Nzureal operates a cloud-based School Enterprise Resource Planning (ERP) platform designed for educational institutions in Kenya. This Privacy Policy outlines how we collect, use, disclose, and protect information when schools, parents, and administrators utilize our platform. In strict adherence to the Kenyan Data Protection Act (2019), Nzureal operates primarily as a Data Processor on behalf of the educational institution (the school), which acts as the Data Controller.
For students under the age of 18, processing is initiated dynamically when a parent or legal guardian signs up, creates an account, and explicitly grants consent to onboard their child onto the platform.
The school warrants that it has the necessary legal authority to utilize our ERP system to process administrative, financial, and academic records across all active terms.
We handle data systematically across targeted modules to maintain standard school ecosystem functions:
To prevent unauthorized internal access, database visibility is strictly compartmentalized based on system roles:
Data is processed via encrypted cloud instances, currently utilizing Supabase Cloud infrastructure with a scheduled architecture migration to high-performance dedicated virtual private servers hosted on Contabo VPS. All transaction records and body payloads are programmatically sanitized against structural database injection parameters.
Production data is held for exactly 30 days following contract termination before full server wiping execution.
A verified full data compilation layout copy is handed back securely to the school administration inside the offboarding phase.
Automated midnight backups operate on a strict 7-day rolling cycle, after which older logs are completely destroyed.