How MIU School collects, uses, stores, and protects your personal data.
Last updated: 2026-10-17
MIU School is operated by MIU Tek ("we", "us", "our"), a company registered in the Republic of Kenya. For the purposes of data-protection law, MIU Tek acts as a data processor for school data and a data controller for platform-account data. Our Data Protection Officer can be reached at privacy@miuttek.com.
We collect: (a) account data — name, email, phone, role, school association, and authentication metadata; (b) school operational data — staff records, student records, attendance, grades, fee payments, hostel & transport allocations, and messages exchanged on the platform; (c) technical data — IP address, user agent, login timestamps, and device metadata; (d) support data — any information you provide when contacting us.
We use data to (a) provide, secure, and improve the Platform; (b) authenticate users and prevent unauthorised access; (c) send transactional notifications (attendance alerts, fee reminders, password resets); (d) send optional marketing communications with your consent; (e) comply with legal obligations and respond to lawful requests. We do not sell personal data.
For users in the European Economic Area, United Kingdom, or Kenya, we rely on one or more of the following legal bases: performance of a contract, compliance with a legal obligation, our legitimate interests in operating a secure service, your explicit consent, and — for special categories of data such as medical or religious information — your explicit consent.
We share data only with: (a) your school's authorised administrators, who act as joint controllers for school operational data; (b) vetted sub-processors that provide hosting, email delivery, and SMS delivery; (c) regulators, courts, or law-enforcement bodies when legally required. Our current list of sub-processors is available on request.
Primary data is stored in the African region (with backup in the EU). Where data is transferred outside your home jurisdiction, we rely on standard contractual clauses or equivalent safeguards. Encrypted backups are stored in at least two geographic regions.
We retain school operational data for the duration of the subscription and for up to ninety (90) days after termination, after which it is permanently deleted unless we are required to retain it longer by law. Account metadata is retained for as long as the account is active. Aggregated, anonymised analytics may be retained indefinitely.
You have the right to access, correct, port, restrict, or delete your personal data; to object to processing; to withdraw consent where processing is based on consent; and to lodge a complaint with a supervisory authority. To exercise these rights, contact your school administrator or email privacy@miuttek.com.
We use industry-standard measures: TLS 1.2+ in transit, AES-256 at rest, bcrypt-hashed passwords with cost factor 10, rate-limited login attempts, audit logging, role-based access control, and per-school data isolation. No system is perfectly secure; we will notify affected users of material breaches without undue delay.
The Platform is intended for use by schools. Student accounts are created and managed by school administrators. We do not knowingly collect data directly from children under 16 outside of an authorised school relationship. Parents can request access, correction, or deletion of their child's data by contacting the school.
We use first-party cookies and local storage strictly to keep you signed in, remember your preferences, and protect against abuse. We do not use third-party advertising cookies. You can clear cookies at any time; doing so will sign you out.
Material changes will be communicated at least fourteen (14) days before they take effect. The current version is always available at this page.
Questions about this policy can be sent to privacy@miuttek.com.
Have questions? Contact us · Also see our Terms of Service