we hold about you.
- Rectification — request correction of inaccurate or incomplete data.
- Erasure — request deletion of your data ("right to be forgotten"), subject to legal retention requirements.
- Restriction — request that we limit processing of your data.
- Portability — receive your data in a structured, commonly used, machine-readable format.
- Objection — object to processing based on legitimate interests, including profiling.
- Withdraw consent — where processing is based on consent.
- Not to be subject to solely automated decisions — see Section 5.3.
To exercise these rights, contact our Data Protection Officer (Section 16). We will respond within the timeframes set by DPA 2019 (generally 21 days, extendable where necessary). We may need to verify your identity before fulfilling a request.
13. Data Breach Notification
In the event of a Personal Data breach likely to result in risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner (ODPC) and affected users without undue delay, and in any event within the timeframes required by DPA 2019 s.43, together with the information required by that section.
14. Changes to This Policy
We may update this Policy from time to time. Material changes will be communicated via the Platform or email. The "Last updated" date at the top reflects the latest revision. Continued use after changes constitutes acceptance.
15. Governing Law
This Policy is governed by the laws of the Republic of Kenya, including the Data Protection Act, 2019, and should be read together with our Terms and Conditions.
16. Data Protection Officer and Contact
For privacy questions, to exercise your rights, or to report a concern, contact:
17. Complaints to the Regulator
If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya:
We encourage you to contact us first so we can resolve your concern promptly.
This Privacy Policy should be read together with our Terms and Conditions.