Privacy policy

The data controller is to be confirmed: the registered company name, exactly as on the CR12, registered in Kenya under company number to be confirmed: the company registration number, trading as Elevate, of to be confirmed: the registered office address.

We are registered with the Office of the Data Protection Commissioner under to be confirmed: the ODPC data controller registration number.

Data-protection questions and requests go to to be confirmed: the address that receives data-protection requests.

Everything below is something the platform actually stores.

From everybody with an account

• Your name and email address, given when you sign up.
• Your phone number, if you give one. It is used to send session reminders by SMS and nothing else.
• A profile photograph, if you upload one.

From learners

• Which programmes and cohorts you enrol in, and your seat number.
• Payments: the amount, the plan, the date, and the M-Pesa transaction reference returned by the payment provider. We never see or store your PIN, and we do not store your card or M-Pesa credentials.
• Refund requests, including the reason you write and the decision made.
• Assignment submissions and any files attached to them.
• Progress: which lessons you have opened, roughly how far into a video you reached, and whether a lesson is complete.
• Attendance at live sessions, marked by the mentor.
• Anything you post in a cohort discussion.

From mentors

• Your application: headline, biography, areas of expertise, and a link to a professional profile.
• Your KRA PIN and M-Pesa number, which are needed to pay you and to meet tax obligations.
• A copy of an identity document, used once to verify that you are who you say you are before you can teach.
• Programmes, cohorts, lessons and feedback you write.

Automatically

• A record of every SMS and email we send you, including failures, so that a message you did not receive can be investigated.
• Standard server logs kept by our hosting and payment providers. We do not run advertising trackers and we do not sell anything to data brokers.

• To provide what you paid for. Enrolments, lessons, sessions, submissions and discussions. Without these the service cannot work — the lawful basis is performance of our contract with you.
• To take and reconcile payments. Also contractual, and in part a legal obligation: we are required to keep accurate financial records.
• To verify mentors. Identity documents and KRA PINs are held so that learners are taught by people we have actually checked, and so that mentors can be paid and taxed correctly.
• To send you operational messages. Session reminders, payment outcomes, refund decisions. You can turn reminders off in your account settings; messages about money or about a decision on your account are sent regardless, because not receiving those would harm you.

• Your mentor sees your name, your attendance, your submissions and your posts in their cohort. They do not see your phone number, your email address or what you paid.
• Other learners in your cohort see your name and anything you post in the discussion. They see nothing else.
• Our payment provider processes the payment itself and holds the details you enter with them.
• Our SMS and email providers receive the message and the number or address it is going to.
• Our hosting and video providers store the data and the lesson videos.

We do not sell personal data, and we do not share it for anybody else’s marketing.

• Your profile — until you delete your account.
• Financial records — orders, payments, refunds and the accounting entries behind them are kept for to be confirmed: the retention period for tax records, because we are required to keep them. After an account is deleted these records remain with the name and contact details removed, so they no longer identify anybody.
• Mentor identity documents — kept while the mentor is active and removed when the account is deleted.
• Submissions and discussion posts — kept while the cohort exists, because other learners and the mentor rely on them. After deletion they remain, attributed to “Deleted account”.
• Message logs — kept so a delivery failure can be traced.

Under the Data Protection Act you can see what we hold about you, correct it, ask for it to be deleted, object to how we use it, and take it elsewhere. Two of those are buttons rather than requests:

• Download my data. In your account settings. It produces a machine-readable file containing your profile, enrolments, payments, submissions, progress, attendance and posts, immediately.
• Delete my account. Also in your settings. It removes your name, phone number, photograph and email, and — if you are a mentor — your KRA PIN, M-Pesa number and identity document. It cannot be undone, and you cannot sign in afterwards.

Deletion does not remove the financial records described above. Erasure does not override a legal obligation to keep accounts, and those records no longer name you. If you are owed a refund, ask for it before deleting your account.

For anything not covered by those two buttons, write to to be confirmed: the address that receives data-protection requests.

Access is enforced by the database itself rather than by the application: every table carries rules that decide, per row, who may read or change it. A mentor cannot query another mentor’s cohort and a learner cannot query another learner’s payments, even by going around the website.

Identity documents are held in private storage and are not reachable by a link. No system is perfect, and if we ever discover a breach affecting you we will tell you and the Office of the Data Protection Commissioner.

Tell us first, at to be confirmed: the address that receives data-protection requests — most things are faster to fix than to escalate.

You do not have to. You can complain directly to The Office of the Data Protection Commissioner, which regulates data protection in Kenya and can investigate us: to be confirmed: the current ODPC complaints address and phone number.

If we change how we use your data in a way that affects you, we will say so on this page and, where the change is significant, tell you directly. The date at the top is the date this version took effect.