Privacy notice

Who is responsible

The Legislative Centre operates TLC Academy and is responsible for the personal information it collects for Academy services. This notice covers the Academy website, learner and staff portals, enquiries, programme delivery and certificate verification. An employer, sponsoring institution or external website may also process information under its own notice.

For questions or to exercise your rights, use the contact routes below and mark your request ‘Privacy’. You do not need to enrol or buy a programme to make a privacy request.

Information we collect

Account and contact information: your name, email, profile details, organisation and role where provided; sign-in and account-security records; and information you send with an enquiry or support request. We collect a phone number where needed for payment or where you choose to provide it.

Learning information: enrolments, invitations, programme versions, progress, saved practice, submissions, assessment answers and results, feedback, attendance, completion decisions and certificate records. Please use fictional or appropriately anonymised examples in coursework and avoid uploading confidential institutional records or other people’s personal information without authority.

Transaction information: orders, invoices, discounts, payer references, payment status, M-Pesa receipt and reconciliation details, and refund records. We do not ask for your M-Pesa PIN, bank password or sign-in codes.

Technical information: network addresses, request and security logs, browser or device information made available with requests, and essential session cookies. A hashed network identifier is used to limit repeated certificate-verification and enquiry requests. Accessibility information is collected only when you choose to share it; describe the adjustment you need rather than sending a medical history.

Why we use it and our legal bases

We use information to respond to requests, administer accounts and orders, provide learning and assessment, support learners, manage institutional places and issue or verify credentials. Processing necessary to supply a service you request is based on taking steps towards, or performing, that service contract.

We also process information to meet applicable accounting, tax and legal duties. Our legitimate interests include keeping the service secure, preventing fraud, maintaining reliable assessment and credential records, resolving complaints and improving delivery; we balance those interests against your rights.

Where consent is required, including optional publicity, marketing or sensitive information used for an adjustment, we seek it separately and explain the purpose. You may withdraw consent for future processing without affecting earlier lawful processing. An enquiry or enrolment is not blanket permission for marketing. We do not sell personal information.

Who can see information

Authorised Academy staff, assigned facilitators and assessors receive access appropriate to their work. Service providers support hosting, authentication, database and file storage, transactional email, payments and technical operations. The Academy’s technology includes Netlify and Supabase; email and M-Pesa payment services are used when enabled. Providers receive information needed for their services, subject to applicable contractual and security requirements.

For an institutional enrolment, the invitation explains the reporting you are asked to accept. Authorised institution managers can receive enrolment status, progress, attendance, completion and certificate status for their learners. This reporting does not include assessment answers, marker comments or private support conversations. Your institution is responsible for its own subsequent use of reports.

Anyone with a certificate number or verification code can check the certificate facts made available through the verification service, including the learner name, programme, issue details and credential status. Marks, submissions, contact details and internal reasons for a decision are not published there. Share certificate references with this visibility in mind.

We may disclose information when legally required, to establish or defend legal claims, or to address a genuine security or safeguarding concern. We limit disclosures to what is necessary. We do not publish your coursework, image or testimonial for promotional use without an appropriate permission.

International processing and protection

Cloud services may process information outside Kenya. Where a transfer is necessary, we must use a lawful transfer basis and appropriate safeguards under Kenyan data-protection law, such as adequate protection and contractual safeguards, or consent where the law permits it. You may ask about the recipients and safeguards relevant to your information.

We use access controls, staff authentication, restricted storage and audit records to protect information. No online service can guarantee complete security. Tell us promptly if you suspect an account or personal-information incident, without sending passwords or authentication codes.

How long we keep information

We retain identifiable information only for as long as necessary for the purpose for which it was collected or a lawful retention requirement. Enquiries and support records are kept while the matter is active and for a proportionate follow-up or dispute period. Learning and assessment evidence is retained for delivery, review, appeals and quality assurance; financial records follow applicable accounting and tax requirements.

A limited credential and audit record may need to remain after a learning account closes so that an issued certificate can still be checked and decisions explained. Legal holds or unresolved disputes can extend retention. When information is no longer needed, it should be securely deleted or anonymised. Account deactivation is not the same as erasure. Ask us for the retention period or criteria applicable to a particular record.

Your choices and rights

Subject to applicable law, you can request information about use of your data, access and a copy, correction, objection or restriction, erasure where applicable, and portability where available. You can withdraw consent or challenge a decision affecting you. We may need proportionate evidence of identity or authority before disclosing or changing records; we will explain any lawful reason a request cannot be fully met.

Assessment may include automated scoring against published rules. Where you believe a result or completion decision is wrong, request a human review through Academy support or the programme’s review process. We do not promise that an objection automatically changes an academic outcome.

You can complain directly to Kenya’s Office of the Data Protection Commissioner without first complaining to us. The official complaint link is provided below. We respond to rights requests within the periods required by applicable law.

Cookies, external services and children

The Academy uses essential cookies for sign-in, session security and short-lived interface messages. Blocking them may prevent account features from working. This notice does not authorise advertising or optional tracking: any such technology requires appropriate notice and choices before use. Linked websites, payment providers and external live-session platforms have their own privacy and cookie practices.

The Academy is designed primarily for adult and professional learners. If a learner is under 18, a parent or guardian should contact us before account creation or enrolment so that suitability and any legally required consent and safeguards can be arranged. We will address information collected from a child without the required authority when brought to our attention.

Updates

We will publish revisions here with a new date and explain significant changes through an appropriate service notice. A new notice does not retrospectively authorise an incompatible use of information.