Data Protection

1. Controller and processor roles

Under the Kenya Data Protection Act, 2019, the subscribing school is the data controller — it determines the purposes and means of processing personal data relating to its learners, staff, and parents. SomaSmart (Alphawonders) is the data processor, processing that data only on the documented instructions of the school. Where SomaSmart determines its own purposes — for example, account administration, billing, and platform security — it acts as a controller for that limited data.

2. Categories of data and data subjects

On behalf of schools, we process personal data relating to:

• Learners (often minors) — identity, class, attendance, assessments, CBC competency grades, report cards, and AI tutor activity;
• Teachers and staff — identity, contact details, timetables, and teaching activity;
• Parents and guardians — identity, contact details, fee and payment records, and portal messages;
• Administrators — identity, roles, and audit records.

3. Sub-processors

We engage carefully selected sub-processors to deliver the service. Each is bound by contractual confidentiality and security obligations, and processes data only to provide their specific function:

• AI providers — OpenAI, Anthropic (Claude), Groq (and self-hosted models where used): AI tutoring, lesson planning, quiz generation, and grading assistance.
• Payment processors — Safaricom M-Pesa (Daraja API) and Paystack: KES subscription and fee payments.
• Messaging — Africa's Talking: bulk SMS to parents and staff.
• Infrastructure and monitoring — cloud hosting and error tracking (Sentry): running and securing the platform.

We maintain an up-to-date list of sub-processors and will inform subscribing schools of material changes so they can raise reasonable objections.

4. Security measures

We implement technical and organisational measures appropriate to the risk, including:

• encryption of data in transit using TLS/HTTPS;
• password hashing with bcrypt and JWT authentication with token blacklisting;
• role-based access control (RBAC) and strict multi-tenant isolation scoped by school;
• rate limiting and abuse prevention;
• audit logging and centralised error monitoring;
• least-privilege access controls for staff and sub-processors;
• regular review of access, dependencies, and security configuration.

5. Data residency and international transfers

We aim to handle school data consistently with Kenyan data residency expectations. Certain sub-processors may process data outside Kenya. Where international transfers occur, we rely on safeguards permitted by the Data Protection Act, 2019 — including contractual protections and appropriate adequacy assessments — and limit such transfers to what is necessary to deliver the service.

6. Personal data breach notification

We maintain procedures to detect, investigate, and respond to personal data breaches. Where a breach affecting a school's data occurs, we will notify the affected school without undue delay after becoming aware of it, providing the information the school needs to meet its own obligations. As the data controller, the school is responsible for notifying the Office of the Data Protection Commissioner (ODPC) and affected data subjects where the Act requires, and we will provide reasonable assistance to support that.

7. Assisting with data-subject requests

Data subjects (learners via their guardians, parents, and staff) exercise their rights — access, correction, deletion, objection, restriction, and portability — primarily through the school as controller. Where SomaSmart receives a request directly, we will refer it to the relevant school and will not respond substantively without the school's instructions, except as required by law.

How schools exercise and fulfil requests:

• administrators can view, correct, and export many records directly within the platform;
• for deletion, restriction, or bulk export beyond in-app tools, the school's authorised administrator or DPO can contact us at info@alphawonders.com;
• we respond to verified controller instructions within the timeframes required by the Act;
• we help the school meet statutory response deadlines by providing the technical means to locate, correct, or remove data.

8. Retention and deletion

We retain personal data for the duration of the school's subscription and as instructed by the school, subject to legal retention obligations (for example, academic and financial records). On termination, we return or securely delete School Content in line with the school's agreement, except where the law requires continued retention.

9. Children's data

Much of the data we process concerns minors. We apply additional care in line with the Data Protection Act, 2019, and process children's data strictly on the school's instructions. Schools are responsible for obtaining and recording any parental or guardian consent required by Kenyan law.

10. Data Protection Officer and contact

For data-protection matters, including sub-processor questions, DPAs, breach queries, and data-subject request support, contact:

Data Protection Contact — Alphawonders (operator of SomaSmart)
Concert House, Wood Garden Rd, Kilimani, Nairobi
Mon-Fri 8AM-5PM · Sat 9AM-1PM
Email: info@alphawonders.com
Web: somasmart.site

Data subjects also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya.