i.Information We Collect and How We Collect It

ii.Information You Provide to Us

iii.Automatic Information Collection and Tracking

iv.Linking to other websites / third-party content

v.Securing Personal Data

vi.Data Retention

vii.Data Transfers

viii.Your Rights

ix.Social Media Plug-ins

Introduction

This Privacy Policy ("Policy") describes the privacy practices for the Service (comprising the K-12 Mashule web application (the “App” and the K-12 Mashule website (the “Website”). References in this Policy to “Upstream” “we”, “us” or “our” relate to Ecites Limited. We control the ways your personal data is collected and the purposes for which your personal data is used by us, acting as the “data co- controller” together with Ecites for the purposes of applicable European data protection legislation.

We are committed to respecting your privacy and complying with all applicable laws with respect to data protection.

This Policy is effective as of 25 May, 2021, in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and other applicable data protection laws (“GDPR”).

We recommend you to please read this Policy carefully to understand our policies and practices regarding your information and how we will treat it. This Policy is an integral part of the Terms of Use of our Website and may be subject to modifications.

In the future, our Website, the K-12 Mashule Application or our practices may change, and if appropriate, we will revise this Policy to reflect the changes. We’ll post the updated version here, and we’ll notify you if we think the changes will significantly impact the treatment of information you have already provided.

This Policy applies only to information we may collect or that you may provide when you purchase, download, install, register with, access or use the Service, exchange e-mail, text and other electronic communications set through or in connection with this Service and any other sources. This Policy does not apply to information that we collect offline or on any other Company apps or websites, including websites you may access through this Service or you provide to or is collected by any third party. Our websites and apps and these third parties may have their own privacy policies, which we encourage you to read before providing information on or through them.

If you have any questions or concerns after reading this, please contact us via email at the following address: data.protection.info@ecites.co.ke

i.Information We Collect and How We Collect It

We may collect information from and about users of the Service directly from you when you provide it to us and/or automatically when you use the Service. For example, when you visit the Website, get authenticated via mobile phone number (MSISDN) into our Service, interact with USSD/SMS notifications, or visit a third-party website, application, or service.

ii.Information You Provide to Us

When you download, register with or use this Service, we may ask you provide information by which you may be personally identified, such as name, e-mail address, telephone number, geolocation, mobile device identification number, or any other identifier by which you may be contacted online or offline ("personal data” or “personal information"), or that is about you but individually does not identify you.

This information includes: (i) Information that you provide by filling in forms on the Service. This includes information provided at the time of using the Service subscribing to promoted services presented on the Service, posting material, and requesting further services. We may also ask you for information when you enter a contest or promotion sponsored by us, and when you report a problem with the Service; (ii) records and copies of your correspondence (including e-mail addresses and phone numbers), if you contact us; (iii) Your responses to surveys that we might ask you to complete for research purposes; (iv) Details of transactions you carry out through the Service and of the fulfillment of your orders (note that you may be required to provide financial information before placing an order through the Service); (v) Your search queries on the Service; and (vi) Other types of interaction that may be available via the Service.

By visiting the Website you provide us with your phone number and you agree to receive text messages to that number from us. We may use your contact information to send you information about our Service, to market to you, to help prevent spam, fraud, or abuse, and to help others find your account, including through third-party services and client applications. You may also unsubscribe from a notification by following the instructions contained within the notification or the instructions on our website.

You may be able to provide information to be published or displayed ("Posts" or "Posted") on public areas of websites you access through the Service (collectively, "User Contributions"). Your User Contributions and Posts may be transmitted to others at your own risk. We cannot control the actions of third parties with whom you may choose to share your User Contributions. Therefore, we cannot guarantee that your User Contributions will not be viewed by unauthorized persons. The Service broadly and instantly disseminates your public information to a wide range of users, customers, and services, including search engines, developers, and publishers that integrate with the Service, and organizations.

iii.Automatic Information Collection and Tracking

When you download, access and use the Service, it may use technology to automatically collect certain information, including but not limited to:

• Usage Details. When you access and use the Service, we may automatically collect certain details of your access to and use of the Service, including traffic data, location data, logs and other communication data and the resources that you access and use on or through the Service. These may include your IP address, browser type, operating system, the referring web page, pages visited, location, your mobile carrier, device information (including device and application IDs), search terms, or cookie information. We also receive log data when you click on, view or interact with links on our Service, including links to third-party applications. We use log data to customize the content presented to you, including ads. We keep log data as needed for the purposes described in this Policy.


• Device Information. We may collect information about your mobile device and internet connection, including the device's unique device identifier, IP address, device manufacturer and model, operating system, internet browser type and version, mobile network information and the device's telephone number.


• Stored Information and Files. The Service also may access metadata, tags and other information associated with other files stored on your device.


• Location Information. The Service may collect real-time information about the location of your device, in order to provide customized features, such as the local weather forecast.

We also may use technologies to collect information about your usage of the Service over time. We do not respond to web browser "do not track" signals.

iv.Linking to other websites / third-party content

Our Service may source and present links to external, third-party content (apps and websites) as a service to you. These external resources are selected according to a series of qualitative criteria (including the update frequency of the content they provide and their popularity to target audience). The Company does not require from users accessing these external sources. We have no responsibility for the quality of content (including the information it provides) of these external resources.

The third-party websites and apps are operated by companies that are outside of our control, and your activities at those sites and apps will be governed by the policies and practices of those third parties. We encourage you to review the privacy practices of these third parties before disclosing any personally identifiable information, as we are not responsible for the privacy practices of those sites and apps.

v.Securing Personal Data

We have clearly defined Data Security Policies applied to the Service and the information we collect from it. These policies require the use of technologies and procedures that are fully compliant with global security standards, certifications and frameworks. These processes ensure data remain protected against:

• Accidental loss


• Unauthorized access and processing of personal information


• Disaster (business continuity and recovery)


• Third-party risks or fraud attempts

Data Security Policies further apply when personal data are processed for privacy impact assessments and training of employees belonging to the Company or partners.

The safety and security of your information also depends on you. We will never ask you to publicly expose personal information nor reveal personal communication details such as your phone number or your email address.

You should not share your private information details (e.g. phone number) with anyone. The transmission of information via the Internet and mobile platforms is not completely secure. While we take reasonable precautions to protect your personal information, we cannot guarantee the security of your personal information. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures we provide.

vi.Data Retention

In principle we will retain your information as long as required or permitted by applicable law. Afterwards, we will remove your personal data from our systems and records and/or take steps to properly anonymize it so that you can no longer be identified from it.

In particular, we will store your information in order to provide you with the Service, to respond to your requests and provide customer service, the information will be stored only for the time necessary to provide you with the service.

vii.Data Transfers

Data may be transferred to outside of the country the Service is available on within the group or to our business partners. In such case, we take measures to ensure it is protected to the same standards as on the country the Service is available on and always according to the GDPR requirements.

Specifically, data may be transferred to secure data centers outside of the country the Service is available on. These data centers comply with global security standards and certifications. Processing of user data is done over encrypted secure connections, according to this Policy and the legal framework of the country the Service is available on. Once data retention period is expired, a standardized data disposal process is applied, according to our GDPR compliant Data Disposal Policy.

viii.Your Rights

The Service respects the right of users to access and manage their data, according to the GDPR framework. As a Data Subject within the context of the GDPR, you are entitled to request:

• Right of access: you have the right to obtain from us confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, to request access to the personal data. The access information includes – inter alia – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed;


• Right to rectification: you have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement;


• Right to erasure: you have the right to obtain from the controller the erasure of personal data; right to restriction of processing: you have the right to request the restriction of processing your personal data;


• Right to data portability: you have the right to receive the personal data concerning you which you have provided to us in a structured, commonly used and machine-readable format and you have the right to transmit those personal data to another entity without hindrance from us;


• Right to object: you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by us and we can be required to no longer process your Personal Data.

ix.Social Media Plug-ins

We may integrate social media application program interfaces or plug-ins ("Plug-ins") from social networks, including Facebook, Twitter, Instagram, Tumblr, Pinterest and others, into the Service.

Interacting with a Plug-in will transmit information directly to that Plug-in's social network and that information may be visible by others on that platform. Plug-ins are controlled by the respective platform's privacy policy, and not by our Policy.