Privacy notice
Last updated 26 September 2026
What SIIQ holds about pupils, parents and school staff, why, who can see it, and how long it is kept.
Draft — pending legal review
Who is responsible
SIIQ is provided by [Company legal name — to be confirmed]. [Whether SIIQ acts as data controller or data processor for each school — to be confirmed.]
Our Data Protection Officer can be reached at [Data Protection Officer contact — to be confirmed].
What we hold
- About pupils: name, date of birth, year group, attendance, measurements such as height, weight and fitness tests, skill assessments, and the sport allocated to them with the reasons.
- About parents and guardians: name, contact details, and the consent decisions they have made for their child.
- About staff: name, role, department, sport, email and phone.
- A record of who looked at or changed a pupil’s record, and when.
Why we hold it
So the school can run its sport programme: take registers, measure pupils, record assessments, and decide which sport suits each pupil, with the evidence attached.
A pupil’s data is processed only with the consent of their parent or guardian, and only in ways that protect and advance the pupil’s interests.
Who can see it
- Staff at the pupil’s own school, limited by their role. A coach sees only the pupils assigned to them.
- The pupil’s parent or guardian.
- County or national sports bodies see counts only. Small counts that could identify a child are withheld.
- SIIQ staff, read-only and logged, when helping the school.
No school can see another school’s data.
Where it is stored
SIIQ runs on servers rented from Hostinger. Emails, such as invitations and sign-in codes, are sent through a Hostinger mailbox. Backups are encrypted before they leave the server, so a copy cannot be read without a key SIIQ keeps separately.
Error reports, where enabled, carry only the page and the technical fault — no names, form contents or user details.
[Country where servers are located, and any transfer outside Kenya — to be confirmed]
How long we keep it
These periods are proposed and awaiting sign-off:
- When a school’s contract ends, the school keeps read-only access for 90 days and can export everything.
- Pupil data is deleted 12 months after the contract closes.
- Audit and billing records are kept for 7 years. They are the school’s own record rather than a child’s.
- If a guardian withdraws consent, processing stops immediately and the child’s records are deleted within 30 days.
Deleted means the data is removed, not merely hidden.
Your rights
You can ask to see what is held about you or your child, to have it corrected, to object, to restrict how it is used, or to have it deleted. There is no fee. See the data protection notice for deadlines and how consent works.