Data protection
Shopika School holds personal data about children. This page states exactly what the system stores, where it is kept and who can reach it, so a school can satisfy itself before putting its learners on it.
Who runs Shopika School
Shopika School is operated by Shopika Enterprise Ltd, 6th Floor, D&D House, Nakuru, Kenya (P.O. Box 598 - 20100, Nakuru).
Each school decides what it records about its own learners, staff and parents, and controls those records from within its portal. Shopika Enterprise Ltd runs the system that holds them.
Privacy questions: privacy@shopika.com · +254 712 095 031
What the system stores
| Learners | Name, UPI/ULI and assessment number, grade, stream, date of birth, sex, an optional photograph, attendance, exam marks, fee and lunch records, and Senior School Pathway choices. |
|---|---|
| Staff | Name, email, phone number, TSC number where given, role, subjects and classes taught, attendance and duty allocations. |
| Parents and guardians | Name, phone number, email, and the link to their child. |
| Payments | Fee and welfare transactions, including M-Pesa reference numbers where a payment was made that way. No card details are ever stored. |
| Sign-in records | The time of the last sign-in, and password reset tokens which expire. Passwords are stored only as one-way hashes and cannot be read back by anyone, including the operator. |
| The school's registration | The school's name, county, level and code, and the name, email and phone number of the person who registered it. |
Separation between schools
Every registered school has its own separate database. One school's learners, marks and money are not stored in the same tables as another's, and a signed-in user's session is scoped to the single school they signed in to.
Uploaded files - learner photographs and teaching resources - are likewise stored under a directory belonging to that school alone.
Where the data is held
On a server in a commercial data centre, reached only over an encrypted connection (HTTPS). The system connects to school data with an account that can read and write records but cannot create, alter or delete databases. Backups are taken nightly and kept for 14 days, and a restore is tested every week.
Email leaving the system - a welcome message, a password reset - passes through a third-party mail provider in order to be delivered.
Who can see a school's data
- Staff at that school, limited by their role. A teacher sees the learners in the classes assigned to them; an administrator sees the whole school.
- A parent sees their own child's records and nothing else.
- A learner sees their own records.
- Shopika Enterprise Ltd's technical staff, for support and maintenance, and only as far as is needed to keep the service running.
Measurement and bot protection on these public pages
The public pages of school.shopika.com - the home page, school registration, the school list and this page - use Google Tag Manager and the Meta Pixel to measure how schools find the service, and the registration form uses Google reCAPTCHA to keep automated sign-ups out. These may set cookies in your browser.
None of these tools is loaded inside any school's portal, so they never see learner, staff or parent records. When a school finishes registering, only the fact that a registration was completed is recorded - not the school's name or anyone's contact details.
What a school controls
- Correcting or removing a learner's or a member of staff's record at any time, from within the portal.
- Asking for a copy of the school's data.
- Asking for the school's account to be closed, which deletes its database.
Children's data
Most of the people in this system are children. Their data is put in by their school in order to run the school - registers, marks, timetables, fees and senior school selection. It is not used for advertising, is not sold, and is not shared with anyone outside the school except where the law requires it or the school itself instructs it.
Questions and complaints
A parent, learner or member of staff who wants to see, correct or remove their data should ask their school first: the school holds the records and can act on them directly.
Anyone can also contact Shopika Enterprise Ltd at privacy@shopika.com or +254 712 095 031.
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner, Kenya.