Privacy & Data Policy.

This policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have over it, in plain language, in line with Kenya’s Data Protection Act, 2019.

Last updated: 01 September 2026 · Effective from: 01 September 2026

1. Who We Are

Tutor Republic is operated by B-House Limited, a company registered in Kenya, trading as both Tutor Republic and School Republic. Because “Republic” cannot itself be registered as a company name in Kenya, B-House Limited is the legal entity responsible for both platforms, and the data controller for the purposes of this policy and the Data Protection Act, 2019.

• Registered company: B-House Limited
• Company registration number:
• KRA PIN: 
• Registered office: 
• Operating address: KOFISI Kaskazi, 19 General Mathenge Drive, Westlands, Nairobi, Kenya
• Data protection contact: Our support team – info@tutorrepublic.co.ke

2. Who This Policy Applies To

This policy applies to:

• Parents and guardians registering a child with any Tutor Republic programme
• Adult learners registering for their own studies, including KCSE Academy’s Last Chance track
• Visitors to tutorrepublic.co.ke and schoolrepublic.co.ke
• Teachers and staff engaging with our systems in a professional capacity (governed separately by internal HR policies where applicable)

Where we refer to “you” or “your” below, and you are a parent or guardian registering on behalf of a child, this includes both your own personal data and the data you provide about your child.

3. What Personal Data We Collect

We collect only what we need to deliver, bill for, and safely run our programmes. This includes:

Parent or Guardian Information
Full name, relationship to student, phone number, WhatsApp number, email address, occupation, county or country of residence, and how you heard about us.

Student Information
Full name, date of birth, gender, current grade or programme, school name and type, academic goals, previous tutoring history, and the subjects and format you select.

Scheduling & Technical Information
Preferred class times, time zone, device type, internet connection quality, and general technical readiness for live online classes.

Sensitive Personal Data
Special educational needs or learning considerations, and medical notes relevant to your child’s safety and participation. This is sensitive personal data under the Data Protection Act, 2019, and we collect it only where you choose to provide it, only to ensure your child is properly supported, and we apply additional care to how it is stored and who can access it internally.

Emergency Contact Information
Name, phone number, and relationship of an emergency contact, used only if we are unable to reach you during a class.

Payment Information
We do not directly store your full card or M-Pesa details. Payments are processed through Paystack, a licensed third-party payment processor, who handles this data under their own security standards and privacy policy. We retain only the transaction outcome, amount, and reference needed for your records and ours.

Communications
Messages sent to us via WhatsApp, email, or our contact form, and, where you’ve explicitly agreed to it, your inclusion in our email updates through Mailchimp.

Consent & Signature Records
The specific consents you gave at registration (data processing, class recording, marketing communications, and terms acceptance), and your digital or written signature, kept as evidence that consent was properly obtained.

4. Children’s Data

Most of the students we teach are children. Where a child is registered by a parent or guardian, the parent or guardian provides consent on the child’s behalf, and remains the primary point of contact for any data protection request relating to that child.

We do not knowingly collect personal data directly from a child without a parent or guardian’s involvement in the registration process. If you become aware that your child has provided us with information outside of a supervised registration, please contact us so we can review and, where appropriate, remove it.

5. Why We Collect It, And Our Lawful Basis

Under the Data Protection Act, 2019, we rely on the following lawful bases, depending on the specific data involved:

• Consent:  for sensitive personal data (special needs, medical notes), class recordings, and marketing communications, all of which are optional and separately consented to
• Contractual necessity: for the information required to register you, schedule classes, and process payment
• Legal obligation: for information we’re required to keep for tax, financial, or regulatory purposes
• Legitimate interest: for basic security, fraud prevention, and service improvement, always balanced against your right to privacy

You may withdraw consent for anything given on that basis at any time, without affecting the lawfulness of anything already done.

6. How We Use Your Information

We use the information above to:

• Register you or your child and issue a permanent admission number
• Schedule and deliver live classes with the right teacher, format, and timing
• Process registration and subject fees, including Lipa Pole Pole instalments
• Communicate with you about your child’s progress, schedule changes, and account status
• Provide reasonable support around special needs or medical considerations you’ve disclosed
• Send marketing updates, only if you’ve explicitly opted in
• Meet our own legal, tax, and regulatory obligations
• Investigate and respond to safeguarding concerns, where necessary

We do not use your data, or your child’s data, for automated decision-making that produces legal or similarly significant effects, and we do not sell personal data to third parties, ever.

7. Who We Share Your Information With

We share personal data only where necessary, and only with organisations bound to protect it:

We do not transfer personal data outside Kenya except where a third-party processor (such as Paystack or Mailchimp) operates infrastructure abroad, in which case we rely on that provider’s own compliance with adequate data protection standards, consistent with the cross-border transfer provisions of the Data Protection Act, 2019.

8. Class Recordings & The Vault

Where you’ve given consent, live classes may be recorded for quality assurance, safeguarding, and as a revision resource available through The Vault to enrolled students only. Recordings are not made public, not shared outside Tutor Republic, and not used for any purpose beyond what’s described here without asking you again.

9. How Long We Keep Your Information

We keep personal data for as long as your child is an active student, plus a reasonable period afterward to meet our legal, tax, and safeguarding record-keeping obligations. Sensitive personal data, such as medical notes, is reviewed and removed once it’s no longer relevant to active enrollment, unless we’re legally required to retain it longer.

10. How We Protect Your Information

We apply reasonable technical and organisational measures to protect your data against unauthorised access, loss, or misuse, including restricted internal access to sensitive personal data, secure payment processing through a licensed third party, and access controls on our systems. No system is perfectly secure, and we continue to review and improve these measures as our platform grows.

11. Your Rights As A Data Subject

Under the Data Protection Act, 2019, you have the right to:

• Be informed of how your data is used, which this policy is intended to do
• Access the personal data we hold about you or your child
• Request correction of inaccurate or outdated data
• Request deletion of your data, subject to our legal retention obligations
• Object to processing carried out on the basis of legitimate interest
• Withdraw consent at any time, for anything based on consent
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your rights have been violated

To exercise any of these rights, contact us at info@tutorrepublic.co.ke or through our Contact Us page. We’ll respond within a reasonable time, consistent with our obligations under the Act.

Office of the Data Protection Commissioner
Britam Towers, Upper Hill, Nairobi
Website: www.odpc.go.ke

12. Cookies & Website Analytics

Our website may use cookies or similar technologies for basic functionality and to understand how visitors use our site. [Confirm exact analytics/cookie tools in use before publishing, this section needs to name them specifically once confirmed.]

13. Marketing Communications

We only add you to our mailing list if you explicitly opt in during registration. You can unsubscribe at any time using the link in any marketing email, or by contacting us directly. Opting out of marketing does not affect essential communications about your child’s classes, schedule, or account.

14. Data Breach Notification

In the event of a data breach likely to result in risk to your rights, we will notify the ODPC within the timeframe required by law, and inform affected individuals without undue delay, along with what happened and what steps we’re taking.

15. Changes To This Policy

We may update this policy as our programmes, systems, or legal obligations evolve. Material changes will be reflected here with an updated effective date, and where appropriate, communicated directly to registered families.

16. Contact Us

Questions about this policy or how your data is handled: info@tutorrepublic.co.ke, or via our Contact Us page. See also our Terms & Conditions.