Privacy Policy

This Privacy Policy describes how Learn by M-TIP, operated by M-TIP Ltd. ("Learn by M-TIP", "we", "our", or "us"), collects, uses, discloses, and protects your personal data when you use our platform, mobile applications, websites, services, events, and related content (collectively, the "Services").

This Policy applies to all users in Kenya and is issued in compliance with the Kenya Data Protection Act, 2019 ("DPA") and related regulations.

By using the Services, you agree to the terms in this Privacy Policy. If you do not agree, please do not use the Services.

1. Data Controller and Contact Information

For the purposes of the DPA, Learn by M-TIP is the Data Controller of personal data processed through the Services.

2. Categories of Personal Data We Collect

We collect personal data you provide directly, data collected automatically when you use the Services, and data from third parties.

2.1 Data You Provide Directly

When you register or interact with the Services, you may provide:

• Account information: name, email address, phone number, password
• Profile information: organization, job title, learner interests
• Government IDs: if required for identity verification or certification
• Payment information: card or mobile money details (handled via payment partners)
• Learning data: course enrollments, progress, assessments, certifications
• Communications: messages with support, feedback, ratings

2.2 Data Collected Automatically

When you use the Services, we automatically collect:

• Usage and engagement data: courses viewed, time spent, clicks
• Device and technical data: IP address, device model and OS, browser type
• Location data: approximate location based on IP or mobile network
• Cookies and tracking data: see Section 11 (Cookies and Tracking)

2.3 Data from Third Parties

We may receive data from:

• Payment processors (for transaction validation)
• Learning partners and institutions (to deliver authorised learning content)
• Analytics and advertising partners
• Regulatory bodies as required by law

3. Lawful Basis for Processing Your Data

We process personal data only when we have a lawful basis under the DPA, including:

• Performance of a contract: to provide learning services and certification
• Consent: where you have given permission (e.g., email marketing)
• Legal obligation: to comply with laws, e-invoicing, tax, audit
• Legitimate interests: to improve services, protect security, prevent fraud
• Vital interests: to protect someone's life or safety, where necessary

4. How We Use Your Personal Data

We use your personal data to:

• Create and manage your account and profile
• Provide and personalise educational content and learning pathways
• Process payments and issue receipts
• Communicate service announcements, updates, support responses
• Verify identities and prevent fraud or misuse
• Generate certificates and verifiable credentials
• Analyse use patterns to improve products and features
• Comply with legal and regulatory requirements

5. How We Share Your Personal Data

We may share your personal data with:

5.1 Service Providers

We share with trusted partners who support the Services:

• Cloud hosting and storage companies
• Payment processors
• Analytics and performance tools
• Customer support systems

5.2 Learning Partners and Employers

Where you enroll in partner courses or corporate programs, we may share:

• Course progress
• Certification outcomes
• Enrollment status

Only data relevant to the learning program is shared.

5.3 Legal and Regulatory Authorities

We may disclose data when required by law, court order, or to protect safety and rights.

5.4 Aggregated or Anonymised Data

We may share anonymised usage patterns for research or reporting, which cannot identify you.

6. Data Retention

We retain your personal data only as long as:

• You have an active account
• It is necessary to deliver Services
• Required by law or auditing requirements

After you close your account, we may keep certain information for legal compliance or legitimate business purposes, only as permitted by law.

7. Security of Your Data

We use reasonable technical and organisational safeguards to protect your data:

• Secure servers and encrypted transmission (HTTPS)
• Access controls and authentication
• Periodic security assessments

However, no system is completely secure; while we strive to protect your data, we cannot guarantee absolute security.

8. Your Rights Under Kenyan Law

Under the Kenya Data Protection Act, you have rights including:

• Right to be informed about processing and purpose
• Right to access your personal data
• Right to correction of inaccurate data
• Right to deletion or erasure (where lawful)
• Right to object to processing
• Right to restrict or withdraw consent
• Right to data portability

To exercise these rights, contact 📧 privacy_learn@m-tip.app. We may need to verify your identity before fulfilling requests.

9. Children and Minors

Our Services are not directed to children under 18 years. If we discover that we have collected data from a minor without appropriate consent, we will take steps to promptly delete such information.

10. International Data Transfers

Your data may be processed outside Kenya (for example, with cloud partners). Where transfers occur, we ensure:

• Adequate safeguards under law
• Contractual protections consistent with the DPA

11. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Provide core functionality
• Remember preferences
• Analyse usage and performance
• Deliver personalised content

You can manage cookie preferences via browser settings or in-app settings.

12. Communications and Marketing

With your consent, we may send promotional emails, notifications, and updates. You may opt out of marketing communications at any time via account settings or the unsubscribe link.

13. Changes to this Privacy Policy

We may update this Policy to reflect changes in law, technology, or our Services. When material changes occur, we will notify you via email or in-app notification. Continued use after updates constitutes acceptance.

14. Complaints and Contact

If you have questions, complaints, or privacy requests:

You may also contact the Office of the Data Protection Commissioner (ODPC), Kenya if you believe your rights under the DPA have been violated.