Privacy Policy

1. Introduction

Vector Automation Systems Ltd (“VAS”) respects your privacy. This Policy explains how we collect, use, store, and protect personal data when you use the VAS School Management System, in line with the Kenya Data Protection Act, 2019 (DPA) and, where applicable, the EU GDPR for international schools, Uganda's Data Protection and Privacy Act, Tanzania's Personal Data Protection Act, and Rwanda's Law No. 058/2021 on personal data.

2. Roles

Schools (tenants) are typically data controllers for student, parent, and employee information they enter.VAS is a data processor providing hosting, security, backups, analytics, and support on the school's instructions. Platform administrators may process account metadata as controllers for billing and security.

3. Data we collect

• Account data: name, email, phone, role, school membership;
• School registration: address, county, curriculum, estimated enrolment, principal contacts;
• Educational records: attendance, grades, timetables, incidents, fees, messages, documents;
• Technical data: IP address, device type, analytics events, error logs, cookies (see Cookie Policy);
• Payment references: transaction codes you submit for manual verification (we do not store full M-PESA PINs).

4. Lawful bases

Processing is based on contract performance, legitimate interests (security, product improvement), legal obligation, and — for children's data — consent or other lawful bases obtained by the school as controller. Schools must obtain parental consent where required before enrolling minors.

5. Sharing & international transfers

Data may be processed using Firebase/Google Cloud and other subprocessors with appropriate safeguards. Cross-border transfers rely on standard contractual clauses or adequacy decisions where required. We do not sell personal data.

6. Retention & security

Data is retained while your subscription is active and as required by law or legitimate business needs. We implement access controls, encryption in transit, tenant isolation via schoolId, and audit logging. Breaches will be notified per DPA requirements.

7. Your rights

Under Kenyan law you may request access, rectification, erasure, restriction, portability, and object to processing. Contact your school administrator first; you may also contact VAS at info@vasmetering.com. You may lodge a complaint with the Office of the Data Protection Commissioner (Kenya) or your local authority.

8. Children

The Service processes children's educational data only on instructions from schools. We do not knowingly market to children under 18.

9. Contact

Data Protection enquiries: info@vasmetering.com · +254 700 877 949 · Nairobi, Kenya