In short
1. About this policy
Soma360 is a product of Frostwood Limited ("we", "us"). This policy explains how we handle personal data on our website (soma360.co.ke) and in the Soma360 service used by colleges, TVET institutions and training centres. It is written with Kenya's Data Protection Act, 2019 in mind.
2. Our two roles
- Institution records. When an institution uses Soma360, it decides which information about its applicants, students, guardians and staff is recorded, and why. The institution is the data controller for those records. Soma360 processes them on the institution's behalf to provide the service.
- Information you give us directly. When you book a demo, send us a message, register an institution or use your own Soma360 account, Soma360 is responsible for that information.
3. Information we collect
- Forms on our website: your name, institution, email, phone number, institution type and size, and your message.
- Account information: your name, email, phone number and password (stored only as a one-way hash), and two-factor sign-in settings.
- Security and usage information: sign-in times, IP addresses and browser or device details for active sessions, and an audit log of important actions in the service.
- Institution records: the information an institution chooses to enter or import, such as admissions, student, academic, fee, staff and payroll records.
4. How we use information
- To provide, maintain and support the Soma360 service.
- To respond to demo requests and messages, and to follow up on them.
- To send service messages, such as invitations, password resets and notifications.
- To keep accounts secure, for example by slowing repeated failed sign-ins and keeping an audit log.
- To improve the service.
We do not sell personal data, and we do not use advertising or tracking cookies.
5. Who we share information with
- Your institution: records in Soma360 are visible to authorised people at the institution they belong to, according to their roles.
- Service providers: companies that help us provide Soma360, such as email delivery, only to the extent they need to provide their services to us.
- Services an institution connects: if an institution connects its own accounts, such as M-PESA (Safaricom), SMS (Africa's Talking), WhatsApp Business (Meta), card payments (Paystack), Microsoft or Google sign-in, or a video meeting service, the information needed for that service is sent to it under the institution's own agreement with that provider.
- When the law requires it: for example, in response to a valid legal request.
6. How we protect information
Our Security page describes the controls in place, including role-based access, separation between institutions, encrypted connections and two-factor sign-in for privileged roles.
7. How long we keep information
- Institution records are kept while the institution's account is active. Institutions can export their data at any time and can ask us to delete it when they leave Soma360.
- Demo requests and messages are kept for as long as we need them to respond and follow up.
- Security and audit records are kept for as long as they are needed to protect accounts and investigate problems.
8. Your rights
Under the Data Protection Act, 2019 you have the right to be informed about how your data is used, to access it, to object to its processing, and to have false or misleading data corrected or deleted.
- For records held by your college or training centre, contact that institution first. We will help them respond.
- For information you gave us directly, contact us.
- You can also complain to the Office of the Data Protection Commissioner (ODPC) in Kenya.
9. Children
Some students may be under 18. Institutions are responsible for having a lawful basis, including any consent needed from parents or guardians, before recording their information in Soma360.
10. Cookies
See our Cookie Policy for the small number of cookies we use.
11. Changes to this policy
We will update this page when our practices change and show the date of the latest version at the top.
12. Contact
Questions about privacy? Reach us through the contact page or on WhatsApp at 0796 429 489