1. Purpose and scope
This policy governs personal information handled by Synapse Global Institute Limited in admissions, teaching, assessments, student support, employment, institutional administration and online services. It applies to staff, instructors, authorised contractors and others handling information on SGI’s behalf. SGI determines the purposes of its institutional processing; service providers may process information under its instructions. This policy must be read with the Privacy Policy and any service-specific notice.
2. Accountability and applicable law
SGI must handle personal data under Kenya’s Data Protection Act, 2019 and applicable Data Protection Regulations. Institutional management is responsible for allocating oversight, maintaining required registrations and ensuring that departments follow this policy. Department heads must identify the information they handle, its purpose, permitted users, disclosures and retention requirements. admin@sgi.ac is the institutional privacy contact; this address does not represent a claim that a named statutory Data Protection Officer has been appointed.
3. Principles and lawful grounds
Information must be obtained fairly for a stated purpose, limited to what that purpose requires, kept accurate and protected against misuse. Each activity must have a documented lawful ground, such as performing an enrolment contract, complying with a legal duty, a properly assessed legitimate interest or valid consent where required. Consent must be specific and freely given; it must be possible to withdraw it without invalidating earlier lawful processing. Merely visiting the website is not consent to every use of personal data.
4. Collection, notices and sensitive information
Collect information directly from the individual where practicable. Before collection, explain the purpose, required and optional fields, intended recipients, relevant rights and consequences of not providing required information. Indirect collection needs a lawful justification and appropriate notice. Identity documents, disability or health information, counselling records and other sensitive information require particular care and restricted access. Do not collect detailed sensitive information in general enquiry forms where a secure, limited-purpose channel is appropriate.
5. Children and safeguarding
For learners under 18, SGI must establish age-appropriate enrolment arrangements, verify parental or guardian authority when required, and apply the legal conditions for processing children’s information. The child’s best interests must guide processing. Learner photographs, publicity and optional recordings must not be treated as automatically authorised by enrolment. Information must not be disclosed to a purported parent or sponsor without checking authority and the applicable lawful basis.
6. Access, security and staff responsibilities
Access must follow assigned duties and be reviewed when staff change roles or leave. Staff must use approved institutional systems, protect authentication details, verify recipients before sending records, and report suspected compromise. Personal email, unapproved cloud storage and public AI tools must not be used for confidential learner records without an authorised assessment and safeguards. Security measures must be proportionate to the information and risks, including appropriate authentication, access controls, protected transfers, backups and secure disposal. No system can promise absolute security.
7. Teaching, online meetings and automated tools
Attendance, assessment submissions and learning activity may be used for educational delivery and legitimate academic administration. Participants must be told before a meeting is recorded, why recording is needed, who can access it and how long it will be kept. Private counselling sessions require stronger confidentiality controls. AI-assisted marking or support must be subject to appropriate human oversight, data minimisation and review routes. A student may ask SGI to explain or review a decision that significantly affects them, including where automated processing is involved.
8. Sharing, suppliers and international transfers
Disclose information only to recipients with an identified lawful purpose, such as authorised educational staff, payment or hosting providers, examination bodies or competent authorities. Vendors must receive only the information needed for their service and be subject to appropriate contractual confidentiality, security, incident-reporting and deletion obligations. Assess hosting and support locations before transferring information outside Kenya and establish the applicable legal safeguards. This policy is not a statement that all SGI data is stored in Kenya or that every supplier has been independently audited.
9. Retention and disposal
Departments must maintain documented retention criteria for applications, academic records, assessment evidence, finance records, employment records, correspondence, recordings and support records. The criteria must reflect their purpose, statutory requirements, accreditation needs and any lawful dispute hold. Keep identifiable data only for as long as justified; securely delete or anonymise it when that justification ends. Backup copies must be covered by a controlled expiry process. A person requesting deletion must be told where a lawful retention obligation prevents immediate removal.
10. Individual rights and requests
Send requests to admin@sgi.ac with the subject “Data protection request”. Identify the record or issue and give a safe way to contact you. SGI may request proportionate identity or representative-authority evidence, but must not demand unnecessary documents. Depending on the applicable conditions, individuals may seek information about processing, access, correction, objection, restriction, erasure, portability and withdrawal of consent, and challenge qualifying automated decisions. Requests must be logged, routed to the responsible officer and answered within the applicable legal period, with reasons and escalation options where a request cannot be fully met.
11. Incidents and breach response
Report lost devices, misdirected messages, suspected unauthorised access or exposed records promptly to admin@sgi.ac and telephone +254 100 000 050. Preserve relevant evidence; do not forward exposed records unnecessarily. Management must assess and contain the incident, document affected information and risks, and coordinate recovery. Where the statutory notification threshold is met, SGI must notify the ODPC without delay and within 72 hours of awareness; any delay must be explained. Affected individuals must receive legally required communication. Processors must report to SGI without delay and, where reasonably practicable, within 48 hours of awareness.
12. Assessments, training and review
Before introducing high-risk processing, management must assess whether a data protection impact assessment is required and complete it before deployment. Staff handling personal information must receive suitable guidance. Management must review incidents, access permissions, supplier arrangements and retention practices, and update this policy when laws or material services change. Publication of this policy does not certify completion of every operational control; departments remain responsible for implementation.
13. Complaints and external oversight
Raise concerns with admin@sgi.ac; general support is available at info@sgi.ac and +254 100 000 050. You may also complain directly to Kenya’s Office of the Data Protection Commissioner without first exhausting SGI’s process: https://www.odpc.go.ke/file-a-complaint/ ; enquiries@odpc.go.ke or info@odpc.go.ke ; telephone 020 780 1800. SGI must cooperate with lawful regulatory enquiries and must not penalise a person for raising a good-faith privacy concern.
14. Contact details and legal references
Synapse Global Institute Limited (SGI) Privacy, data-protection and refund escalation: admin@sgi.ac General enquiries and student support: info@sgi.ac Telephone / WhatsApp: +254 100 000 050 Office: PostBank House, Banda Street, 3rd Floor, Nairobi, Kenya Postal address: P.O. Box 25970–00100, Nairobi, Kenya Published office hours: 8:00 AM–5:00 PM, East Africa Time. Email may be sent outside office hours. Never send passwords, one-time codes or card PINs.
Kenyan data protection legislation and regulations: https://www.odpc.go.ke/data-protection-laws-kenya/ Rights guidance: https://www.odpc.go.ke/rights-of-a-data-subject/ This policy takes effect on 25 October 2026. Material changes will be published with a revised version and effective date.