Legal
Privacy Policy
This policy explains how KUCIAP handles personal data, and the rights you have under the Data Protection Act, 2019. It covers both students and organizations.
1. Summary
- We collect only what we need to run the attachment portal and to connect students with organizations.
- We never sell your personal data.
- Your student profile is visible to approved organizations you apply to, and to organizations you choose to be discoverable to. You control your visibility.
- We keep data only as long as we need it, then delete or anonymise it.
- You can access, correct, delete or export your data, and you can complain to the ODPC.
This summary is a quick guide only. The sections below are the full policy and take precedence.
2. Who controls your data
KUCIAP, the Kenya University and College Attachment Portal, is the data controller for the personal data described in this policy. That means we decide why and how your data is processed.
Where an organization receives your application through KUCIAP, that organization becomes a separate data controller for the data it receives. It must protect your data and use it only for recruitment. We ask organizations to accept this in our Terms of Service.
KUCIAP is registered as a data controller with the Office of the Data Protection Commissioner (ODPC) as required by the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.
3. What we collect
We collect the following categories of personal data:
| Category | Examples |
|---|---|
| Identity and account data | Name or organization name, email address, phone number, password (stored only as a secure hash). |
| Student profile data | Institution, course of study, year of study, county, attachment county of interest, interests and skills. |
| Documents | CV, cover letters, certificates and academic records you choose to upload. |
| Application data | The attachments you apply for, messages you exchange, and the outcome of applications. |
| Organization data | Organization name, registration or KRA PIN number, industry, locations, website, description and contact person details. |
| Payment data | Mobile-money transaction references and amounts. We do not store your M-PESA PIN or full payment credentials. |
| Technical data | IP address, device and browser type, pages viewed, and security logs. |
Some fields are optional and marked as such. Others are required for an account to work; if you leave a required field blank, we may not be able to register you or process your application.
4. Why we collect it and our lawful basis
Under the Data Protection Act, 2019 we must have a lawful basis for each purpose. Our purposes and bases are:
| Purpose | Lawful basis |
|---|---|
| Create and run your account | Performance of our contract with you |
| Show opportunities and match students to them | Performance of our contract with you |
| Send an application to an organization | Your consent, given when you apply |
| Verify and approve organizations | Our legitimate interest in a trustworthy platform |
| Process premium payments | Performance of our contract with you |
| Keep the platform secure and prevent fraud and abuse | Our legitimate interest and legal obligation |
| Send service emails about your account or applications | Performance of our contract with you |
| Send optional newsletters or marketing | Your consent, which you may withdraw at any time |
| Meet tax, accounting and other legal duties | Legal obligation |
5. Student data
Student data is the most sensitive data on the platform, and we treat it with care:
- Your profile is visible to organizations you apply to, and to approved organizations that search the student directory where you have made yourself discoverable.
- We do not sell your data, and we do not pass it to advertisers.
- We do not share your data with an organization you have not applied to or chosen to be discoverable to.
- An organization may use your data only to assess your application. It must not use it for marketing or keep it after recruitment ends.
- You may withdraw an application, and you may ask us to delete your profile and documents at any time.
Your CV and other documents are private. They are only released to an organization when you apply to its listing, or where you have made your profile discoverable in the directory.
6. Organization data
We publish the profile of approved organizations so students can learn about them. A published organization profile includes the organization name, industry, locations, website and description, and the contact person's name, email and phone number. Please provide a business contact where possible.
If you give us a contact person's details, you confirm you have that person's permission to share them with us for this purpose.
7. Who we share it with
We share personal data only with:
- Organizations you apply to, or that you are discoverable to — the data needed to assess your application.
- Students — the public parts of an approved organization profile.
- Service providers (data processors) who host the platform, send email, or process payments, and who act only on our instructions.
- Professional advisers such as auditors and lawyers, where necessary.
- Authorities, where the law requires it or where we must protect the rights and safety of users.
- A successor, if the platform is transferred or merged; we would tell you first.
We require every processor to protect your data to at least the standard of the Data Protection Act, 2019.
8. Storage and cross-border transfers
Your data is stored on servers we use to run the platform. Where data is stored or processed outside Kenya, we transfer it only as permitted by the Data Protection Act, 2019, and only to a country or processor that provides an adequate level of protection or under appropriate safeguards.
9. How long we keep it
- Account and profile data: while your account is open, then deleted or anonymised within a reasonable period after you close it.
- Documents: while your profile is active, or until you delete them.
- Application records: kept while the application is live and for a short period afterwards so both sides have a record, then deleted.
- Payment records: kept as long as tax and accounting law requires.
- Security logs: kept for a limited period to detect and investigate abuse.
10. How we protect it
We protect personal data using technical and organisational measures appropriate to the risk, including:
- Encryption of data in transit using HTTPS.
- Passwords stored only as secure one-way hashes.
- Access controls, so staff and organizations see only the data they need.
- Organization accounts reviewed before their listings go live.
- Logging and monitoring to detect and respond to abuse.
- Regular review of who has access to production data.
No system is perfectly secure. If you believe your account has been compromised, contact us immediately.
11. Your rights
Under the Data Protection Act, 2019 you have the right to:
- Be informed about how your data is used — this policy does that.
- Access the personal data we hold about you, and be told its source.
- Correct inaccurate or incomplete data.
- Delete data that is no longer needed, or where you withdraw consent and there is no other basis.
- Object to processing, including processing for direct marketing.
- Restrict processing in certain circumstances.
- Portability — receive your data in a structured, commonly used format.
- Withdraw consent at any time, where consent is our basis.
- Complain to the Office of the Data Protection Commissioner.
- Not be subject to a decision based solely on automated processing that significantly affects you.
To exercise any of these rights, email info@kuciap.ink. We will respond within the time the Act allows. We may ask you to verify your identity first, so we do not release your data to someone else.
12. Students under 18
Some college and TVET students may be under 18. Where a student is under 18, we rely on consent given or authorised by a parent or guardian as required by the Data Protection Act, 2019. We collect only the data needed for the attachment, and we never use a child's data for marketing.
13. Cookies and tracking
We use a small number of cookies that are needed for the platform to work — for example, to keep you signed in, to protect forms against cross-site request forgery, and to remember your registration progress. We do not use advertising cookies and we do not sell data to ad networks.
You can control cookies in your browser settings. Blocking essential cookies may stop you from signing in.
14. Data breaches
If a breach of security leads to your personal data being lost, altered, accessed or disclosed without permission, we will notify the Office of the Data Protection Commissioner and affected users without undue delay, as the Act requires.
15. Changes to this policy
We may update this policy as the platform or the law changes. When we make a material change we will update the “Last updated” date above and, where appropriate, tell you by email or in the platform.
16. How to contact us
For any question about this policy, or to exercise your rights:
- Email: info@kuciap.ink
- Contact page: kuciap.ink/contact
You also have the right to complain to the Office of the Data Protection Commissioner, Kenya, at odpc.go.ke.