Privacy policy

Last updated: 12 October 2026

This policy explains how NUELAS COLLEGE ("the college", "we") collects and uses personal data in the NUELAS COLLEGE Learning Management System ("the LMS"). The college is the data controller. We handle personal data in line with the Kenya Data Protection Act, 2019.

1. Data we use

From the college's student and staff records (the college management system):

• Students: name, admission number, course, level, study mode, module dates, phone number and email address.
• Staff: name, username, role, phone number and email address.
• Fee balances and statements, shown to the student they belong to.

Created when you use the LMS:

• Your password, stored in encoded form.
• Sign-in records: date and time, IP address, and the type of browser and device you used (for example "Chrome on Android").
• Learning activity: lessons opened and completed, quiz answers and scores, assignment submissions and grades.
• Files and content that lecturers and students upload.
• One-time codes sent to you by SMS or email, stored in encoded form and deleted from use once they expire.

If you use the contact form on our home page: your name, email address, phone number (if you give it), who you are (for example a prospective student) and your message, together with your IP address and browser type to help us block spam.

2. Why we use it

• To let you sign in securely and keep your account safe, including limiting each student account to one device at a time.
• To deliver courses, assessments and progress tracking.
• To show students their fees.
• To send account messages such as verification codes and password resets.
• To keep an audit record of important account actions for security.
• To reply to messages sent through the contact form.

We use this data to provide education and services you are enrolled in or employed for. We do not sell personal data or use it for advertising.

3. Cookies

The LMS uses only the cookies it needs to work: a session cookie that keeps you signed in, a security cookie that protects forms, and a device cookie that identifies a student's registered device. When you watch a course video, the YouTube player may set its own cookies; see Google's privacy policy below.

4. YouTube API Services

The LMS uses YouTube API Services to host course videos on the college's own YouTube channel. By watching or uploading videos in the LMS, you also agree to the YouTube Terms of Service, and your use of YouTube is covered by the Google Privacy Policy.

• Whose Google account: only the college's own YouTube channel, connected by a college administrator. The LMS never asks students or lecturers for their Google accounts.
• What the LMS accesses: the channel's name and ID, the videos the LMS itself uploads, and their processing status.
• What it stores: the channel name and ID, the IDs of videos it uploaded, and an encrypted access token that lets it upload on the college's behalf.
• How it is used: only to upload course videos as Unlisted, check when they are ready, play them inside lessons, and delete videos the LMS uploaded when a lecturer removes them. It is not used for anything else and is not shared with anyone.
• Revoking access: an administrator can disconnect YouTube at any time in the LMS (Integrations → YouTube), which deletes the stored token. Access can also be removed from the Google account's security settings.

The LMS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Who we share data with

We share personal data only with service providers that run parts of the LMS for the college, and only what they need:

• Our hosting and file storage providers, which store the LMS and uploaded files.
• Our SMS and email providers, which receive your phone number or email address and the message to deliver.
• YouTube (Google), which hosts the course videos uploaded to the college channel.

We may also disclose data where the law requires it.

6. How long we keep it

• Students can use the LMS for as long as they are active students of the college. Access ends when the college records that they have completed or left their studies.
• Security and audit records are kept for two years.
• Contact form messages are kept for up to two years, then deleted.
• Learning records are kept as part of the college's academic records, in line with college policy and the law.

7. How we protect it

Connections to the LMS are encrypted (HTTPS). Passwords and codes are stored in encoded form, the YouTube access token is encrypted, uploaded files are private and opened only through short-lived links, and staff can see only the student data their role needs.

8. Your rights

Under the Kenya Data Protection Act, 2019, you may ask to see the personal data we hold about you, ask us to correct or delete it, or object to how it is used. Contact The College Administration using the details below. If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner.

9. Changes

We may update this policy. The date at the top shows when it last changed.

10. Contact

• NUELAS COLLEGE
• Location: Magunas Building, 1st Floor, DB36, Wendani, Nairobi
• Postal address: P.O. Box 3556-00200, Nairobi
• Phone: 0705 890 420
• Email: [email protected]