Draft for review. This policy was prepared for SOS and should be read and approved by Fr. Selvam (and, ideally, someone familiar with the Kenya Data Protection Act) before it is relied on. Edit this page in public/privacy.php.
1. Who we are
SOS · School of Spirituality (“SOS”, “we”, “us”) is the online formation programme of God in the City, an initiative of Rev. Prof. Fr. Sahaya G. Selvam, SDB, based in Nairobi, Kenya. This policy explains how we handle personal data on sos.godinthecity.org, including the Student, Teacher and Admin portals. Course fees are received into the account of SDB UTUME YOUTH MINISTRY.
We act as the data controller for the personal data described here, under the Kenya Data Protection Act, 2019.
2. What we collect
- Account details: your name, email address, phone number (optional) and an encrypted (hashed) password. We never see or store your password in readable form.
- Learning records: the courses you enrol in, your progress, assignment answers, quiz attempts and scores, teacher feedback and any certificates issued.
- Payment details you submit: amount, M-Pesa or bank transaction code, payer name and phone number. We do not receive or store your M-Pesa PIN, card or bank login details.
- Your private notes written inside courses.
- Mailing list: your email (and name if given) if you subscribe to updates.
- Technical data: basic server logs (such as IP address and browser type) that our hosting provider keeps for security.
3. How we use your data
- To create and run your account and give you access to the courses you enrol in.
- To confirm your payments and keep financial records.
- So your teacher can review your work, give feedback and award certificates.
- To send you emails about your account, payments, feedback, certificates and announcements (see Emails).
- To let anyone verify a certificate you share, using its number or QR code — this shows only your name, the course and the date.
- To improve our courses, using overall (non-identifying) statistics.
We do not sell your personal data, and we do not use it for advertising.
4. Legal basis
We process your data because it is necessary to provide the course you signed up for (contract), because you have given consent (for example to the mailing list), and for our legitimate interest in running a safe and well-organised formation programme. Where the law requires consent, you can withdraw it at any time.
5. Who we share it with
- Your teachers and our administrators — only what they need to teach and support you.
- Service providers who host the website and send our emails, under appropriate confidentiality and security terms.
- Banks and mobile-money providers (NCBA Bank, Safaricom M-Pesa) as part of processing your payment.
- Authorities, only where the law requires it.
Some providers may store data outside Kenya; where this happens we take reasonable steps to make sure your data stays protected, as required by the Act.
6. Your notes and work
Notes you write in a course are private: only you can see them. Teachers and administrators cannot read them. Assignment answers and quiz results are visible to your course teachers and administrators.
7. Emails
We send two kinds of email:
- Security emails (password reset links, password changes, new account details) — these are always sent because they protect your account.
- Optional emails (payments, feedback, assignment receipts, certificates, announcements) — you can switch each of these on or off at any time under Profile → Email notifications in your portal.
8. Cookies
We use one essential session cookie to keep you signed in, and your browser's session storage to remember that you have already seen an event pop-up. We do not use advertising or tracking cookies.
9. How long we keep your data
We keep your account and learning records while your account is active and for up to 5 years after your last course, so we can confirm your studies and certificates. Payment records are kept for as long as Kenyan law requires for financial records. You can ask us to delete your account sooner (see below); certificate verification records may be kept so that certificates already issued remain verifiable.
10. Security
Passwords are stored using strong one-way hashing, the site is served over HTTPS, and access to student information is limited by role. No system is perfectly secure, so please use a password you don't use elsewhere and keep it private.
11. Your rights
Under the Kenya Data Protection Act, 2019 you have the right to be informed about how your data is used, to access it, to have it corrected or deleted, to object to certain uses, and to receive a copy in a common format. To use any of these rights, email info@godinthecity.org. We will reply within the time the law allows.
12. Young people
SOS courses are designed for adults. If you are under 18, please enrol only with the permission and involvement of a parent or guardian.
13. Contact and complaints
Questions about this policy: info@godinthecity.org · +254 710 586079.
If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (ODPC), Kenya — www.odpc.go.ke.
We may update this policy from time to time; the date at the top shows the latest version.