1.0 Introduction

DeKUT respects the privacy of its staff, students and other stakeholders and is forever committed to protect their personal data. This privacy statement underlines the statement in regard to processing the personal data in line with the Data Protection Act, 2019. It explains the range of personal data that DeKUT collects and how it is processed. This policy statement should be read along with the Terms and Conditions of Service (ToS) and other University policies. The Statement applies to members of staff, students, parents /guardians and all other parties engaging with DeKUT under contractual agreements.

2.0 Definition of terms

1. Personal data- This is information relating to an identified or identifiable natural person who can be identified from the data. Personal data may include the bio data such as name, sex, marital status, date of birth, place of birth, personal file number, religion, ethnicity, country of origin, occupation, mobile phone number, photographs etc about the individual;
2. Data Subject – This is the person whose data is subject to being processed;
3. Consent–This is granting of permission by the data subject to process his/her personal data;
4. Processing – This means any operation or set of operations which is performed on personal data;
5. Sensitive personal data – This refers to data revealing the natural person’s race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details including names of person’s children, parents, spouse or spouses, sex or the sexual orientation of the data subject;
6. Identifiable natural person – This means a person who can be identified directly or indirectly, by reference to an identifier such as name, personal  identification number, location data an online identifier etc
7. vii) Data Controller – This is the natural or legal person, public authority, agency or other body which alone or jointly determines the purpose and means of processing personal data; In this case this refers to DeKUT;
8. Data Processor - This means a natural or legal person, public authority, agency or other body which processes personal data on behalf of a Data Controller;
9. Data Protection Officer – This is a designated officer who supervises, monitors and reports compliance of the Data Protection Act, 2019;
10. Encryption – this means the process of converting the content of any readable data using technical means into a coded form;
11. Health Data – This is data related to the state of physical or mental health of the data subject and it includes records regarding the past, present or future state of health, data collected in the course of registration for, or provision of health services;

3.0 Data Subject Categories

1. Students;
2. Parents / Guardians;
3. Members of staff;
4. Suppliers;
5. Visitors

40. Personal data collected by DeKUTand its purpose

Documents generated for staff members

Documents generated for students

5.0 Other personal data collected within the premises

• DeKUT records and retains Closed Circuit Television (CCTV) surveillance data from CCTV devices installed at different locations to provide safe and secure environment in the premises;
• Vehicle data is collected at the DeKUTs entry points;
• We record and retain data of visitors (names, company/institution details, phone numbers, car registration details, national identity card numbers and vehicle registration numbers) of visitors. The information is collected for the legitimate interest in securing the premises, staff, students and visitors;

6.0 How DeKUT collects personal data

• By filling application forms either physically or electronically;
• Correspondence either by phone, emails, social media platforms;
• When you visit our website and submit information;
• Through CCTV footages;
• By visiting the customer touch points (customer care desks and entry points);
• Dropping of documents in the offices;
• From other parties you have consented to share with us eg. Banks, HELB;

7.0 Lawful basis for processing information

Personal data will be processed based on the lawful basis as provided by section 30 of the Data Protection Act, 2019;

8.0 Rights of a Data Subject

The data subject has the right to:-

1. be informed of the use to which their personal data is to be put;
2. update personal held by the data controller;
3. to correct data held by the data controller;

9.0 Safeguarding and Protection of Information

DeKUT is committed to ensuring security and integrity in handling personal data and observing confidentiality;

10.0 Contact for Data Protection Office

Data Protection Officer

C/o Human Resource Office

P. o. Box 657 – 10100

NYERI

0715 086810

dataprotection@dkut.ac.ke

11.0 Amendments to Privacy Statement

Any amendments / modifications to the Privacy Statement will be made communicated in the document via the University websitewww@dkut.ac.ke