Privacy Policy
At Epic Academy, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and purchase or access our courses. This policy complies with the Constitution of Kenya and the Kenya Data Protection Act, 2019.
1. Information We Collect
We collect personal data that you voluntarily provide to us when you register on our platform, express an interest in obtaining information about us or our products, or otherwise contact us.
Identity Data: First name, last name, and account username.
Contact Data: Email address, billing address, and phone number(s).
Financial Data: Payment details necessary to process your purchases. Note: We do not store full credit card numbers; these are handled securely by our payment processors.
Technical & Usage Data: IP address, browser type, device information, and data about how you interact with our courses (e.g., video progression, quiz scores).
2. Lawful Basis for Processing
Under the Data Protection Act, 2019, we must have a lawful basis to process your personal data. We process your data under the following bases:
Performance of a Contract: To create your account, process payments, and deliver the educational content you purchased.
Consent: When you opt-in to receive our marketing newsletters or promotional offers. You can withdraw this consent at any time.
Legitimate Interests: To analyze website usage, improve our course offerings, and ensure the security of our platform against fraud or piracy.
Legal Obligation: To comply with Kenyan tax laws, accounting standards, or lawful requests from regulatory authorities.
3. How We Share Your Information
We do not sell, rent, or trade your personal data. We may share your information only in the following specific situations:
Service Providers (Data Processors): We share data with trusted third-party vendors that assist us in operating our platform, including payment gateways, email delivery services, and cloud hosting providers. These processors are contractually bound to keep your data secure.
Legal Compliance: If required by law, subpoena, or other legal processes, we may disclose your information to law enforcement or regulatory bodies in Kenya.
4. Data Security
We implement appropriate technical and organizational security measures designed to protect the security of any personal information we process. This includes encryption, secure socket layer (SSL) technology, and restricted access to data by our staff. However, please remember that no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure.
5. Data Retention
We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by Kenyan law (such as tax or accounting requirements). Once your data is no longer necessary, we will securely delete or anonymize it.
6. Your Rights as a Data Subject
As a resident of Kenya, the Data Protection Act, 2019 grants you specific rights regarding your personal data. You have the right to:
Be Informed: Know how your data is being used.
Access: Request a copy of the personal data we hold about you.
Rectification: Request that we correct any inaccurate or incomplete data.
Erasure (Right to be Forgotten): Request the deletion of your personal data, subject to certain legal exceptions.
Object: Object to the processing of your data for specific purposes, such as direct marketing.
Data Portability: Request the transfer of your data to another service provider in a structured, machine-readable format.
To exercise any of these rights, please contact us via info@epicacademy.ke. We will respond to your request within the statutory timeframe mandated by the ODPC.
7. Cross-Border Data Transfers
Our servers or third-party service providers may be located outside of Kenya. In such cases, we ensure that your personal data receives an adequate level of protection, and we comply with the ODPC's regulations regarding the transfer of personal data outside Kenya.
8. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. The updated version will be indicated by an updated "Effective Date." We encourage you to review this policy frequently.
9. Contact Us & Complaints
If you have questions or comments about this policy, or wish to exercise your data rights, you may contact us at info@epicacademy.ke. If you believe we are unlawfully processing your personal data, you also have the right to complain directly to the Office of the Data Protection Commissioner (ODPC) in Kenya.
