Privacy Policy

Cynk Analytics ("Cynk", "we", "us") supplies the Cynk platform to schools and educational institutions ("the School").

The School is the data controller of the student, guardian and staff information entered into the platform: the School decides what data is collected and how it is used. Cynk acts as a data processor, handling that data only on the School's documented instructions and only to deliver the service.

For information we collect directly — for example enquiries, demo requests or billing contacts — Cynk is the data controller.

• Student data: name, admission number, class and stream, date of birth, gender, guardian contact details, attendance, examination marks, grades, rankings, academic reports and progress records.
• Teacher and staff data: name, staff identifier, subjects taught, contact details, login credentials, timetable allocation and activity within the platform.
• School data: school profile, classes, subjects, streams, examination structures, grading scales and timetables.
• Account and technical data: email address, hashed passwords, device and browser information, IP address, log records and audit trails of actions taken in the system.
• Enquiry data: details you send us by WhatsApp, phone or email when requesting a demo or support.

We do not require sensitive categories of data such as health or biometric information. If a School chooses to record such information in free-text fields, it does so under its own responsibility and legal basis.

Much of the data in the platform relates to learners under the age of eighteen. We do not collect data directly from children, we never use learner data for advertising or profiling, and we never sell it. Learner data is used solely to deliver the academic management, reporting and analytics functions the School has asked for.

Consent and notification to parents or guardians, where required by law, remain the responsibility of the School as data controller.

• To operate student records, examinations, grading, reporting and timetabling.
• To generate academic performance analytics and insights for authorised staff.
• To authenticate users and maintain security and audit logs.
• To provide technical support, training and onboarding.
• To maintain, troubleshoot and improve the reliability of the service.
• To meet legal, regulatory and contractual obligations.

We do not use School, teacher or student data to train third-party artificial intelligence models, and we do not disclose it for marketing purposes.

Where data protection law applies — including the Kenya Data Protection Act, 2019 and, where relevant, the GDPR — processing is carried out on the basis of the contract with the School, the School's legitimate interests in administering education, compliance with legal obligations, and consent where consent is required and has been obtained by the School.

Access to data within a School's account is role-based. Teachers see only the classes and subjects assigned to them; administrators see school-wide information. Cynk personnel do not access School data except where strictly necessary to resolve a reported support issue, under confidentiality obligations and with the action recorded.

• Encryption of data in transit using TLS.
• Encryption of data at rest on our hosting infrastructure.
• Passwords stored using industry-standard one-way hashing.
• Role-based permissions and per-school data isolation.
• Regular automated backups with restoration testing.
• Audit logging of significant actions such as marks entry and record changes.

No system can be guaranteed absolutely secure, but we apply appropriate technical and organisational measures proportionate to the sensitivity of education data.

We share data only with vetted service providers required to run the platform — cloud hosting, database, email or messaging delivery — each bound by confidentiality and data protection terms. We may also disclose data where compelled by law or a valid order from a competent authority. We never sell personal data.

Our infrastructure providers may process data on servers outside your country. Where this happens, we require appropriate safeguards and contractual protections consistent with applicable data protection law.

We retain School data for as long as the School holds an active account. On termination, the School may request a full export of its data. Unless a longer period is required by law, we delete or irreversibly anonymise School data within ninety (90) days of account closure. Backups are purged on their normal rotation cycle.

Individuals may request access to their data, correction of inaccurate data, deletion, restriction of processing, objection, and portability. Because the School is the controller of student and staff records, requests should be made first to the School, which we will support promptly. Enquiries may also be sent to us directly and will be answered within thirty (30) days.

If a personal data breach occurs that is likely to affect a School's data, we will notify the affected School without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of it, together with the facts known, the likely consequences, and the remedial measures taken.

The platform uses strictly necessary cookies and similar storage to keep users signed in and maintain session security. We do not use advertising or cross-site tracking cookies.

We may update this policy from time to time. Material changes affecting Schools will be communicated in advance through the platform or by email, and the revision date above will be updated.

Data protection enquiries: cynkclem@gmail.com or phone / WhatsApp 0745 027 997.

See also our Terms of Service.