Hati hii imechapishwa kwa Kiingereza
Maandishi ya Kiingereza yaliyo hapa chini ndiyo yanayotumika. Sheria zinazotajwa kwenye hati hii zimeandikwa kwa Kiingereza, na tafsiri ya hati ya kisheria inaweza kubadilisha maana yake, kwa hivyo hati yenyewe haijatafsiriwa. Ukiwa na swali lolote kuhusu hati hii, tuandikie kupitia ukurasa wa mawasiliano.
Rasimu inayosubiri kukaguliwa kisheria nchini Kenya, 21 Septemba 2026
Maneno haya yaliandikwa kwa kuzingatia sheria za Kenya zinazotajwa ndani yake, na bado yanasubiri kukaguliwa na wakili aliyesajiliwa nchini Kenya. Huenda yakabadilika kabla ya kukamilika. Mambo ambayo bado hayajaamuliwa yamewekewa alama "In review" pale yanapotokea hapa chini.
Jinsi Eduace inavyoshughulikia taarifa binafsi za walimu wanaoiomba kazi, na za wale wanaofanya kazi nayo
Ilisasishwa mwisho: 21 Septemba 2026 (rasimu inayosubiri kukaguliwa kisheria nchini Kenya)
This policy sets out what Eduace does with personal data belonging to the teachers who apply to it, the teachers who go on to work with it, and the people who visit this website. Eduace recruits trained Kenyan teachers to teach online, live, for learners who live outside Kenya. It enrols no learner inside Kenya and sells nothing to families here, so the people described below are applicants and teachers. Eduace is the data controller for that information. When you apply, your application details are also shared with the partner teaching platform Eduace works through, so that you can set up a teacher account there, and that platform may store them outside Kenya; sections 4 and 5 of this policy set out how. Section 4 of the Data Protection Act No. 24 of 2019 applies the Act to a data controller processing the personal data of data subjects located in Kenya, whether or not that controller is established here. You are in Kenya, so the Act governs this, and this policy is written to it. Applying to Eduace is free of charge at every stage, and nobody at Eduace will ever ask you to send money or to give card or bank details in order to apply.
Four groups of people, and it is worth being exact about them, because the answer sets the shape of everything below.
Anyone who sends the application form on this website. Most of what follows concerns you, because the application is where almost all of the personal data Eduace holds comes from.
Once an application is taken further, Eduace holds a record of the subjects and hours you teach, the lessons you have accepted and taught, and the payments made to you for them.
Anyone reading these pages, whether or not they apply. What is held about a visitor is described in the sections on technical information and on cookies.
Anyone who sends a question through the contact page or by any channel listed on it, together with our reply.
Eduace runs no lessons for learners inside Kenya and takes no enquiry from a Kenyan family, so this website asks for no information about a Kenyan family or a Kenyan child. The one place a learner could appear is the recording of you teaching, and section 2 asks you to keep identifiable learners out of it. Where a teacher receives details about a learner in order to teach a lesson, the duties that apply to those details are set out in the terms of engagement.
The application is for adults of eighteen years and over. Section 33 of the Act bars the processing of a child’s personal data without the consent of a parent or guardian, and Eduace does not knowingly take a child’s personal data through this website. If you believe a child has sent us their details, tell us and we will remove them.
Almost all of it comes from you, and you can see the whole of it on the form before you send anything. Section 25(d) of the Act limits a controller to what is adequate, relevant and necessary for the purpose, so the form asks for what a person needs to assess a teaching application and for nothing beyond it.
A single form in three short steps. About you: your full name, an email address, a mobile or WhatsApp number that reaches you, the country you live in, your citizenship, and your county if you live in Kenya. Your teaching: the curricula you have taught, your subjects, the learners you have taught, your years of teaching, your Teachers Service Commission (TSC) number if you hold one, and evidence of your English. Your time: the hours you can teach, which you choose in East African Time and which are stored in Coordinated Universal Time (UTC) so that they can be set against a learner’s clock, and the hours a week you can hold. The form also records that you ticked the box agreeing to be contacted about the application. Your number is stored in its international form, beginning with the country dialling code, so that a message reaches you from outside the country.
The form asks for a link to a recording of about five minutes of you teaching. It shows your face and carries your voice, and a person watches it to assess your teaching, which is the only use made of it. It is not processed to recognise you by your face or your voice. If learners appear in it, please make sure none of them can be identified, or that you hold the consent the law requires: for a learner under eighteen, section 33 of the Act requires the consent of a parent or guardian.
Everyone who applies receives an email with the next step: setting up a teacher account on the partner teaching platform Eduace works through, signing in with Google using the same email address you gave on the form, and completing your profile and documents there. Signing in with Google means Google confirms your email address to that platform. What you add to that account is held on the platform, and it is yours to change.
Once you are teaching, a record of which lessons were offered to you, which you accepted, and which you taught. This is what the payment for your work is calculated from.
The details needed to send money to you, which you give at the point you are engaged. Nothing on this website asks for a bank or mobile money account in order to apply.
What you write to us by email, on WhatsApp or through the forms on this website, together with our replies.
Your device and browser type, the address your connection comes from, and the pages you open. The address your connection comes from is also counted for a short time to stop the application form from being flooded automatically.
Section 2 of the Act defines sensitive personal data more widely than many readers expect: it covers race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details including the names of your children, parents or spouse, sex and sexual orientation. Eduace asks for none of it, and there is no field for any of it. Your citizenship, which the form asks for, is outside that list. Please leave sensitive personal data out of an application, out of your recording and out of a message to us.
Section 30(1) of the Act allows processing only on one of the grounds it lists. Every use below names the ground it rests on, so you can check it against the section itself.
Section 30(1)(b)(i): the processing is necessary in order to take steps at your request before entering into a contract. Your tick on the form also records your consent under section 30(1)(a).
The same ground. We use your email address and your number to send you the next step, to ask anything we need to ask, and to tell you where the application stands.
Your application details are shared with the partner teaching platform Eduace works through so that you can set up the teacher account the next step asks for, and for no other purpose. The ground relied on is section 30(1)(b)(i), a step taken at your request before a contract is entered into, together with your consent under section 30(1)(a). Whether that pairing is the right one, and whether the wording you agree to on the form has to name this sharing in terms, has not been settled by a Kenyan advocate.
Section 30(1)(b)(i): the performance of a contract to which you are a party. Your subjects, levels and available hours are matched against what a learner has asked for, and a lesson that fits is offered to you.
Performance of that contract, together with section 30(1)(b)(ii), compliance with a legal obligation, for the tax and accounting records that follow a payment.
Section 30(1)(b)(vii), the legitimate interests of the controller: counting requests from one connection, and running a human check when that count is exceeded, keeps the form open to the teachers it is meant for.
Section 30(1)(a), your consent, given through the cookie banner and withdrawable at any time. Nothing is measured until you accept it.
Section 30(2) requires any further processing to be in accordance with the purpose it was collected for, and section 37(1) bars commercial use of personal data without your express consent. Eduace does not sell personal data and does not pass it to anyone to advertise to you.
Section 32(2) gives you the right to withdraw consent at any time, and section 32(3) leaves lawful everything that was done on that consent before you withdrew it.
No decision about an application is taken solely by automated processing. Every application is read by a person. Section 35 of the Act would in any case give you the right to be told in writing of such a decision and to ask for it to be reconsidered, or for a new decision to be taken that does not rest solely on automated processing.
A short list, and each entry is here because the work cannot be done without it. Section 42(2)(b) requires a written contract with any processor, binding it to act only on the controller’s instructions, and each service below that processes your details for Eduace works under one. The partner teaching platform is set out on its own, because it also holds the account you set up with it.
The people who read applications and arrange lessons. Access is limited to the people who need it for that work.
Your application and the record of your lessons and payments sit in the platform database where Eduace keeps its records. That is where an application is written the moment you send it.
Your application details are shared with the partner teaching platform Eduace works through, so that you can set up a teacher account there and complete your profile and documents. It receives what you gave on the form, and it holds what you add to the account yourself. The details are shared for that purpose alone. They are not published, and they are not sold.
Whether the partner teaching platform processes your details only on Eduace’s instructions, as a processor, or also as a data controller in its own right for the account you set up with it, has not been settled by a Kenyan advocate. The answer decides whose policy governs what you add to that account, and it is written into this page, with what follows for your rights, once it is settled.
An email delivery service carries the message confirming your application and setting out the next step. It receives your name and your email address for that purpose.
A service that tells an automated request from a human one guards the application form. It sees the address your connection comes from and signals from your browser.
Where analytics is switched on for this website and you have accepted it in the banner, a measurement service counts visits and the pages they reach. Decline it and none of that loads.
To arrange a lesson, the learner or the adult acting for them is told who is teaching it and what that teacher teaches. Your contact details are not handed over for that purpose.
Where the law requires it, information is given to the Office of the Data Protection Commissioner, to a court, or to another authority entitled to it.
This is the part of the Act that bites hardest on an arrangement like this one, so it is set out here in full.
The platform database, the email service, the check on the form and the measurement service all run outside Kenya. The partner teaching platform, which receives your application details so that you can set up a teacher account there, may store them outside Kenya as well. The learners are outside Kenya too. So personal data described in this policy does leave the country.
Section 25(h) requires that personal data is not transferred outside Kenya unless there is proof of adequate data protection safeguards or consent from the data subject. Section 48 allows a transfer on proof to the Data Commissioner of appropriate safeguards, or on one of the grounds it lists, which include the performance of a contract.
The ground of contract: a teacher cannot be set up on the partner teaching platform, matched to a learner outside Kenya, or paid from outside Kenya, without the details travelling with the arrangement. Each service that holds the data for Eduace is bound by a written contract to protect it and to act only on our instructions.
Your application details reach that platform so that you can set up an account there, which is a step you take at your own request. Whether that transfer rests on the ground of contract in section 48, on your consent under section 25(h), or on proof of safeguards given to the Data Commissioner, has not been settled by a Kenyan advocate, and the answer is written here once it is.
Section 48 speaks of proof to the Data Commissioner of appropriate safeguards. What that proof must consist of for an arrangement of this kind, and whether it is filed before a transfer or produced on request, has not been settled by a Kenyan advocate. The position is stated here as it stands, and nothing on this page claims compliance with it yet.
Section 49 allows sensitive personal data out of Kenya only on the data subject’s consent together with confirmation of appropriate safeguards, and the Data Commissioner may prohibit, suspend or attach conditions to such a transfer. Eduace asks for no sensitive personal data, so none is sent anywhere.
You may ask which countries your personal data reaches and what protects it there, and we will tell you.
A reader who knows the Act will look for this, and the honest answer is more useful than a confident one.
Section 18(1): no person shall act as a data controller or data processor unless registered with the Data Commissioner. Section 18(2) leaves the Commissioner to prescribe the thresholds for mandatory registration, weighing the nature of the industry, the volumes of data processed and whether sensitive personal data is involved.
Regulation 13 of the Data Protection (Registration of Data Controllers and Data Processors) Regulations 2021 exempts a controller only where it is under both a turnover threshold and a headcount threshold. Regulation 13(3) then keeps Part IV and Part VI of the Act binding on it regardless, which means the data protection principles and the rules on transfers out of Kenya apply whether or not anyone is registered.
The same Regulations list purposes that force registration whatever the size of the controller, and one of the twelve is the operation of an educational institution.
Eduace holds no certificate of registration from the Office of the Data Protection Commissioner at the date on this page. Whether a brand that recruits teachers falls inside that Third Schedule entry has not been settled, and it is one of the questions put to a Kenyan advocate. The principles in Part IV and the transfer rules in Part VI bind Eduace either way, and the rest of this policy is written to them.
Section 39(1) allows personal data to be retained only as long as is reasonably necessary for the purpose it is processed for, unless the retention is required or authorised by law, reasonably necessary for a lawful purpose, or consented to.
Kept while it is being considered and while we are answering you, then deleted or stripped of what identifies you, as section 39(2) requires.
The period is being set alongside the Kenyan advice on this policy, so a firm number is not published here yet. Ask us at any time what we still hold about you, and ask us to delete it, and we will answer.
Kept for as long as the Kenyan tax and accounting rules require records of a payment to be kept. That is retention required or authorised by law under section 39(1)(a).
The retention period that the tax rules impose on an arrangement of this shape is one of the questions with a Kenyan advocate, and it is written into this page once answered.
Section 39(2) requires a controller to delete, erase, anonymise or pseudonymise personal data that no longer needs to be retained, and that is what happens to it.
Section 26 of the Act gives every data subject a set of rights, and later sections add to them. Each one below names the section it comes from, so you can hold us to the words of the statute itself.
Section 26(a): the right to be informed of the use to which your personal data is to be put. Section 29 requires us to tell you this before collecting it, which is what this page is for.
Section 26(b): the right to access your personal data in our custody. Ask, and we will give you a copy of what we hold.
Section 26(c) and section 36: the right to object to the processing of all or part of your personal data. We stop unless we can show a compelling legitimate interest that overrides yours, or unless the data is needed for a legal claim.
Section 26(d) and section 40(1)(a): the right to have data corrected without undue delay where it is false, misleading, inaccurate, out-dated or incomplete. Where we have already passed it on, section 40(2) requires us to take all reasonable steps to tell whoever holds it.
Section 26(e) and section 40(1)(b): the right to have data erased or destroyed without undue delay where it is false or misleading, or where we are no longer authorised to retain it, or where it is irrelevant, excessive or was obtained unlawfully.
Section 34: you may ask us to restrict processing while we check accuracy you have contested, where the data is no longer needed for the purpose, where processing is unlawful and you would rather restrict than erase, or while an objection you have made is being weighed.
Section 38: the right to receive your personal data in a structured, commonly used and machine-readable format, and to send it to another controller without hindrance. Section 38(6) requires a controller to answer such a request at reasonable cost and within thirty days.
Section 32(2): where we rely on your consent, you may withdraw it at any time, and section 32(3) leaves lawful what was done before you did.
Section 27 allows a right to be exercised by a guardian for a minor, by a person duly authorised for a data subject with a disability, or by anyone you have duly authorised.
Section 56(1): a data subject aggrieved by a decision under the Act may lodge a complaint with the Data Commissioner, orally or in writing under section 56(2), and section 56(5) requires the complaint to be investigated and concluded within ninety days. Tell us first if you would like to, since most things are quicker to put right directly, and go to the Office of the Data Protection Commissioner whether or not you do.
Section 41 requires appropriate technical and organisational measures, designed in from the start and applied by default so that only the personal data necessary for each purpose is processed.
Only the people who need your details for your application or your lessons can reach them.
Everything you send through this website travels over an encrypted connection.
The application form asks what a person needs to assess a teacher: who you are and how to reach you, what you have taught, when you can teach, and a short recording of you teaching. Your documents are asked for later, on the teacher account you set up, and payment details only once you are engaged. That is section 41(3) applied to the form itself.
Section 42(2)(a) requires a controller to choose a processor that gives sufficient guarantees, and section 42(2)(b) requires a written contract binding it to act only on the controller’s instructions. Each service named in this policy is engaged on that basis.
Eduace pays teachers. It charges an applicant nothing, at any stage, so this website never asks you for a card number or a bank account in order to apply. If a message claiming to come from Eduace asks you to pay for an application, for training or for a place with a learner, it did not come from us, and we would like to hear about it.
Section 43 of the Act sets out what a controller must do when personal data is breached, and the timings in it are firm.
Section 43(1)(a): where a breach carries a real risk of harm to you, the Data Commissioner is notified without delay, within seventy-two hours of our becoming aware of it.
Section 43(1)(b): you are told in writing, within a reasonably practical period, and in as plain terms as we can manage.
Section 43(2): a notification made later than seventy-two hours has to carry the reasons for the delay, and it will.
Section 43(3): a processor must tell the controller of a breach without delay and, where reasonably practicable, within forty-eight hours. That duty is written into the contracts described above.
You do not have to wait for us. the Office of the Data Protection Commissioner takes breach reports directly through its own website, and you may use it.
Section 31 requires a data protection impact assessment before any processing that is likely to result in a high risk to the rights and freedoms of a data subject, given its nature, scope, context and purposes.
A systematic description of the processing and its purposes, an assessment of its necessity and proportionality, an assessment of the risks, and the measures and safeguards that answer them. Section 31(3) requires the Data Commissioner to be consulted where the assessment shows a high risk, and section 31(5) requires the report to be submitted sixty days before the processing starts.
Taking applications from teachers, each with a short recording of the teacher teaching, and sharing them with the partner teaching platform so that an account can be set up there, is a use of ordinary contact and professional details, and no sensitive personal data is asked for. Whether the recording and the transfer out of Kenya bring it to the high risk threshold in section 31(1) is a judgement for a Kenyan advocate, and the sixty day clock means that judgement has to be made before any processing of a new kind begins.
If Eduace starts to process anything materially different from what this page describes, this page changes first, and an assessment is carried out and submitted where section 31 calls for one.
Cookies are small files a website stores in your browser. This site uses as few as it can, and none that measure you until you have said yes.
These keep the site working and are always on. A cookie named ec_consent remembers your answer to the cookie banner for one hundred and eighty days. NEXT_LOCALE remembers whether you are reading in English or Kiswahili, for a year. Signing in uses a session cookie that ends when you sign out or when it expires. The check that guards the forms may set its own short-lived cookie.
These load only after you accept them in the banner, and only where measurement is switched on for this website at all. The measurement service sets cookies named _ga and _ga_ followed by an identifier, which it keeps for up to two years, to count visits. Where an advertising account is connected, it also sets _gcl_au for ninety days. Our own are mkt_attr and kf_attr, each kept for ninety days, which remember the link or advert that brought you here, and kf_anon, kept for a year, a random identifier that lets us count a returning visit without knowing who you are. A visit identifier named kf_session lasts only until you close the tab.
Accept or decline in the banner, and change your answer at any time through Cookie settings at the foot of every page. Declining removes the measurement cookies this website has set. You may also block or delete cookies in your browser; if you block the ones the website needs, signing in and sending a form may stop working.
This page changes when what Eduace does changes, when the Kenyan advice on it lands, or when the law moves. The date at the top is the date of the version you are reading. Where a change affects how information already held is used, everyone with a live application or an open engagement is told before it takes effect. The positions marked as in review are the ones most likely to move, and each one stays on the page, marked, until a settled answer replaces it.
To ask something, or to use any of the rights in section 8, reach us through one of the channels here. Before acting on a request we may ask you to confirm who you are, so that nobody else can reach your details by asking for them.
Contact page
Send us a messageWhen we reply
As soon as we can. A request to take your data elsewhere is answered within thirty days, which is the period section 38(6) of the Act sets.