Last updated: January 2025

This privacy policy describes how RiverLearn Inc. ("we," "our," or "us") collects, uses, and protects your information when you use the RiverLearn platform.

🇰🇪 Kenya Data Protection Act Compliance

RiverLearn Inc. is committed to full compliance with the Kenya Data Protection Act, 2019. This privacy policy is designed to ensure transparency and protection of your personal data in accordance with Kenyan data protection laws. We process your personal data lawfully, fairly, and transparently, respecting your fundamental rights and freedoms.

Reference: Kenya Data Protection Act, 2019

1. Information We Collect

1.1 Personal Information

When you register for RiverLearn, we collect:

Full name
Email address
Phone number (for SMS notifications)
University of Nairobi registration number
Academic year and program information

1.2 Academic and Educational Data

In addition to personal information, we collect educational data necessary for legal education compliance:

Course enrollment and completion records
Academic performance and assessment data
Attendance records and participation metrics
Research activities and academic projects
Professional development and continuing education records

1.3 Usage Information

We automatically collect information about how you use our platform, including:

Pages visited and time spent on each page
Course materials accessed and downloaded
Lecture recordings viewed
Device information and browser type
IP address and general location data

2. Kenya Data Protection Act Compliance

Data Protection Principles

In accordance with the Kenya Data Protection Act, 2019, we adhere to the following data protection principles:

Lawfulness, Fairness, and Transparency: We process your data lawfully, fairly, and in a transparent manner
Purpose Limitation: We collect data for specified, explicit, and legitimate purposes
Data Minimisation: We collect only data that is adequate, relevant, and limited to what is necessary
Accuracy: We keep personal data accurate and up to date
Storage Limitation: We retain data only for as long as necessary for the purposes for which it was collected
Integrity and Confidentiality: We process data in a manner that ensures appropriate security

2.1 Legal Basis for Processing

Under the Kenya Data Protection Act, we process your personal data based on the following legal grounds:

Consent: You have given clear consent for us to process your personal data for specific purposes
Contract Performance: Processing is necessary for the performance of a contract (providing educational services)
Legal Obligation: Processing is necessary for compliance with legal obligations (educational reporting requirements)
Legitimate Interests: Processing is necessary for our legitimate interests in providing educational services (subject to your rights and freedoms)

2.2 Data Protection Officer

RiverLearn Inc. has appointed a Data Protection Officer (DPO) to ensure compliance with the Kenya Data Protection Act. You can contact our DPO at:

Email: dpo@riverlearn.co.ke

Purpose: Data protection inquiries, complaints, and rights requests

3. How We Use Your Information

We use the information we collect to:

Provide and maintain the RiverLearn platform
Verify your University of Nairobi student status
Send you important notifications about your courses
Personalize your learning experience
Improve our platform and develop new features
Ensure platform security and prevent fraud
Comply with legal obligations

3. Information Sharing

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

With University of Nairobi: We may share your registration status and academic information with the university for verification purposes
Council of Legal Education (CLE): We may share academic records, course completion data, and educational progress information with the CLE for accreditation, quality assurance, and compliance with legal education standards as required by the Legal Education (Accreditation and Quality Assurance) Regulations
Legal Education Compliance: We may share information necessary for compliance with Kenya's legal education framework, including institutional reports and quality assurance documentation
Service Providers: We may share information with trusted third-party service providers who help us operate our platform (e.g., hosting, SMS services)
Legal Requirements: We may disclose information if required by law or to protect our rights and safety
Business Transfers: In the event of a merger or acquisition, your information may be transferred to the new entity

4. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit and at rest
Regular security assessments and updates
Access controls and authentication systems
Secure hosting infrastructure

5. Your Rights Under Kenya Data Protection Act

Data Subject Rights

Under the Kenya Data Protection Act, 2019, you have the following fundamental rights as a data subject:

Right to be Informed: Right to know what personal data is being processed and why
Right of Access: Right to obtain confirmation and access to your personal data
Right to Rectification: Right to correct inaccurate or incomplete personal data
Right to Erasure: Right to request deletion of your personal data under certain circumstances
Right to Restrict Processing: Right to limit how your personal data is processed
Right to Data Portability: Right to receive your data in a structured, machine-readable format
Right to Object: Right to object to processing of your personal data
Rights Related to Automated Decision Making: Rights regarding automated processing and profiling

5.1 How to Exercise Your Rights

To exercise any of these rights, you can:

Contact our DPO: Email dpo@riverlearn.co.ke with your request
Use our platform: Access your account settings to update certain information
Write to us: Send a formal request to our registered address in Nairobi, Kenya

5.2 Response Time and Verification

In accordance with the Kenya Data Protection Act:

We will respond to your requests within 30 days of receipt
We may require identity verification before processing your request
We will provide reasons if we cannot fulfill your request
You have the right to lodge a complaint with the Data Commissioner if unsatisfied

5.3 Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with the Kenya Data Protection Act, you have the right to lodge a complaint with:

Office of the Data Protection Commissioner

Kenya

Website: www.odpc.go.ke

6. Data Processing in Kenya

🇰🇪 Kenya-Based Data Processing

RiverLearn Inc. is incorporated in Kenya and processes personal data in accordance with Kenyan law:

Local Processing: Personal data is primarily processed within Kenya's jurisdiction
Data Localization: We maintain data processing facilities in Kenya where possible
Regulatory Compliance: All processing activities comply with Kenya Data Protection Act requirements
Cross-Border Transfers: Any international data transfers are subject to adequate protection measures
Local Oversight: Our operations are subject to oversight by the Office of the Data Protection Commissioner

6.1 Sensitive Personal Data

Under the Kenya Data Protection Act, we may process sensitive personal data (including academic records) only when:

You have given explicit consent
Processing is necessary for educational purposes
Processing is required by law or for compliance with educational regulations
Processing is necessary for the establishment, exercise, or defense of legal claims

7. Technology Integration in Legal Education

Our platform supports the integration of technology in legal education as outlined in Kenya's evolving legal education framework:

Digital Learning Environment: We provide a secure digital platform for legal education delivery, supporting both traditional and technology-enhanced learning methods
Research and Technology Law: Our platform facilitates research in technology law and legal research methodologies, supporting the integration of technology law into Kenya's legal curriculum
Data-Driven Education: We collect and analyze educational data to improve learning outcomes while maintaining strict privacy protections
Accessibility and Inclusion: Our technology solutions ensure equitable access to legal education resources for all students
Future-Ready Legal Education: We support the preparation of law students for the digital transformation of the legal profession

8. Council of Legal Education (CLE) Compliance

As a platform supporting legal education in Kenya, we comply with the Council of Legal Education requirements and the evolving landscape of legal education technology integration:

Accreditation Support: We assist in maintaining compliance with CLE accreditation standards by providing secure access to academic records and educational progress data
Quality Assurance: We support institutional quality assurance processes by enabling data collection and reporting required under the Legal Education (Accreditation and Quality Assurance) Regulations
Regulatory Compliance: Our platform ensures compliance with all applicable CLE regulations and guidelines for legal education delivery
Educational Standards: We maintain data practices that align with CLE standards for legal education delivery and assessment
Research and Development: We support legal education research initiatives while maintaining strict data protection standards
Institutional Reporting: We facilitate the submission of required institutional reports and documentation to the CLE

9. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this privacy policy. Specifically:

Account information is retained while your account is active
Usage data is typically retained for up to 2 years for analytics purposes
Academic records are retained in accordance with CLE requirements and educational standards
Legal education compliance data may be retained longer to meet regulatory requirements
Some information may be retained longer if required by law or CLE regulations

10. Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience on our platform. These technologies help us:

Remember your login status and preferences
Analyze platform usage and performance
Provide personalized content and features

You can control cookie settings through your browser, but disabling cookies may affect platform functionality.

11. Third-Party Services

Our platform may integrate with third-party services, including:

SMS providers for notifications
Video hosting services for lecture recordings
Analytics services for platform improvement

These services have their own privacy policies, and we encourage you to review them.

12. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure that such transfers comply with applicable data protection laws and implement appropriate safeguards.

13. Children's Privacy

RiverLearn is designed for university students and is not intended for children under 16. We do not knowingly collect personal information from children under 16.

14. Changes to This Privacy Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the new privacy policy on this page and updating the "Last updated" date. Your continued use of the platform after such changes constitutes acceptance of the updated policy.

15. Contact Information

If you have any questions about this privacy policy or our data practices, please contact us:

General Inquiries

Company: RiverLearn Inc.

Email: privacy@riverlearn.co.ke

LinkedIn:RiverLearn Inc. on LinkedIn

Address: Nairobi, Kenya

Data Protection Inquiries

Data Protection Officer:

Email: dpo@riverlearn.co.ke

Purpose: Data protection rights, complaints, and compliance

Response Time: Within 30 days as per Kenya Data Protection Act