1. Introduction
La Fontana International Schools (“we,” “our,” “us”) is committed to protecting the privacy and security of all students, parents, staff, and visitors. This policy explains how we collect, use, store, and protect your personal information in accordance with the Kenyan Data Protection Act, 2019.

2. Information We Collect
We may collect and process the following data:

• Student Data: Full name, date of birth, nationality, identity or passport number, health and medical information, academic records, photographs, and emergency contact details.
• Parent/Guardian Data: Full name, contact information (address, email, phone), identity documents, financial information for fee payment, and occupation.
• Staff Data: Information provided during recruitment, including CVs, references, qualifications, national ID, KRA PIN, NSSF details, and bank information.

3. How We Use Your Information
We use your information for:

• Student registration, academic administration, and safeguarding.
• Communication with parents about school activities, progress, and emergencies.
• Processing fee payments and managing accounts.
• Ensuring the health, safety, and welfare of all students.
• Fulfilling our legal and regulatory obligations.
• With explicit consent, for marketing purposes (e.g., school newsletters).

4. Legal Basis for Processing
We process your data on the grounds of:

• Performance of a contract (e.g., enrolment agreement).
• Compliance with a legal obligation.
• Protection of the vital interests of a data subject (e.g., in a medical emergency).
• Your explicit consent, which you can withdraw at any time.

5. Data Sharing and Disclosure
We will not share your personal data with third parties without your consent, except:

• To relevant government bodies as required by law (e.g., Ministry of Education).
• To trusted service providers under strict confidentiality agreements (e.g., cloud storage, school management software).
• In cases of safeguarding concerns, where it is necessary to share information with child protection services or the police.

6. Data Security
We have implemented robust technical and organizational measures to prevent unauthorized access, loss, or misuse of your data.

7. Your Rights
Under the Data Protection Act, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data (where applicable).
• Object to or restrict the processing of your data.
• Data portability.

8. Changes to This Policy
We may update this policy periodically. The latest version will always be available on our website.