Privacy & Data Protection Policy

1. Introduction & Institutional Scope

Nyamira University College ("the College", "we", "our") is dedicated to protecting the rights, freedoms, and privacy of prospective students, enrolled scholars, faculty, administrative staff, vendors, and online visitors. This policy outlines how personal data is collected, processed, safeguarded, and retained across our digital portals, paper forms, and administrative registries.

2. Principles of Data Processing

Under Section 25 of the Data Protection Act, 2019, all personal data handled by Nyamira University College is:

• Processed lawfully, fairly, and transparently with valid legal grounds.
• Collected for specified, explicit, and legitimate purposes relating to academic administration, student welfare, admissions, and institutional operations.
• Adequate, relevant, and limited to what is strictly necessary in relation to the purposes for which it is processed.
• Accurate and kept up to date, with every reasonable step taken to ensure inaccurate data is erased or rectified promptly.
• Kept in a form which permits identification for no longer than is necessary for academic records, statutory audit, and historical archives.
• Protected against unauthorized access, unlawful processing, accidental loss, destruction, or damage through appropriate technical and organizational measures.

3. Information We Collect

Depending on your interaction with Nyamira University College, we may collect the following categories of data:

• Prospective Student Enquiries: Full name, email address, telephone contact, geographic county/town, and academic programmes of interest.
• Formal Admissions & Registry Data: KCSE index numbers, national identification or birth certificate numbers, academic transcripts, next-of-kin emergency contacts, and passport photographs.
• Procurement & Vendor Information: Business registration certificates, KRA PIN numbers, tax compliance certificates, physical office addresses, and banking details for payment clearance.
• Website Telemetry & Technical Logs: IP address, browser type, device specifications, operating system, and anonymous page interaction telemetry for service optimization.

4. Legal Basis for Processing

The College processes personal data under one or more of the following lawful bases recognized under Kenyan law:

• Performance of an Educational Contract: Processing student admissions, academic progress tracking, examination administration, and certificate issuance under Kisii University Senate oversight.
• Compliance with Legal & Statutory Obligations: Reporting requirements to the Commission for University Education (CUE), Kenya Universities and Colleges Central Placement Service (KUCCPS), Kenya National Qualifications Authority (KNQA), and Higher Education Loans Board (HELB).
• Consent: Where individuals explicitly opt-in to receive campus news bulletins, event invitations, or public outreach communications.
• Legitimate Institutional Interests: Maintaining campus security, preventing fraudulent transactions, and ensuring network stability.

5. Cookies and Web Analytics

Our website utilizes strictly essential session cookies to enable core website navigation, secure form submissions, and maintain accessibility preferences. We do not use intrusive third-party commercial advertising tracking. You can manage or disable cookies via your browser settings, though certain interactive forms may require session cookies to complete verification.

6. Data Sharing and Third Parties

Nyamira University College does not sell, lease, or commercially trade personal information. Data may be shared strictly under formal data exchange agreements with:

• Kisii University: For curriculum accreditation, examination moderation, joint senate approvals, and academic conferment.
• Governmental Bodies: The Ministry of Education, CUE, KUCCPS, and law enforcement agencies when mandated by Kenyan statutory law.
• Accredited IT Infrastructure Providers: Cloud hosting and backup systems operating under binding confidentiality and data processor contracts compliant with the Data Protection Act.

7. Your Rights as a Data Subject

Under the Kenya Data Protection Act, 2019, you have the right to:

• Be informed of the use to which your personal data is being put.
• Access your personal data in custody of the College.
• Object to the processing of all or part of your personal data.
• Request correction of false, misleading, or outdated personal data.
• Request deletion or erasure of personal data held without lawful basis.

8. Data Protection Office Contact

Policy Version: 1.0 · Effective Date: November 2026 · Subject to annual review by College Management Board and Kisii University Legal Office.